<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="148"><package pkgid="6d0cc9b5e0aafdc48dc4623ba3f9daa97f0c7a01" name="ImageMagick" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="127299cc6bc12324e74331a5a9860ca6b8bec325" name="ImageMagick" arch="src">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="341ea10d4ce31fc4fc22e9b478c5fd70e4e01bb4" name="ImageMagick" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="d4892acd19a6853cec32b479cdb4b7138cad23b1" name="ImageMagick-devel" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="8b30421ed2ef4d1b3d9d55739351ab5d184409dc" name="ImageMagick-devel" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="b09d9a4b03db9878d8b5433581c80f9e25b36131" name="ImageMagick-extra" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="1a5e84b2c6a40a3781750db36d05864efde4c275" name="ImageMagick-extra" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="e8077beea476a7c645cfb182e0171b56df2a8d2f" name="apache2-mod_php5" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="3a12a5ad574459fb61d50c019e2bc760c173c32a" name="apache2-mod_php5" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9c719190803779c9e6b4fd5675e5cd9f47d98e81" name="imap" arch="i586">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="fe34b4c7e94481949ca13dae85eaea3857422ecf" name="imap" arch="src">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="arvin@suse.de" date="1064404800">- updated to version 2002e (minor release with primarily bugfixes)</changelog>
<changelog author="arvin@suse.de" date="1067601600">- build rpms as non-root user</changelog>
<changelog author="kukuk@suse.de" date="1074254400">- Add pam-devel to neededforbuild</changelog>
<changelog author="arvin@suse.de" date="1077883200">- add %run_ldconfig</changelog>
<changelog author="arvin@suse.de" date="1084276800">- updated to version 2004
- enable IPv6 support</changelog>
<changelog author="arvin@suse.de" date="1089979200">- updated to version 2004a (bugfix release)</changelog>
<changelog author="arvin@suse.de" date="1095076800">- fixes for mailbox access over rsh and ssh (bug #43905)</changelog>
<changelog author="kukuk@suse.de" date="1100520000">- Use common-* PAM config files in imap.pamd and pop.pamd</changelog>
<changelog author="arvin@suse.de" date="1103025600">- updated to version 2004b RC1</changelog>
<changelog author="arvin@suse.de" date="1106308800">- updated to version 2004c</changelog>
<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="dffe8c174a0f080a7d9b75c19901bc44818eec00" name="imap" arch="x86_64">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="3495c566d1e8577062c3c16504c6f397885977d4" name="imap-devel" arch="i586">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="68599ade44bf03465be65e6d1322125c1c9954c4" name="imap-devel" arch="x86_64">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="fcf87d64df5fbfe62b6aecf9dfd501e826ef2908" name="imap-lib" arch="i586">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="dcf726792ce07013a993874fb1b393c04291c66b" name="imap-lib" arch="x86_64">
    <version epoch="0" ver="2006c1_suse" rel="132.2"/>

<changelog author="rommel@suse.de" date="1124712000">- the FreeFork license used by UW says we have to make it clear in the version
  number that we modified the sources; hinted by our license manager</changelog>
<changelog author="rommel@suse.de" date="1128945600">- version update to imap-2004g (includes fix for Bug #120608)</changelog>
<changelog author="seife@suse.de" date="1136980800">- add -fstack-protector</changelog>
<changelog author="schwab@suse.de" date="1137240000">- Don't strip binaries.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="ro@suse.de" date="1138881600">- give libc-client.so a SONAME</changelog>
<changelog author="mskibbe@suse.de" date="1163678400">- update to version 2006c1 which
  o fix bugs
  o fix bug( Bug 217287 - imap-2004g_suse-28: use of dangerous
    "gets" function )
  o fix bug( Bug 144598 - imap-2004g_suse-4: dodgy code )</changelog>
<changelog author="mskibbe@suse.de" date="1172836800">- imap : Support for FATE #300687: Ports for SuSEfirewall added
  via packages (#250579)</changelog>
<changelog author="mskibbe@suse.de" date="1174046400">- fix ports in firewall file</changelog>
<changelog author="mskibbe@suse.de" date="1199707200">- Bug 351197 - several packages use wrong dir for SuSEfirewall2
  services files</changelog>

</package>
<package pkgid="ea00664c51147bc857413cd8910e17b1f961e467" name="libMagick++-devel" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="bddbcd9784a94eaa7db3228d742eed27a559325a" name="libMagick++-devel" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="707b9bdc25f6dbf5911e5e386ed35c287735cdbb" name="libMagick++1" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="fbcc1ba3a3d539d9675ad068f7b1314c66978438" name="libMagick++1" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="bd6f65d1aa9ebf68f6b51671de9ac6451fad3e86" name="libMagickCore1" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="499f81d3335754d6fb690a50e0d285b6d6bd0da6" name="libMagickCore1" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="9dececf030ac9c553055adfc6286590d71e18d22" name="libMagickWand1" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="5b31229a6290f63d0d54c4c74926b4ece8736e31" name="libMagickWand1" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="6e726a61eb7d87f87b51388504e62ab05875efdb" name="libtidy" arch="i586">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="2e5254aaf27e5a1ebeab011350891c93f6933c6d" name="libtidy" arch="x86_64">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="75683a99d133b1e71b7bc5b8a8430abb8343fa71" name="libtidy-devel" arch="i586">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="654a59fded4e4d7fcc2c6e0d65f098a7942661eb" name="libtidy-devel" arch="x86_64">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="dba788ce0621416016953ea0727c77534eba97ca" name="libvuurmuur" arch="i586">
    <version epoch="0" ver="0.7" rel="6.1"/>

<changelog author="halberstadt (at) imageware.de" date="1332590400">- Fixed broken spec.file to build for SLES 11</changelog>

</package>
<package pkgid="a889cec301aa40e7a883851e30733b05720ba6f2" name="libvuurmuur" arch="src">
    <version epoch="0" ver="0.7" rel="6.1"/>

<changelog author="halberstadt (at) imageware.de" date="1332590400">- Fixed broken spec.file to build for SLES 11</changelog>

</package>
<package pkgid="3175ade8bf0c4ce267854e759ab8843446e13d65" name="libvuurmuur" arch="x86_64">
    <version epoch="0" ver="0.7" rel="6.1"/>

<changelog author="halberstadt (at) imageware.de" date="1332590400">- Fixed broken spec.file to build for SLES 11</changelog>

</package>
<package pkgid="f80a96c5bbb7d76af066943ed09be944a99ef7cb" name="mc" arch="i586">
    <version epoch="0" ver="4.6.2" rel="11.2"/>

<changelog author="nadvornik@suse.cz" date="1159963200">- built with --with-samba [#207643]
- fixed displaying of nlink column in utf8 mode [#194715]
- spec file cleanup [#194392]</changelog>
<changelog author="nadvornik@suse.cz" date="1168862400">- fixed special characters quoting for bash 3.2 [#232411]</changelog>
<changelog author="rguenther@suse.de" date="1175515200">- add gpm BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1184673600">- fixed terminal escape sequences parsing (#253401)</changelog>
<changelog author="maw@suse.de" date="1186488000">- Use %fdupes
- Split off a -lang subpackage.</changelog>
<changelog author="olh@suse.de" date="1186833600">- remove umode_t checks
  use offsetof() in vfs-impl.h
  build parallel
  move iconv updates to build section to fix quilt setup -v *.spec</changelog>
<changelog author="nadvornik@suse.cz" date="1188302400">- link duplicate files only inside /usr [#304167]</changelog>
<changelog author="nadvornik@suse.cz" date="1194264000">- updated to 4.6.2-pre1
  * improved subshell handling
  * improved fish filesystem
  * a lot of other fixes and enhancements
- updated UTF-8 patches using Fedora package
- added support for weak rpm dependencies in VFS</changelog>
<changelog author="nadvornik@suse.cz" date="1206964800">- fixed cursor appearance on visible tabs</changelog>
<changelog author="nadvornik@suse.cz" date="1220961600">- added bugfixes from upstream cvs and from debian package for
  * preserve Attributes checkbox [bnc#419832]
  * fish filesystem [bnc#400515]
  * regexp matching
  * lzma support [bnc#400388]
  * other fixes and improvements
- fixed information displayed for rpm files [bnc#410704]
- partialy fixed SHIFT-Fn key behavior [bnc#400552]</changelog>
<changelog author="nadvornik@suse.cz" date="1223553600">- fixed dynamic loading of X11 library
  [http://savannah.gnu.org/bugs/index.php?24505]</changelog>
<changelog author="nadvornik@suse.cz" date="1227787200">- added desktop file [bnc#434809]</changelog>
<changelog author="nadvornik@suse.cz" date="1234440000">- updated to final 4.6.2:
  * many patches mentioned bellow were included upstream</changelog>
<changelog author="sbrabec@suse.cz" date="1235563200">- Fixed Esc + Numeral F-key emulation (mc#287).
- Convert Serbian files to UTF-8.
- UTF-8 conversion moved to %prep.
- Locale specific files moved to -lang package.</changelog>
<changelog author="prusnak@suse.cz" date="1236859200">- added xz support (05_add_lzma_xz_support.patch)</changelog>
<changelog author="nadvornik@suse.cz" date="1241611200">- fixed crash in utf-8 patch [bnc#500516]
- allow to specify port number in the shell link [bnc#483249]</changelog>
<changelog author="nadvornik@suse.cz" date="1242820800">- really apply 05_add_lzma_xz_support.patch</changelog>
<changelog author="coolo@novell.com" date="1247486400">- only things that can be split into bundles can go into -lang
- do not require but recommend the -lang package</changelog>
<changelog author="mseben@novell.com" date="1255262400">- added mc-mkdir_mc_home.patch - create .mc home dir at startup (bnc#533262)</changelog>

</package>
<package pkgid="f88389e74baf8fecfa85f0d1fd496c58bb23feea" name="mc" arch="src">
    <version epoch="0" ver="4.6.2" rel="11.2"/>

<changelog author="nadvornik@suse.cz" date="1149681600">- fixes for Slang2 [#177920, #176327]</changelog>
<changelog author="nadvornik@suse.cz" date="1159963200">- built with --with-samba [#207643]
- fixed displaying of nlink column in utf8 mode [#194715]
- spec file cleanup [#194392]</changelog>
<changelog author="nadvornik@suse.cz" date="1168862400">- fixed special characters quoting for bash 3.2 [#232411]</changelog>
<changelog author="rguenther@suse.de" date="1175515200">- add gpm BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1184673600">- fixed terminal escape sequences parsing (#253401)</changelog>
<changelog author="maw@suse.de" date="1186488000">- Use %fdupes
- Split off a -lang subpackage.</changelog>
<changelog author="olh@suse.de" date="1186833600">- remove umode_t checks
  use offsetof() in vfs-impl.h
  build parallel
  move iconv updates to build section to fix quilt setup -v *.spec</changelog>
<changelog author="nadvornik@suse.cz" date="1188302400">- link duplicate files only inside /usr [#304167]</changelog>
<changelog author="nadvornik@suse.cz" date="1194264000">- updated to 4.6.2-pre1
  * improved subshell handling
  * improved fish filesystem
  * a lot of other fixes and enhancements
- updated UTF-8 patches using Fedora package
- added support for weak rpm dependencies in VFS</changelog>
<changelog author="nadvornik@suse.cz" date="1206964800">- fixed cursor appearance on visible tabs</changelog>
<changelog author="nadvornik@suse.cz" date="1220961600">- added bugfixes from upstream cvs and from debian package for
  * preserve Attributes checkbox [bnc#419832]
  * fish filesystem [bnc#400515]
  * regexp matching
  * lzma support [bnc#400388]
  * other fixes and improvements
- fixed information displayed for rpm files [bnc#410704]
- partialy fixed SHIFT-Fn key behavior [bnc#400552]</changelog>
<changelog author="nadvornik@suse.cz" date="1223553600">- fixed dynamic loading of X11 library
  [http://savannah.gnu.org/bugs/index.php?24505]</changelog>
<changelog author="nadvornik@suse.cz" date="1227787200">- added desktop file [bnc#434809]</changelog>
<changelog author="nadvornik@suse.cz" date="1234440000">- updated to final 4.6.2:
  * many patches mentioned bellow were included upstream</changelog>
<changelog author="sbrabec@suse.cz" date="1235563200">- Fixed Esc + Numeral F-key emulation (mc#287).
- Convert Serbian files to UTF-8.
- UTF-8 conversion moved to %prep.
- Locale specific files moved to -lang package.</changelog>
<changelog author="prusnak@suse.cz" date="1236859200">- added xz support (05_add_lzma_xz_support.patch)</changelog>
<changelog author="nadvornik@suse.cz" date="1241611200">- fixed crash in utf-8 patch [bnc#500516]
- allow to specify port number in the shell link [bnc#483249]</changelog>
<changelog author="nadvornik@suse.cz" date="1242820800">- really apply 05_add_lzma_xz_support.patch</changelog>
<changelog author="coolo@novell.com" date="1247486400">- only things that can be split into bundles can go into -lang
- do not require but recommend the -lang package</changelog>
<changelog author="mseben@novell.com" date="1255262400">- added mc-mkdir_mc_home.patch - create .mc home dir at startup (bnc#533262)</changelog>

</package>
<package pkgid="af1fd126276b037c9bce958dba9012c234cf8a77" name="mc" arch="x86_64">
    <version epoch="0" ver="4.6.2" rel="11.2"/>

<changelog author="nadvornik@suse.cz" date="1159963200">- built with --with-samba [#207643]
- fixed displaying of nlink column in utf8 mode [#194715]
- spec file cleanup [#194392]</changelog>
<changelog author="nadvornik@suse.cz" date="1168862400">- fixed special characters quoting for bash 3.2 [#232411]</changelog>
<changelog author="rguenther@suse.de" date="1175515200">- add gpm BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1184673600">- fixed terminal escape sequences parsing (#253401)</changelog>
<changelog author="maw@suse.de" date="1186488000">- Use %fdupes
- Split off a -lang subpackage.</changelog>
<changelog author="olh@suse.de" date="1186833600">- remove umode_t checks
  use offsetof() in vfs-impl.h
  build parallel
  move iconv updates to build section to fix quilt setup -v *.spec</changelog>
<changelog author="nadvornik@suse.cz" date="1188302400">- link duplicate files only inside /usr [#304167]</changelog>
<changelog author="nadvornik@suse.cz" date="1194264000">- updated to 4.6.2-pre1
  * improved subshell handling
  * improved fish filesystem
  * a lot of other fixes and enhancements
- updated UTF-8 patches using Fedora package
- added support for weak rpm dependencies in VFS</changelog>
<changelog author="nadvornik@suse.cz" date="1206964800">- fixed cursor appearance on visible tabs</changelog>
<changelog author="nadvornik@suse.cz" date="1220961600">- added bugfixes from upstream cvs and from debian package for
  * preserve Attributes checkbox [bnc#419832]
  * fish filesystem [bnc#400515]
  * regexp matching
  * lzma support [bnc#400388]
  * other fixes and improvements
- fixed information displayed for rpm files [bnc#410704]
- partialy fixed SHIFT-Fn key behavior [bnc#400552]</changelog>
<changelog author="nadvornik@suse.cz" date="1223553600">- fixed dynamic loading of X11 library
  [http://savannah.gnu.org/bugs/index.php?24505]</changelog>
<changelog author="nadvornik@suse.cz" date="1227787200">- added desktop file [bnc#434809]</changelog>
<changelog author="nadvornik@suse.cz" date="1234440000">- updated to final 4.6.2:
  * many patches mentioned bellow were included upstream</changelog>
<changelog author="sbrabec@suse.cz" date="1235563200">- Fixed Esc + Numeral F-key emulation (mc#287).
- Convert Serbian files to UTF-8.
- UTF-8 conversion moved to %prep.
- Locale specific files moved to -lang package.</changelog>
<changelog author="prusnak@suse.cz" date="1236859200">- added xz support (05_add_lzma_xz_support.patch)</changelog>
<changelog author="nadvornik@suse.cz" date="1241611200">- fixed crash in utf-8 patch [bnc#500516]
- allow to specify port number in the shell link [bnc#483249]</changelog>
<changelog author="nadvornik@suse.cz" date="1242820800">- really apply 05_add_lzma_xz_support.patch</changelog>
<changelog author="coolo@novell.com" date="1247486400">- only things that can be split into bundles can go into -lang
- do not require but recommend the -lang package</changelog>
<changelog author="mseben@novell.com" date="1255262400">- added mc-mkdir_mc_home.patch - create .mc home dir at startup (bnc#533262)</changelog>

</package>
<package pkgid="e8deae6dd9e56546704aedb756ca8ffde5a37276" name="mc-lang" arch="i586">
    <version epoch="0" ver="4.6.2" rel="11.2"/>

<changelog author="nadvornik@suse.cz" date="1159963200">- built with --with-samba [#207643]
- fixed displaying of nlink column in utf8 mode [#194715]
- spec file cleanup [#194392]</changelog>
<changelog author="nadvornik@suse.cz" date="1168862400">- fixed special characters quoting for bash 3.2 [#232411]</changelog>
<changelog author="rguenther@suse.de" date="1175515200">- add gpm BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1184673600">- fixed terminal escape sequences parsing (#253401)</changelog>
<changelog author="maw@suse.de" date="1186488000">- Use %fdupes
- Split off a -lang subpackage.</changelog>
<changelog author="olh@suse.de" date="1186833600">- remove umode_t checks
  use offsetof() in vfs-impl.h
  build parallel
  move iconv updates to build section to fix quilt setup -v *.spec</changelog>
<changelog author="nadvornik@suse.cz" date="1188302400">- link duplicate files only inside /usr [#304167]</changelog>
<changelog author="nadvornik@suse.cz" date="1194264000">- updated to 4.6.2-pre1
  * improved subshell handling
  * improved fish filesystem
  * a lot of other fixes and enhancements
- updated UTF-8 patches using Fedora package
- added support for weak rpm dependencies in VFS</changelog>
<changelog author="nadvornik@suse.cz" date="1206964800">- fixed cursor appearance on visible tabs</changelog>
<changelog author="nadvornik@suse.cz" date="1220961600">- added bugfixes from upstream cvs and from debian package for
  * preserve Attributes checkbox [bnc#419832]
  * fish filesystem [bnc#400515]
  * regexp matching
  * lzma support [bnc#400388]
  * other fixes and improvements
- fixed information displayed for rpm files [bnc#410704]
- partialy fixed SHIFT-Fn key behavior [bnc#400552]</changelog>
<changelog author="nadvornik@suse.cz" date="1223553600">- fixed dynamic loading of X11 library
  [http://savannah.gnu.org/bugs/index.php?24505]</changelog>
<changelog author="nadvornik@suse.cz" date="1227787200">- added desktop file [bnc#434809]</changelog>
<changelog author="nadvornik@suse.cz" date="1234440000">- updated to final 4.6.2:
  * many patches mentioned bellow were included upstream</changelog>
<changelog author="sbrabec@suse.cz" date="1235563200">- Fixed Esc + Numeral F-key emulation (mc#287).
- Convert Serbian files to UTF-8.
- UTF-8 conversion moved to %prep.
- Locale specific files moved to -lang package.</changelog>
<changelog author="prusnak@suse.cz" date="1236859200">- added xz support (05_add_lzma_xz_support.patch)</changelog>
<changelog author="nadvornik@suse.cz" date="1241611200">- fixed crash in utf-8 patch [bnc#500516]
- allow to specify port number in the shell link [bnc#483249]</changelog>
<changelog author="nadvornik@suse.cz" date="1242820800">- really apply 05_add_lzma_xz_support.patch</changelog>
<changelog author="coolo@novell.com" date="1247486400">- only things that can be split into bundles can go into -lang
- do not require but recommend the -lang package</changelog>
<changelog author="mseben@novell.com" date="1255262400">- added mc-mkdir_mc_home.patch - create .mc home dir at startup (bnc#533262)</changelog>

</package>
<package pkgid="661647689bb11bc66ac2c0fb65c6f0ed9f47277e" name="mc-lang" arch="x86_64">
    <version epoch="0" ver="4.6.2" rel="11.2"/>

<changelog author="nadvornik@suse.cz" date="1159963200">- built with --with-samba [#207643]
- fixed displaying of nlink column in utf8 mode [#194715]
- spec file cleanup [#194392]</changelog>
<changelog author="nadvornik@suse.cz" date="1168862400">- fixed special characters quoting for bash 3.2 [#232411]</changelog>
<changelog author="rguenther@suse.de" date="1175515200">- add gpm BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1184673600">- fixed terminal escape sequences parsing (#253401)</changelog>
<changelog author="maw@suse.de" date="1186488000">- Use %fdupes
- Split off a -lang subpackage.</changelog>
<changelog author="olh@suse.de" date="1186833600">- remove umode_t checks
  use offsetof() in vfs-impl.h
  build parallel
  move iconv updates to build section to fix quilt setup -v *.spec</changelog>
<changelog author="nadvornik@suse.cz" date="1188302400">- link duplicate files only inside /usr [#304167]</changelog>
<changelog author="nadvornik@suse.cz" date="1194264000">- updated to 4.6.2-pre1
  * improved subshell handling
  * improved fish filesystem
  * a lot of other fixes and enhancements
- updated UTF-8 patches using Fedora package
- added support for weak rpm dependencies in VFS</changelog>
<changelog author="nadvornik@suse.cz" date="1206964800">- fixed cursor appearance on visible tabs</changelog>
<changelog author="nadvornik@suse.cz" date="1220961600">- added bugfixes from upstream cvs and from debian package for
  * preserve Attributes checkbox [bnc#419832]
  * fish filesystem [bnc#400515]
  * regexp matching
  * lzma support [bnc#400388]
  * other fixes and improvements
- fixed information displayed for rpm files [bnc#410704]
- partialy fixed SHIFT-Fn key behavior [bnc#400552]</changelog>
<changelog author="nadvornik@suse.cz" date="1223553600">- fixed dynamic loading of X11 library
  [http://savannah.gnu.org/bugs/index.php?24505]</changelog>
<changelog author="nadvornik@suse.cz" date="1227787200">- added desktop file [bnc#434809]</changelog>
<changelog author="nadvornik@suse.cz" date="1234440000">- updated to final 4.6.2:
  * many patches mentioned bellow were included upstream</changelog>
<changelog author="sbrabec@suse.cz" date="1235563200">- Fixed Esc + Numeral F-key emulation (mc#287).
- Convert Serbian files to UTF-8.
- UTF-8 conversion moved to %prep.
- Locale specific files moved to -lang package.</changelog>
<changelog author="prusnak@suse.cz" date="1236859200">- added xz support (05_add_lzma_xz_support.patch)</changelog>
<changelog author="nadvornik@suse.cz" date="1241611200">- fixed crash in utf-8 patch [bnc#500516]
- allow to specify port number in the shell link [bnc#483249]</changelog>
<changelog author="nadvornik@suse.cz" date="1242820800">- really apply 05_add_lzma_xz_support.patch</changelog>
<changelog author="coolo@novell.com" date="1247486400">- only things that can be split into bundles can go into -lang
- do not require but recommend the -lang package</changelog>
<changelog author="mseben@novell.com" date="1255262400">- added mc-mkdir_mc_home.patch - create .mc home dir at startup (bnc#533262)</changelog>

</package>

<package pkgid="9f6bc6f11088d3ccc896eb3fdb861ada33118281" name="mylvmbackup" arch="noarch">
    <version epoch="0" ver="0.13" rel="1.1"/>

</package>

<package pkgid="fb5ce4a595b361fb513ce2940c614f8e34bc96eb" name="mylvmbackup" arch="src">
    <version epoch="0" ver="0.13" rel="1.1"/>

</package>
<package pkgid="f15ce39283e9f25c97bb3e0b690c2a487bb31362" name="perl-PerlMagick" arch="i586">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="4a44a3cdd51aabc0664e54e1a37b6a91f4eacf28" name="perl-PerlMagick" arch="x86_64">
    <version epoch="0" ver="6.4.3.6" rel="28.1"/>

<changelog author="nadvornik@suse.cz" date="1162209600">- fixed overflows in dcm and palm codecs CVE-2006-5456 [#215685]</changelog>
<changelog author="mvaner@suse.cz" date="1171886400">- Array boundaries fix in bezier path (#243280)
  - bezier-array.patch</changelog>
<changelog author="dmueller@suse.de" date="1172577600">- adjust BuildRequires: libexif -&gt; libexif-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1176984000">- updated to 6.3.3-8, see ChangeLog for details
- fixed various crashes on malformed input, including
  CVE-2007-1797 and CVE-2007-1667 [#258253]
- do not build static libs
- adjusted BuildRequires for libjasper-devel</changelog>
<changelog author="nadvornik@suse.cz" date="1185364800">- updated to 6.3.5-3, see ChangeLog for details
- reduced the requrements of the main package,
  created ImageMagick-extra with full set of requirements
- adjusted to Shared Library Policy:
  * created libMagick10 and libWand10
  * renamed ImageMagick-Magick++ -&gt; libMagick++10
  * renamed ImageMagick-Magick++-devel -&gt; libMagick++-devel</changelog>
<changelog author="coolo@suse.de" date="1185624000">- remove requires on ImageMagick-Magick++</changelog>
<changelog author="coolo@suse.de" date="1186142400">- fix provides for ImageMagick-Magick++ (#293401)</changelog>
<changelog author="nadvornik@suse.cz" date="1190721600">- updated to 6.3.5-10: fixes CVE-2007-4985, CVE-2007-4986,
  CVE-2007-4987, CVE-2007-4988 [#327021]</changelog>
<changelog author="pth@suse.de" date="1191844800">- Add libMagick10 to Requires of perl-PerlMagick (#331611)</changelog>
<changelog author="nadvornik@suse.cz" date="1196424000">- updated to 6.3.7-2, see ChangeLog for details
  * fixes conflicts in header files [#340485]</changelog>
<changelog author="nadvornik@suse.cz" date="1196683200">- fixed BuildRequires</changelog>
<changelog author="nadvornik@suse.cz" date="1206532800">- updated to 6.3.9-7, see ChangeLog for details
  * renamed shared library subpackages:
    libMagick10 -&gt; libMagickCore1
    libWand10 -&gt; libMagickWand1
    libMagick++10 -&gt; libMagick++1
  * read EXIF data in TIFF images
  * add -encipher / -decipher options to the command-line utilities
  * many bugfixes and improvements</changelog>
<changelog author="coolo@suse.de" date="1206792000">- fix requires</changelog>
<changelog author="schwab@suse.de" date="1207569600">- Fix PRNG.</changelog>
<changelog author="nadvornik@suse.cz" date="1207742400">- update to 6.4.0-4, see ChangeLog for details
  * mostly bugfixes</changelog>
<changelog author="nadvornik@suse.cz" date="1221048000">- update to 6.4.3-6, see ChangeLog for details</changelog>
<changelog author="thoenig@suse.de" date="1223380800">- add baselibs.conf (libMagickCore1) required by libfprint0-32bit</changelog>
<changelog author="ro@suse.de" date="1228132800">- add libMagicWand1 to baselibs.conf (for libxine1)</changelog>
<changelog author="nadvornik@suse.cz" date="1228478400">- fixed fontconfig detection [bnc#441874]</changelog>
<changelog author="nadvornik@suse.cz" date="1232712000">- backported fix for race condition [bnc#465967]</changelog>

</package>
<package pkgid="ec70b20e6555fbba8919e4df5a65a1280b74befd" name="php5" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="993be8a2169bc23a02578a37f087224d920b633a" name="php5" arch="src">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="5890077e2f9391857c556c88c3afa319713d8b1c" name="php5" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="c538a75828c6f418e94def2cda3971b84bc5cf95" name="php5-bcmath" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="776f04c0bb6a13a25863c327f02dab2b2e9784bb" name="php5-bcmath" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="a2890da954c0b4e90a7f2c6661bff6e468712d48" name="php5-bz2" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="410e33ef3c8e49decb209f4c2c463f968ad99d39" name="php5-bz2" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="8a2ba5a0a73bd0248b51628c9f38c4cdb768503b" name="php5-calendar" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="61869862e36615fadde1d9eb4b22690c96281cea" name="php5-calendar" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="24687322d0c26ceab75ea899d1bc044363cb7554" name="php5-ctype" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="ec073c8b2451cc7d7f32694b5c0db8c2487a406b" name="php5-ctype" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="05cc30ae23e36bc0fc6ded29c4f007329bac1e24" name="php5-curl" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="17424a2f12518d38c1f14a2158fec819ed70251c" name="php5-curl" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9f80b3ecbb74ba5fafeece1579994c2ef49522c7" name="php5-dba" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="932b835419e3fabd9ec0d1ca93c8b65951badffe" name="php5-dba" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="0f173df9765f2fc02cda3b90d21930c72eb00f8b" name="php5-dbase" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="a66f6c30a02ce1f2b4c967b9b408d3f48c87bade" name="php5-dbase" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="2b814f28871822c88b7a51ff07007bf1cccf6c77" name="php5-devel" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="7c1f7751a304da333760b3f48f6bf20b08b3de70" name="php5-devel" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="1ef852e7b5f898c5d56586c69a321e61c71563de" name="php5-dom" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="23f7f228be5042e1b57721664f2cacbf4dca76a0" name="php5-dom" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="2d6133789f028f939aec1731157948cc029eb018" name="php5-exif" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="29a8ddc39f068281e57dd218606fed7fd5a5ca5f" name="php5-exif" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="7d0f76e2fabe73a922b23bf75b596dc67315e840" name="php5-fastcgi" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="94da87bae679655a013752c43c39b89d277821d3" name="php5-fastcgi" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="d851c1b12a88d31fb62acb654dc6330f7cfc0664" name="php5-ftp" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="226d290469da900711fda8d9b5ffdaf1765385bc" name="php5-ftp" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="fdc8f0f8ffbd74cbec32c4701157005426337ec0" name="php5-gd" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9907fdd8ec8d50a34664cecbfc538bcbcb2f4e12" name="php5-gd" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="6cb4ecdefcb5f33a0c12bd0467632ec18ab09231" name="php5-gettext" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9cbda9c0da8884f73e256fac0bdc51a6ad95406f" name="php5-gettext" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="20be705bfb4e686ba13b2939bd7618ab27e7178d" name="php5-gmp" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="fe5c3805db951375d9771ab374de7fbdc076cc99" name="php5-gmp" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="b92f20c33e2914b704ac5ee820f3c42e645fef0e" name="php5-hash" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="24492295473d19efdeb004e70caf04d0be7ffd08" name="php5-hash" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="67873ff5d2d77aee20499fffe28440d7967b5808" name="php5-iconv" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f77d6c6bd5ec337661c88f8b03e793e8f59c6223" name="php5-iconv" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e0ea127e59db4839f2a484a2eab6b042abcff71b" name="php5-imap" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="d74457f49b5a10dcc73e0cd90c5c47131cbe6a0b" name="php5-imap" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="4e7b0bc67a93bd32e77386363f46d46bd235fd6e" name="php5-json" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="3c6455a396db66373767b95277466deed4fadc7f" name="php5-json" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="1fde9d5edf26a27552730eec7ee8d1a85846d00b" name="php5-ldap" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="eec1f401a1afc920956e9eaecfd3acdf6affdc23" name="php5-ldap" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="95cdc4c6777c28fc44aee4e8173229733c16a50a" name="php5-mbstring" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="38476adb72bc343e98f8c87d660e4d5c7499e2b0" name="php5-mbstring" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="75a9ab56b65ac130eca32cadaa8a0259e7b04c92" name="php5-mcrypt" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="084a8757ecd800e3e3fcc9b6f5ff606f67f56fc6" name="php5-mcrypt" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e8720f3c4b4809e04a48f8d529128add63938e77" name="php5-mysql" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="ffc71e6cf8a16778d2939c4c98e0a8ed4d68b4cd" name="php5-mysql" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="0870656a4a6acb238d3bb0df411b0fc08f0c6db2" name="php5-ncurses" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f5d998e6570b38dfcce7ead972e529efff792057" name="php5-ncurses" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="66aa2e90a42eeab0bfbbea301587078cecb8023b" name="php5-odbc" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f0a967f451bf93212397a8a6d0a40f1dbf0e930e" name="php5-odbc" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="56cdcf8cbbe1b305a1ec96f60e5043f65de252cb" name="php5-openssl" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="71e3de6a537bbbf9e2976e13197c637b9786328d" name="php5-openssl" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="713d030020cf6c1c39f799f192f6ac95a9e45ff3" name="php5-pcntl" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9ed7b6b1ca255c05f397a140759cd2b867a39a3f" name="php5-pcntl" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e5aca72af0ef4f5610ae9ce28f65ab7b05592431" name="php5-pdo" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e51beedd6f5062422eff13044f969614915b24bd" name="php5-pdo" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="99a8fb98c13921a0e0d6393612e43783f7b1b787" name="php5-pear" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="5f7eeded0d98a42b03dde520614500fdaabb022e" name="php5-pear" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="8d29cf989967873a5bea31cba52bf59caec84299" name="php5-pgsql" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="4f564768ce000b0b9c28a1edef56b275ea9e8d38" name="php5-pgsql" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="6d8c00711e084bae976a4c6b31b35a70e2c6bf5f" name="php5-posix" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="582da3378f4bb547f8f506ccc60427bf7193837b" name="php5-posix" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="c566033d73010b1d70599e200127d50a02dccb41" name="php5-pspell" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="8093eacf4dd91f170948694f09f4ba4153c5ce2d" name="php5-pspell" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f4e068347f201c3856e754a96a1ecf9c602f5642" name="php5-readline" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e0e7e96fcb8f6b630ecd6692c97910e6f7be9872" name="php5-readline" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="337fd600232cbdeddf7ebd1261dbe5633ae665b4" name="php5-shmop" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="a5c53d47e31412f1ea2247bbf8fcdd0965297736" name="php5-shmop" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="7af716df63fd1d59cbb457e0ac5064f6e32272e1" name="php5-snmp" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="51284bba84984ff5e330ec6ef2487f6ab0f9f8c7" name="php5-snmp" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="74d2b7e117d8a8724b4c76d8f539f6af90315346" name="php5-soap" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="4b5aa1fdf2cd76e6a43a7c93645335e346d264f0" name="php5-soap" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="deb5a536585fb276f71a93ca5e621018564a9afb" name="php5-sockets" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="4ba624705f16899b4f863747ff8d9ec603fdae41" name="php5-sockets" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="0a75c78d6c623ed31b1297658bbdc0091381f2f2" name="php5-sqlite" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="7633c58d0e1251caefba0ef6bf24cc67c7468c42" name="php5-sqlite" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="c780c50bc0f690b0c4a62317edb7c76978bf9c95" name="php5-suhosin" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="a8272dc1465792669eb699f5ff3768bb5bbebf26" name="php5-suhosin" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="df55c124c821f201249560593e3bc4f0e1fff074" name="php5-sysvmsg" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="20ad847b8ab4bb11c6cc5408e6fe7ae6351d5bc0" name="php5-sysvmsg" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="2f87c4f891b18e83f5106a1b472a8d6cdae24240" name="php5-sysvsem" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e7d8d2f8e3268b6cad37e731302baa2ce425ec74" name="php5-sysvsem" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="65181038877055ced837d3a9a95b8a728167fff4" name="php5-sysvshm" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="3bc75ffe37a77672d1a80f9b64a6177ae579da33" name="php5-sysvshm" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="5157787b267da60353cde47ac869fd9cea67b95f" name="php5-tidy" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="8c92dbfeb004a1d96e3419062221a947ea3af2e3" name="php5-tidy" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f68ea4f35cae08060554c1199771c51e63137c03" name="php5-tokenizer" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e117fe1a796e455a9278d65098dc447a5ecb2711" name="php5-tokenizer" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e11c8f5ee26f5be5fae112da2d08be7e05327ef8" name="php5-wddx" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="bf0f5defbd5dcdc4e2efa76e039f86aa3776752a" name="php5-wddx" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="934e3b38526653b44556d895ff5912c35051eb4f" name="php5-xmlreader" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="45549229250f75215e9e538d1cd09de50c7bb16f" name="php5-xmlreader" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="fc8357c7e68eb2a72fb29549c66d87f46c47c6be" name="php5-xmlrpc" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="f1cfd02c70f5fe56637a5e65d83ec0d544722c5b" name="php5-xmlrpc" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="4f0b49d79d1ba32882f013b8f795abdc24cccdb6" name="php5-xmlwriter" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="2430b5545f93b565e24ed1ed88c4152111ab3844" name="php5-xmlwriter" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="fc6e9c2c3bb67fa52d8836befb05102a6be57f70" name="php5-xsl" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="9451d083e6d891e2a4851fcfe7d6ca6c7429fb07" name="php5-xsl" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="6d6a5a4c74b1b5d1d102f94aa26d1ebcf9564b08" name="php5-zip" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="0b08be76a4fb96fc19e3c31d8111480644817a82" name="php5-zip" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="e34efd128699ea00c1c95d865fa6f4574d2787bd" name="php5-zlib" arch="i586">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="0de8eaa8fe1167dca742bf22335ab1d1ec85141d" name="php5-zlib" arch="x86_64">
    <version epoch="0" ver="5.2.6" rel="50.4"/>

<changelog author="crrodriguez@suse.de" date="1188475200">- update to PHP 5.2.4, no relevant changes since RC3.</changelog>
<changelog author="crrodriguez@suse.de" date="1194868800">- update to PHP 5.2.5
  * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
  * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
  * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
  * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
  * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
  * Upgraded PCRE to version 7.3 (Nuno)
  * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
  * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
  * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
  * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
  * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
  * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
  * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
  * Fixed PDO crash when driver returns empty LOB stream. (Stas)
  * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
  * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
  * Fixed leaks with multiple connects on one mysqli object. (Andrey)
  * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
  * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
  * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
  * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
  * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
  * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
  * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
  * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
  * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
  * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
  * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
  * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
  * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
  * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
  * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
  * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
  * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
  * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
  * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
  * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
  * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
  * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
  * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
  * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
  * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
  * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
  * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
  * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
  * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
  * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
  * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
  * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
  * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
  * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
  * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
  * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
  * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
  * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
  * Fixed bug #42326 (SoapServer crash). (Dmitry)
  * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
  * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
  * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
  * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
  * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
  * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)</changelog>
<changelog author="crrodriguez@suse.de" date="1197374400">- use /dev/urandom for generating session-IDs [#337005]
- L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]</changelog>
<changelog author="crrodriguez@suse.de" date="1197547200">- suhosin 0.9.22
  - Fixed function_exists() now checks the Suhosin permissions
  - Fixed crypt() salt no longer uses Blowfish by default
  - Fixed .htaccess/perdir support
  - Fixed compilation problem on OS/X
  - Added protection against some attacks through _SERVER variables
  - Added suhosin.server.strip and suhosin.server.encode</changelog>
<changelog author="crrodriguez@suse.de" date="1198756800">- PHP is leaking file descriptors badly on relative includes
  (php-5.2.5-fdleak.patch)</changelog>
<changelog author="crrodriguez@suse.de" date="1199707200">- Do not hard require php5-timezonedb, instead provide a capability
  php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
  Supplements only when needed.</changelog>
<changelog author="crrodriguez@suse.de" date="1200052800">- Try patch recently published by Redhat that allows PHP to
  use the system timezone database instead of the bundled one.</changelog>
<changelog author="mmarek@suse.cz" date="1201867200">- use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
  enables building in the bs in other projects than server:php
  (bnc#357917)</changelog>
<changelog author="crrodriguez@suse.de" date="1202299200">- update suhosin extension to version 0.9.23
- Fixed suhosin extension now compiles with snapshots of PHP 5.3
- Fixed crypt() behaves like normal again when there is no salt supplied
- wrong Obsoletes causes upgrade trouble [bnc #355618]</changelog>
<changelog author="crrodriguez@suse.de" date="1209729600">- update to PHP 5.2.6
  * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  * Fixed two possible crashes inside the posix extension.
  * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
  * Fixed bug #44141 (private parent constructor callable through static function).
  * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
  * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
  * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
  * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
  * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
  * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
  * Fixed bug #42369 (Implicit conversion to string leaks memory).
  * Fixed bug #41562 (SimpleXML memory issue).
  * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
  * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
  * Over 120 bug fixes.</changelog>
<changelog author="schwab@suse.de" date="1210248000">- Don't try to replace libtool.
- Fix alignment violation.
- Don't define feature test macros after system headers.</changelog>
<changelog author="crrodriguez@suse.de" date="1220443200">- do not restart apache after update of mod_php5 [BNC#419508]</changelog>
<changelog author="crrodriguez@suse.de" date="1220875200">- update suhosin to version 0.9.27
  * Fixed problem with suhosin.perdir
    Thanks to Hosteurope for tracking this down
  * Fixed problems with ext/uploadprogress
    Reported by: Christian Stocker
  * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
  * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
  * Added better internal seeding of rand() and mt_rand()</changelog>
<changelog author="crrodriguez@suse.de" date="1223553600">- Using the ArrayObject class leaks and corrupt memory,
  causing a really nasty undefined behaviour in userspace code, whatever
  can happend due to corruption of the symbol table.
  see http://bugs.php.net/bug.php?id=46222 where martian variables
  get created as example.</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- update system timezone support patch to r4
  * added "System/Localtime" tzname which uses /etc/localtime</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results: fix PPC64 regression of gd module [BNC#364518]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- QA Results fixed
  * array_pad "succeeds" when padding with large negative number [BNC#435595]</changelog>
<changelog author="crrodriguez@suse.de" date="1226491200">- fix ext/imap buffer overflows, old API used [#BNC402665]</changelog>
<changelog author="crrodriguez@suse.de" date="1231761600">- VUL-0: php: buffer overflow in ext/mbstring [BNC#462499]
- VUL-0: php5: dir traversal vulnerability in ZipArchive [BNC#464048]
- PHP5: ext/xml is broken due to libxml2 2.7.x changes [BNC#457056]
  * Note that this MUST be submitted AFTER libxml2 update</changelog>
<changelog author="crrodriguez@suse.de" date="1231934400">- libxml version detection of previous fix will never work.
  11.1 version is 2.7.2 not 2.7.3 and presence of XML_PARSE_OLDSAX
  enumeration value cannot be tested with defined()..</changelog>

</package>
<package pkgid="6ec7fba6b75c5529faad6457c78a3be2d7ed23be" name="tidy" arch="i586">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="12996a2b918572ba45afa0a64831e04992f9d0b7" name="tidy" arch="src">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="sierkb@gmx.de" date="1119528000">- Updated tidy to 050623.</changelog>
<changelog author="sierkb@gmx.de" date="1122120000">- Updated tidy to 050723.</changelog>
<changelog author="sierkb@gmx.de" date="1127217600">- Updated tidy to 050913.
- Updated docs to 050706.</changelog>
<changelog author="sierkb@gmx.de" date="1127390400">- To reflect the fact that the Quick Reference and the Manpage can be autogenerated
  through the Tidy Makefile, all instructions to reproduce this manually
  now are removed from the Spec file and are replaced by the much shorter equivalent
  'make doc'.</changelog>
<changelog author="sierkb@gmx.de" date="1127908800">- Removed extra patch for fixing casting issue,
  because the issue now is fixed.</changelog>
<changelog author="sierkb@gmx.de" date="1129550400">- Updated tidy to 051014.</changelog>
<changelog author="sierkb@gmx.de" date="1130414400">- New destination for tidy's header files: /usr/include/tidy rather than /usr/include.
- Spec file clean-up.</changelog>
<changelog author="sierkb@gmx.de" date="1130846400">- Updated tidy to 051027.
- Updated docs to 051021.</changelog>
<changelog author="sierkb@gmx.de" date="1132747200">- Rebuild for SUSE Linux 10.0 OSS (GCC 4.0.2)</changelog>
<changelog author="sierkb@gmx.de" date="1133265600">- Generating also a debug information sub-package.</changelog>
<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>
<package pkgid="fe715392efa0763bc7f3587568901a37d1bc3bdf" name="tidy" arch="x86_64">
    <version epoch="0" ver="1.0" rel="128.2"/>

<changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
<changelog author="sierkb@gmx.de" date="1140609600">- Updated tidy from CVS snapshot 060222.
- Spec file clean-ups:
  - Removed libmxl2 from BuildRequires.
  - Removed authors due to anti-spam strategy.</changelog>
<changelog author="sierkb@gmx.de" date="1150372800">- Rebuild for SUSE Linux 10.1</changelog>
<changelog author="sierkb@gmx.de" date="1158667200">- Updated tidy from CVS snapshot 060919.</changelog>
<changelog author="sierkb@gmx.de" date="1160136000">- Updated tidy from CVS snapshot 061006.</changelog>
<changelog author="sierkb@gmx.de" date="1161691200">- Updated tidy from CVS snapshot 061023.</changelog>
<changelog author="poeml@suse.de" date="1163419200">- copying package from buildservice package to autobuild
  (adding .changes file)</changelog>
<changelog author="ro@suse.de" date="1163419200">- added directory to filelist</changelog>
<changelog author="adrian@suse.de" date="1182427200">- fix changelog entry order</changelog>
<changelog author="crrodriguez@suse.de" date="1235304000">- remove static libraries</changelog>

</package>

</otherdata>