String handling is quite different between Python 2 and Python 3, largely because the latter is designed to handle Unicode natively. But those differences make it more difficult for Python-2-based projects to make the move to Python 3. A proposal to add a feature to the language that would make that transition easier has led to a series of massive threads on the python-dev mailing list. A seemingly simple idea has interesting ramifications, both technical and philosophical.

Gentoo has updated activerecord (sql injection), cacti (multiple vulnerabilities, some from 2010), ccid (code execution from 2010), gmime (code execution from 2010), inn (man-in-the-middle attack from 2012), ldns (code execution from 2011), opensc (code execution from 2010), pcsc-lite (code execution from 2010), poppler (multiple vulnerabilities), and sudo (privilege escalation).

Mandriva has updated cups (information disclosure), elinks (does not properly verify SSL certificates), net-snmp (BS1.0; ES5.0: denial of service), php (multiple vulnerabilities, one from 2009), spice (denial of service), and x11-server (code execution).

openSUSE has updated almanah (12.2: does not encrypt its database) and cups (13.1, 12.x: cups.socket is listening on 0.0.0.0).

CentOS has updated augeas (C6: world writable config files) and bind (C6: denial of service).

Debian has updated drupal7 (multiple vulnerabilities).

Fedora has updated libvirt (F20: denial of service), nss (F20: information disclosure), nss-softokn (F20: information disclosure), nss-util (F20: information disclosure), and rubygem-will_paginate (F19; F20: cross-site scripting).

Gentoo has updated asterisk (multiple vulnerabilities).

Mageia has updated cups (information disclosure), elinks (does not properly verify SSL certificates), java-1.7.0-openjdk (multiple vulnerabilities), libxfont (privilege escalation), memcached (multiple vulnerabilities), net-snmp (denial of service), nss (information disclosure), ruby-i18n (cross-site scripting), spice (denial of service), x11-server (code execution), and zabbix (multiple vulnerabilities).

Mandriva has updated java-1.7.0-openjdk (multiple vulnerabilities), libxfont (privilege escalation), and nss (information disclosure).

openSUSE has updated quassel (13.1: information leak).

Oracle has updated augeas (OL6: world writable config files) and bind (OL6: denial of service).

Red Hat has updated augeas (RHEL6: world writable config files) and bind (RHEL6: denial of service).

Scientific Linux has updated augeas (SL6: world writable config files) and bind (SL6: denial of service).

Ubuntu has updated devscripts (code execution), hplip (multiple vulnerabilities), and mysql-5.5, mysql-dfsg-5.1 (multiple vulnerabilities).

Debian has updated libvirt (denial of service), mysql-5.1 (multiple vulnerabilities), and puppet (regression in previous update).

Fedora has updated bind (F20; F19: denial of service) and drupal7-entity (F20; F19: multiple vulnerabilities).

Gentoo has updated curl (multiple vulnerabilities), gnustep-base (multiple vulnerabilities from 2010), libexif (multiple vulnerabilities from 2012), openswan (code execution), perl (multiple vulnerabilities), and virtualbox (multiple vulnerabilities).

openSUSE has updated icinga (12.3: denial of service), libpng16 (13.1: denial of service), openssl (12.2; 12.3; 13.1: denial of service), and v8 (12.2: multiple vulnerabilities).

SUSE has updated ntp (denial of service).

LinuxGizmos is reporting on the Blackphone, a just-announced "ultra-secure" mobile phone to be jointly produced by Geeksphone (who released the Firefox OS developer phones) and security-conscious email vendor Silent Circle. The OS is advertised as "PrivatOS," a security-tuned derivative of Android. The phone is expected to be available in late February, in time to debut at Barcelona's Mobile World Congress. The Blackphone site calls it "the world's first smartphone which prioritizes the user's privacy and control, without any hooks to carriers or vendors," although as LinuxGizmos points out, few other details—including hardware details—are available yet.

Gentoo has updated ntp (denial of service).

Mageia has updated bind (denial of service), dcraw, ufraw (denial of service), nagios (multiple vulnerabilities), openssl (multiple vulnerabilities), and qtr (denial of service).

Mandriva has updated bind (denial of service), ejabberd (information disclosure), librsvg (information disclosure), libxslt (denial of service), memcached (multiple vulnerabilities), nagios (multiple vulnerabilities), nrpe (code execution), openjpeg (multiple vulnerabilities), and openssl (denial of service).

Fedora has updated java-1.7.0-openjdk (F20; F19: many vulnerabilities).

Oracle has updated java-1.7.0-openjdk (OL6; OL5: many vulnerabilities).

Red Hat has updated java-1.7.0-oracle (many vulnerabilities).

Scientific Linux has updated java-1.7.0-openjdk (SL6; SL5: many vulnerabilities).

Ubuntu has updated cups (13.10, 13.04, 12.10: information disclosure) and graphviz (three vulnerabilities).

CentOS has updated java-1.7.0-openjdk (C6; C5: multiple vulnerabilities).

Debian has updated djvulibre (code execution).

openSUSE has updated chromium (13.1: multiple vulnerabilities), ibus-chewing (13.1: password disclosure), icinga (13.1: denial of service), libqt4 (12.3; 12.2: denial of service), libXfont (11.4; 13.1, 12.x: privilege escalation), lightdm-gtk-greeter (13.1, 12.x: denial of service), and lighttpd (13.1, 12.x; 11.4: multiple vulnerabilities).

Red Hat has updated flash-plugin (multiple vulnerabilities) and java-1.7.0-openjdk (RHEL6; RHEL5: multiple vulnerabilities).