Linux Weekly News

Tartalom átvétel
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Frissült: 8 perc 41 másodperc

Security updates for Friday

p, 2016-07-08 16:02

Debian-LTS has updated clamav (update to 0.99.2), icu (three vulnerabilities, two from 2015), and tcpreplay (denial of service).

openSUSE has updated php5 (13.2: multiple vulnerabilities, one from 2015).

Slackware has updated samba (crypto downgrade).

Kategóriák: Linux

LWN.net Weekly Edition for July 8, 2016

p, 2016-07-08 03:23
The LWN.net Weekly Edition for July 8, 2016 is available.
Kategóriák: Linux

10 million Android phones infected by all-powerful auto-rooting apps (Ars Technica)

p, 2016-07-08 00:09
Ars Technica reports on the "HummingBad" malware that has infected millions of Android devices: "Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android." The article is based on a report [PDF] from Check Point, though the article notes that "researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices".
Kategóriák: Linux

Thursday's security advisories

cs, 2016-07-07 15:11

Debian has updated horizon (two vulnerabilities, one from 2015).

openSUSE has updated ImageMagick (13.2: many vulnerabilities, lots from 2014 and 2015) and qemu (42.1: many vulnerabilities, lots from 2015).

Scientific Linux has updated ocaml (SL7: information leak from 2015).

Ubuntu has updated tomcat8 (16.04: denial of service). In addition, Ubuntu has announced the end of life for 15.10 on July 28 and the end of life for 14.04.x hardware-enablement (HWE) stacks on August 4.

Kategóriák: Linux

Debian Edu / Skolelinux Jessie

sze, 2016-07-06 19:41
The Debian Edu team has announced Debian Edu 8+edu0 "Jessie", the latest Debian Edu / Skolelinux release. Debian Edu, also known as Skolelinux, provides a complete solution for schools. Debian Edu 8 is based on Debian 8 "Jessie", update 8.5. "Do you have to administrate a computer lab or a whole school network? Would you like to install servers, workstations and laptops which will then work together? Do you want the stability of Debian with network services already preconfigured? Do you wish to have a web-based tool to manage systems and several hundred or even more user accounts? Have you asked yourself if and how older computers could be used? Then Debian Edu is for you. The teachers themselves or their technical support can roll out a complete multi-user multi-machine study environment within a few days. Debian Edu comes with hundreds of applications pre-installed, but you can always add more packages from Debian."
Kategóriák: Linux

digiKam 5.0.0 is published

sze, 2016-07-06 19:36
The digiKam team has announced the release of digiKam Software Collection 5.0.0. "This release marks almost complete port of the application to Qt5. All Qt4/KDE4 code has been removed and many parts have been re-written, reviewed, and tested. Porting to Qt5 required a lot of work, as many important APIs had to be changed or replaced by new ones. In addition to code porting, we introduced several changes and optimizations, especially regarding dependencies on the KDE project. Although digiKam is still a KDE desktop application, it now uses many Qt dependencies instead of KDE dependencies. This simplifies the porting job on other operating systems, code maintenance, while reducing the sensitivity of API changes from KDE project."
Kategóriák: Linux

LWN weekly edition one day late this week

sze, 2016-07-06 18:51
Those who are anxiously awaiting this week's edition later today (or tomorrow, depending on time zone) will have to wait another day. The US Independence Day holiday fell on Monday, so LWN staff took that day off for barbecues, fireworks, and other festivities. That means the edition will go out sometime in the early morning hours UTC on Friday, July 8. For those who celebrated the holiday, we hope you had a great one; for those who didn't, we certainly hope you had a great day too! We will be back on our normal schedule next week.
Kategóriák: Linux

Security advisories for Wednesday

sze, 2016-07-06 18:37

Arch Linux has updated libarchive (code execution), libreoffice-fresh (code execution), and xerces-c (denial of service).

Debian-LTS has updated sqlite3 (information leak).

Fedora has updated mingw-xerces-c (F23; F22: three vulnerabilities) and xerces-c (F23; F22: two vulnerabilities).

Mageia has updated gimp (use-after-free), iperf (denial of service), libarchive (multiple vulnerabilities), libgd (multiple vulnerabilities), libtorrent-rasterbar (denial of service), php (multiple vulnerabilities), phpmyadmin (multiple vulnerabilities), pidgin (multiple vulnerabilities), squidguard (cross-site scripting), and xerces-c (denial of service).

openSUSE has updated cronic (Leap42.1, 13.2: predictable temporary files), libircclient (Leap42.1; 13.2: insecure cipher suites), and xerces-c (13.2: code execution).

SUSE has updated xen (SLE11-SP3: multiple vulnerabilities - some from 2013).

Ubuntu has updated gimp (15.10, 14.04, 12.04: use-after-free), libimobiledevice (16.04, 15.10, 14.04: sockets listening on INADDR_ANY), libusbmuxd (16.04, 15.10: sockets listening on INADDR_ANY), and tomcat6, tomcat7 (multiple vulnerabilities).

Kategóriák: Linux

[$] Kernel documentation with Sphinx, part 1: how we got here

sze, 2016-07-06 05:13

The last time LWN looked at formatted kernel documentation in January, it seemed like the merging of AsciiDoc support for the kernel's structured source-code documentation ("kernel-doc") comments, was imminent. As Jonathan Corbet, in the capacity of the kernel documentation maintainer, wrote: "A good-enough solution that exists now should not be held up overly long in the hopes that vague ideas for something else might turn into real, working code." Sometimes, however, the threat that something not quite perfect might be merged is enough to motivate people to turn those vague ideas into something real.

Subscribers can click below to see the full story by guest author (and the developer behind most of the Sphinx work) Jani Nikula.

Kategóriák: Linux

KDE Plasma 5.7 Release

k, 2016-07-05 21:18
KDE Plasma 5.7 has been released. This release features the return of the agenda view in the calendar, improvements to the Volume Control applet allow volume control on a per-application basis, improved Wayland support, and more. "This release brings Plasma closer to the new windowing system Wayland. Wayland is the successor of the decades-old X11 windowing system and brings many improvements, especially when it comes to tear-free and flicker-free rendering as well as security. The development of Plasma 5.7 for Wayland focused on quality in the Wayland compositor KWin. Over 5,000 lines of auto tests were added to KWin and another 5,000 lines were added to KWayland which is now released as part of KDE Frameworks 5."
Kategóriák: Linux

Security updates for Tuesday

k, 2016-07-05 19:41

Debian has updated gimp (use-after-free), kernel (multiple vulnerabilities), libvirt (authentication bypass), tomcat7 (denial of service), and wireshark (multiple vulnerabilities).

Debian-LTS has updated pidgin (multiple vulnerabilities).

Fedora has updated gimp (F24: use-after-free), kernel (F23: multiple vulnerabilities), libreoffice (F23: code execution), mbedtls (F24: three vulnerabilities), mediawiki (F24; F23: multiple vulnerabilities), mingw-xerces-c (F24: three vulnerabilities), ntp (F23; F22: multiple vulnerabilities), php (F24; F23; F22: multiple vulnerabilities), php-pecl-zip (F24; F23; F22: two vulnerabilities), phpMyAdmin (F23; F22: multiple vulnerabilities), pypy (F24; F23: startTLS stripping attack), pypy3 (F24: two vulnerabilities), python3 (F23: two vulnerabilities), qemu (F23; F22: multiple vulnerabilities), setroubleshoot-plugins (F23: command injection), and xerces-c (F24: two vulnerabilities).

openSUSE has updated gimp (Leap42.1, 13.2: use-after-free), GraphicsMagick (13.2: multiple vulnerabilities), kinit (Leap42.1, 13.2: privilege escalation), and spice (Leap42.1; 13.2: two vulnerabilities).

Red Hat has updated nodejs010-node-gyp and nodejs010-nodejs-qs (RHSCL: denial of service) and openstack-ironic (RHOSP7 for RHEL7; RHOSP8: authentication bypass).

Slackware has updated thunderbird (multiple vulnerabilities).

Kategóriák: Linux

Kernel prepatch 4.7-rc6

h, 2016-07-04 23:16
The 4.7-rc6 kernel prepatch is out, right on schedule. "I'd love to tell you that things are calming down, and we're shrinking, but that would be a lie. It's not like this is a huge rc, but it's definitely bigger than the previous rc's were. I don't think that's necessarily a big problem, it seems to be mostly timing."
Kategóriák: Linux

Slackware 14.2

szo, 2016-07-02 00:36
Slackware Linux Project has announced the release of Slackware version 14.2. "Slackware 14.2 brings many updates and enhancements, among which you'll find two of the most advanced desktop environments available today: Xfce 4.12.1, a fast and lightweight but visually appealing and easy to use desktop environment, and KDE 4.14.21 (KDE 4.14.3 with kdelibs-4.14.21) a stable release of the 4.14.x series of the award- winning KDE desktop environment. These desktops utilize eudev, udisks, and udisks2, and many of the specifications from freedesktop.org which allow the system administrator to grant use of various hardware devices according to users' group membership so that they will be able to use items such as USB flash sticks, USB cameras that appear like USB storage, portable hard drives, CD and DVD media, MP3 players, and more, all without requiring sudo, the mount or umount command. Just plug and play. Slackware's desktop should be suitable for any level of Linux experience." See the release notes for more details.
Kategóriák: Linux

Rails 5.0 is available

szo, 2016-07-02 00:13

Rails 5.0 has been released. The announcement highlights two new features, the Action Cable framework for handling WebSockets and an "API mode" for interfacing with client-side JavaScript. Development of the latter feature is ongoing; progress can be tracked in the JSONAPI::Resources repository. There are quite a few other new features to be found in the update as well; the release announcement provides links to detailed ChangeLogs for various subprojects.

Kategóriák: Linux

Friday's security updates

p, 2016-07-01 16:13

Debian-LTS has updated libvirt (authentication bypass), qemu (multiple vulnerabilities), qemu-kvm (multiple vulnerabilities), roundcube (cross-site scripting), wget (code execution), and wireshark (multiple vulnerabilities).

Fedora has updated kernel (F24: multiple vulnerabilities), python-django-horizon (F23: cross-site scripting), python3 (F24: StartTLS stripping), squidGuard (F22; F23; F24: cross-site scripting), struts (F23; F24: multiple vulnerabilities), and wordpress (F22; F23; F24: multiple vulnerabilities).

SUSE has updated kernel (SLE11; SLE12; SLE12 GA: multiple vulnerabilities).

Ubuntu has updated oxide-qt (14.04, 15.10, 16.04: multiple vulnerabilities).

Kategóriák: Linux

Linux Mint 18 Cinnamon and MATE editions released

p, 2016-07-01 01:59
Linux Mint 18 has been released with Cinnamon and MATE editions. "Linux Mint 18 is a long term support release which will be supported until 2021. It comes with updated software and brings refinements and many new features to make your desktop even more comfortable to use." The MATE edition has MATE 1.14 along with many other updates listed on the What's New page. The Cinnamon edition has Cinnamon 3.0 (which we recently reviewed) and lots of other new packages described on its What's New page. The release notes pages (MATE, Cinnamon) also have important information on the releases.
Kategóriák: Linux

Extracting Qualcomm's KeyMaster Keys - Breaking Android Full Disk Encryption (Bits Please)

cs, 2016-06-30 22:14
The "Bits Please" blog has a detailed description of how one breaks full-disk encryption on an Android phone. Included therein is a lot of information on how full-disk encryption works on Android devices and its inherent limitations. "Instead of creating a scheme which directly uses the hardware key without ever divulging it to software or firmware, the code above performs the encryption and validation of the key blobs using keys which are directly available to the TrustZone software! Note that the keys are also constant - they are directly derived from the SHK (which is fused into the hardware) and from two 'hard-coded' strings. Let's take a moment to explore some of the implications of this finding."
Kategóriák: Linux

etcd 3.0 released

cs, 2016-06-30 22:03
CoreOS has announced the availability of version 3.0 of the etcd distributed key-value store. "etcd 3.0 marks the first stable release of the etcd3 API and data model. Upgrades are simple, because the same etcd2 JSON endpoints and internal cluster protocol are still provided in etcd3. Nevertheless, etcd3 is a wholesale API redesign based on feedback from etcd2 users and experience with scaling etcd2 in practice. This post highlights some notable etcd3 improvements in efficiency, reliability, and concurrency control."
Kategóriák: Linux

Security updates for Thursday

cs, 2016-06-30 16:52

Debian has updated libcommons-fileupload-java (denial of service), libreoffice (code execution), tomcat8 (multiple vulnerabilities, some from 2015), and xerces-c (denial of service).

Debian-LTS has updated libgd2 (denial of service), php5 (multiple vulnerabilities), and xerces-c (denial of service).

Fedora has updated setroubleshoot (F23; F22: code execution) and xguest (F23: insecure password creation).

Ubuntu has updated libreoffice (16.04, 15.10, 12.04: code execution).

Kategóriák: Linux

[$] LWN.net Weekly Edition for June 30, 2016

cs, 2016-06-30 03:51
The LWN.net Weekly Edition for June 30, 2016 is available.
Kategóriák: Linux