Linux Weekly News

Tartalom átvétel
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Frissült: 24 perc 13 másodperc

Friday's security updates

p, 2016-03-18 18:25

Debian has updated xen (multiple vulnerabilities).

Fedora has updated jenkins (F23; F22: multiple vulnerabilities), jenkins-remoting (F23; F22: multiple vulnerabilities), python-django (F23; F22: multiple vulnerabilities), rubygem-actionpack (F23; F22: code injection), and rubygem-actionview (F23; F22: code injection).

openSUSE has updated Chromium (13.2, Leap 42.1; SLE12 Package Hub: multiple vulnerabilities) and samba (13.2: multiple vulnerabilities).

Scientific Linux has updated OpenAFS (SL 5,6,7: multiple vulnerabilities).

Slackware has updated mozilla-firefox (multiple vulnerabilities).

SUSE has updated samba (SLE12; SLE12-SP1: file permission overwriting).

Ubuntu has updated pam (12.04: multiple vulnerabilities).

Kategóriák: Linux

A Government Error Just Revealed Snowden Was the Target in the Lavabit Case (WIRED)

p, 2016-03-18 00:05
The information is unsurprising, since it has been strongly suspected for years, but its method of disclosure is rather amusing: Edward Snowden was the target when the US government went after the Lavabit email service. In the response to a request that the government unseal more documents in its case against him, Lavabit owner Ladar Levison got more than he bargained for—the target email address, Ed_Snowden@lavabit.com, was not redacted in one place, as WIRED reports. "WIRED spoke with Levison, prior to his learning that the government had made the redaction error, about his struggle to obtain transparency. 'Three years later, I still cannot tell you who they were after. I keep getting asked the question, and I can't answer.' Now, it appears he doesn't have to. The government has answered for him."
Kategóriák: Linux

Security updates for Thursday

cs, 2016-03-17 17:35

CentOS has updated bind (C5; C6; C7: two vulnerabilities), bind97 (C5: two vulnerabilities), kernel (C5: two vulnerabilities, one from 2013), and thunderbird (C5; C6; C7: multiple vulnerabilities).

Mageia has updated dropbear (information disclosure), nss (code execution), putty (code execution), shotwell (multiple vulnerabilities), and thunderbird (multiple vulnerabilities).

openSUSE has updated bsh2 (42.1: code execution), cgit (42.1, 13.2: two code execution flaws), git (42.1, 13.2: two code execution flaws), graphite2 (13.2: multiple vulnerabilities), and rubygem-actionview-4_2 (42.1: code execution).

Oracle has updated bind (OL5; OL6; OL7: two vulnerabilities), bind97 (OL5: two vulnerabilities), kernel (OL5: two vulnerabilities, one from 2013), and thunderbird (OL6; OL7: multiple vulnerabilities).

Red Hat has updated bind (two vulnerabilities), bind97 (RHEL5: two vulnerabilities), and thunderbird (multiple vulnerabilities).

Scientific Linux has updated bind (two vulnerabilities) and thunderbird (multiple vulnerabilities).

SUSE has updated git (SLE11SP4; SLE12SP1: two code execution flaws).

Ubuntu has updated pam (regression in earlier security update).

Kategóriák: Linux

LWN.net Weekly Edition for March 17, 2016

cs, 2016-03-17 02:06
The LWN.net Weekly Edition for March 17, 2016 is available.
Kategóriák: Linux

Stable kernel updates

sze, 2016-03-16 22:21
Greg Kroah Hartman has released stable kernels 4.4.6, 3.14.65, and 3.10.101. Each contains the usual set of important fixes.
Kategóriák: Linux

[$] The Car Hacker's Handbook

sze, 2016-03-16 20:48

No Starch Press recently released a book about working with automotive software systems: The Car Hacker's Handbook: A Guide for the Penetration Tester, written by Craig Smith. The book is an expansion of Smith's popular and widely circulated e-book of the same title. The old version remains available online at no cost, but there is considerably more content in the new revision—enough to make it a tempting purchase not just for automotive-software fans in general, but for those interested in embedded-device security and in reverse engineering other classes of consumer product.


Kategóriák: Linux

[$] Thread-level control with resource groups

sze, 2016-03-16 18:24
The kernel's control-group mechanism allows processes to be divided into groups for the purposes of tracking and resource control. Both the API and underlying implementation of this mechanism have been going through considerable change in recent years. As part of that change, the newer control-group API has lost the ability to separately manage threads within a process, a loss that is not welcome in some quarters. Current work to replace that functionality is not finding an entirely warm reception either, though.
Kategóriák: Linux

Security advisories for Wednesday

sze, 2016-03-16 18:18

CentOS has updated samba (C7; C6: arbitrary file access) and samba4 (C6: arbitrary file access).

Debian has updated spip (two vulnerabilities).

Fedora has updated bind99 (F23: multiple vulnerabilities), firefox (F22: multiple vulnerabilities), and pcre (F22: denial of service).

Oracle has updated kernel (OL5: two vulnerabilities), samba (OL7; OL6: arbitrary file access), and samba4 (OL6: arbitrary file access).

Red Hat has updated kernel (RHEL5: two vulnerabilities), rh-php56-php (RHSCL: multiple vulnerabilities), rh-ror41-rubygem-actionview (RHSCL: two vulnerabilities), ror40 (RHSCL: multiple vulnerabilities), and ruby193 (RHSCL: multiple vulnerabilities).

Scientific Linux has updated kernel (SL5: two vulnerabilities), samba (SL6,7: arbitrary file access), and samba4 (SL6: arbitrary file access).

Slackware has updated git (code execution) and seamonkey (multiple vulnerabilities).

SUSE has updated bind (SLE12: two vulnerabilities), graphite2 (SLE12-SP1: multiple vulnerabilities), java-1_6_0-ibm (SLES11-SP3; SLES10-SP4: multiple vulnerabilities), firefox, nspr, nss (SLE11-SP4: multiple vulnerabilities), sles11sp4-docker-image (SLEM12: multiple vulnerabilities), sles12-docker-image (SLEM12: multiple vulnerabilities), and kernel (SLE12: multiple vulnerabilities).

Ubuntu has updated linux-raspi2 (15.10: multiple vulnerabilities) and pam (multiple vulnerabilities).

Kategóriák: Linux

The first CyanogenMod 13.0 release

sze, 2016-03-16 08:52
The CyanogenMod Android distribution has finally moved into the "Marshmallow" era with CM13.0 Release 1. "We left the M release builds in the oven longer than we thought, but nothing a little graham cracker and chocolate can’t make that much better. CM13.0 brings Android 6.0.1 (r17) goodies such as the battery saving ‘doze’ functionality and new permissions model, alongside the CM features you’d expect." Other changes include the removal of WhisperPush, the removal of the "quick unlock" feature, a switch to the standard Android messaging app, a new "Snap" camera app, and more.
Kategóriák: Linux

Security updates for Tuesday

k, 2016-03-15 18:20

Arch Linux has updated dropbear (information disclosure).

openSUSE has updated python-Pillow (Leap42.1, 13.2: denial of service) and webkit2gtk3 (Leap42.1: multiple vulnerabilities).

Red Hat has updated samba (RHEL6,7: arbitrary file access) and samba4 (RHEL6: arbitrary file access).

SUSE has updated bind (SLE12-SP1: multiple vulnerabilities), sles12sp1-docker-image (SLEM12: multiple vulnerabilities), and tomcat (SLES12-SP1: multiple vulnerabilities).

Ubuntu has updated exim4 (two vulnerabilities), kernel (15.10; 14.04; 12.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiple vulnerabilities), linux-lts-utopic (14.04: multiple vulnerabilities), linux-lts-vivid (14.04: multiple vulnerabilities), linux-lts-wily (14.04: multiple vulnerabilities), and linux-ti-omap4 (12.04: code execution).

Kategóriák: Linux

NetDev 1.1 videos now available

k, 2016-03-15 16:31
Videos from the NetDev 1.1 conference are now available on YouTube. "It took us a while to edit and to upload these ~100 Gbytes of videos, so thanks for your patience." LWN covered several sessions from this event.
Kategóriák: Linux

A (nearly) mainline kernel running on the Nexus 7

k, 2016-03-15 10:26
As was discussed at the 2015 Kernel Summit, there are essentially no commercial Android devices running mainline kernels. At the recently concluded Linaro Connect event, though, John Stultz demonstrated a Nexus 7 tablet running mainline with just a few patches. It even has accelerated graphics via the freedreno driver. "This is really great, because we now have a very-close to mainline test bed on a actual consumer device. So we can make sure upstream doesn't introduce any regressions (just recently, two ABI breaks that affected android were recently caught) and allows us to make sure when we push Android functionality upstream, that any interface changes required by maintainers can be properly tested to make sure what lands upstream really works."
Kategóriák: Linux

Graber: LXD 2.0: Introduction to LXD

k, 2016-03-15 00:45
Stéphane Graber provides an introduction to LXD. "LXD focuses on system containers, also called infrastructure containers. That is, a LXD container runs a full Linux system, exactly as it would be when run on metal or in a VM. Those containers will typically be long running and based on a clean distribution image. Traditional configuration management tools and deployment tools can be used with LXD containers exactly as you would use them for a VM, cloud instance or physical machine."
Kategóriák: Linux

Monday's security advisories

h, 2016-03-14 20:28

Arch Linux has updated bind (multiple vulnerabilities), openssh (command injection), pcre (code execution), pidgin-otr (code execution), wireshark-cli (multiple dissector crashes), wireshark-gtk (multiple dissector crashes), and wireshark-qt (multiple dissector crashes).

Debian has updated exim4 (privilege escalation), graphite2 (multiple vulnerabilities), samba (two vulnerabilities), and wireshark (multiple dissector crashes).

Fedora has updated bind (F23: multiple vulnerabilities), exim (F23; F22: privilege escalation), kernel (F22: denial of service), libssh (F22: insecure ssh sessions), openssh (F23: command injection), openssl (F22: multiple vulnerabilities), perl (F22: ambiguous environment), php (F22: multiple vulnerability), php-htmLawed (F22: unspecified vulnerability), php-udan11-sql-parser (F22: multiple vulnerabilities), phpMyAdmin (F22: multiple vulnerabilities), and samba (F23; F22: incorrect ACL get/set allowed on symlink path).

Gentoo has updated chromium (many vulnerabilities), ffmpeg (many vulnerabilities), flash-player (multiple vulnerabilities), flightgear (two vulnerabilities from 2012), icedtea (multiple vulnerabilities), libreswan (denial of service), oracle-jre-bin (multiple vulnerabilities), qtgui (multiple vulnerabilities), and vlc (multiple vulnerabilities).

openSUSE has updated Adobe (13.1: multiple vulnerabilities), Chromium (13.2: multiple vulnerabilities), Firefox (13.1: multiple vulnerabilities), libotr,libotr2 (13.1: code execution), and firefox (Leap42.1, 13.2: multiple vulnerabilities).

Red Hat has updated flash-plugin (RHEL5,6: multiple vulnerabilities) and openstack-heat (RHELOSP6 for RHEL7; RHELOSP5 for RHEL7; RHELOSP5 for RHEL6: denial of service).

SUSE has updated firefox, nss, nspr (SLE12-SP1: multiple vulnerabilities).

Ubuntu has updated graphite2 (15.10, 14.04: multiple vulnerabilities).

Kategóriák: Linux

The 4.5 kernel has been released

h, 2016-03-14 09:34
Linus has released the 4.5 kernel. "So this is later on a Sunday than my usual schedule, because I just couldn't make up my mind whether I should do another rc8 or not, and kept just waffling about it. In the end, I obviously decided not to, but it could have gone either way." Some of the headline features from the development cycle are dm-verity forward error correction, optional mandatory locking, the new copy_file_range() system call, the SOCK_DESTROY operation, another set of persistent-memory improvements, extended address-space layout randomization on 32-bit systems, the MADV_FREE option for madvise(), the UBSAN checker tool, some extensions to epoll_wait(), project quotas for the ext4 filesystem, and more.
Kategóriák: Linux

Catanzaro: Do you trust this application?

v, 2016-03-13 12:40
Michael Catanzaro laments the poor level of security provided by free-software applications, focusing on TLS verification issues in particular. "In the case of Shotwell, the issue has been fixed in git, but it might never be released because nobody works on Shotwell anymore. I informed distributors of the Shotwell vulnerability three months ago via the GNOME distributor list, our official mechanism for communicating with distributions, and advised them to update to a git snapshot. Most distributions ignored it. This is completely typical; to my knowledge, the stable releases of all Linux distributions except Fedora are still vulnerable."
Kategóriák: Linux

TP-Link blocks open source router firmware to comply with new FCC rule (ars technica)

szo, 2016-03-12 08:54
Ars technica reports that TP-Link will block the loading of third-party firmware on its routers, citing new US Federal Communications Commission rules. "The FCC says it doesn't intend to ban the use of third-party firmware such as DD-WRT and OpenWRT; in theory, router makers can still allow loading of open source firmware as long as they also deploy controls that prevent devices from operating outside their allowed frequencies, types of modulation, power levels, and so on. But open source users feared that hardware makers would lock third-party firmware out entirely, since that would be the easiest way to comply with the FCC requirements."
Kategóriák: Linux

FSF: A preliminary analysis of High Priority Projects feedback

szo, 2016-03-12 01:58

The Free Software Foundation (FSF) has posted an initial analysis of the public feedback submitted in response to its call for suggestions about what software projects deserve to be on the high-priority projects list. Several of the existing projects on the list are likely to be removed, such as a replacement for Google Earth and an automatic-transcription application. Multiple potential additions to the list are also described, such as a free-software "Siri"-like personal assistant and a free-software implementation of advanced PDF features. Further input is welcome; the page notes that the FSF "will strive to recommend projects that are actionable. Such projects document ways for members of the free software community to get involved and make the project succeed, with any kind of concrete contributions, from money donation, to code patches, advocacy, etc."

Kategóriák: Linux

Friday's security updates

p, 2016-03-11 17:57

Arch Linux has updated flashplugin (multiple vulnerabilities) and lib32-flashplugin (multiple vulnerabilities).

CentOS has updated libssh2 (C6; C7: insecure ssh sessions) and xerces-c (C7: code execution).

Fedora has updated firefox (F23: multiple vulnerabilities), kernel (F23: denial of service), and php-htmLawed (F23: unspecified vulnerability).

Mageia has updated bind (M5: multiple vulnerabilities), flash-player-plugin (M5: multiple vulnerabilities), openssh (M5: command injection), php/timezone/php-timezonedb (M5: multiple vulnerabilities), and samba (M5: ACL ownership overwrite).

openSUSE has updated Adobe Flash Player (13.2: multiple vulnerabilities), exim (13.2, Leap 42.1: privilege escalation), libssh (Leap 42.1: insecure ssh sessions), and openssl (Leap 42.1: multiple vulnerabilities).

Oracle has updated libssh2 (O6: insecure ssh sessions) and xerces-c (O7: code execution).

Red Hat has updated xerces-c (RHEL7: code execution).

Scientific Linux has updated libssh2 (SL 6,7: insecure ssh sessions) and xerces-c (SL7: code execution).

Slackware has updated openssh (command injection).

SUSE has updated flash-player (SLE12; SLE11: multiple vulnerabilities).

Ubuntu has updated libotr (12.04: denial of service).

Kategóriák: Linux

A policy statement on open-source software from the White House

p, 2016-03-11 01:44

The White House has announced a draft policy addressing how the U.S. federal government will share and release custom software. "This policy requires that, among other things: (1) new custom code whose development is paid for by the Federal Government be made available for reuse across Federal agencies; and (2) a portion of that new custom code be released to the public as Open Source Software (OSS)."

The full policy document is available at sourcecode.cio.gov, where it has been made available for public comment. The relevant passage regarding public source releases begins by outlining a pilot program. "Each covered agency shall release at least 20 percent of its newly-developed custom code each year as OSS. Custom code is defined as code for all custom software projects, modules, and add-ons that are self-contained. [...] Although the minimum requirement for OSS release is 20 percent of custom code, covered agencies are strongly encouraged to publish as much custom-developed code as possible to further the Federal Government’s commitment to transparency, participation, and collaboration."

Kategóriák: Linux