Linux Weekly News

Tartalom átvétel
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Frissült: 19 perc 51 másodperc

[$] LWN.net Weekly Edition for March 24, 2016

cs, 2016-03-24 02:46
The LWN.net Weekly Edition for March 24, 2016 is available.
Kategóriák: Linux

GNOME 3.20

sze, 2016-03-23 20:30
GNOME 3.20 has been released. "This release brings significant improvements to many of our core applications, such as system upgrades and reviews in Software, simple photo editing in Photos and improved search in Files. Improvements to our platform include shortcut help windows which are now available in many applications, a refined font and better control of location services." See the release notes for details.
Kategóriák: Linux

Security advisories for Wednesday

sze, 2016-03-23 20:09

Debian has updated libmatroska (information leak) and pixman (code execution).

Fedora has updated krb5 (F23: null pointer dereference), webkitgtk (F23: multiple vulnerabilities), and webkitgtk4 (F23: denial of service).

openSUSE has updated bind (Leap42.1: two vulnerabilities).

Oracle has updated foomatic (OL6: two vulnerabilities), kernel (OL6: memory leak), krb5 (OL6: two vulnerabilities), and tomcat6 (OL6: Security Manager bypass).

Red Hat has updated foomatic (RHEL6: three vulnerabilities), git (RHEL6,7: code execution), git19-git (RHSCL: code execution), kernel (RHEL6: memory leak), krb5 (RHEL6: two vulnerabilities), nss-util (RHEL6.2, 6.4, 6.5, 6.6, 7.1: code execution), RHOSE (multiple vulnerabilities), and tomcat6 (RHEL6: Security Manager bypass).

Scientific Linux has updated foomatic (SL6: three vulnerabilities), git (SL6,7: code execution), kernel (SL6: memory leak), krb5 (SL6: two vulnerabilities), and tomcat6 (SL6: Security Manager bypass).

SUSE has updated rubygem-actionview-4_1 (SOSC5: two vulnerabilities).

Kategóriák: Linux

[$] KubeCon EU 2016, part 1: Kubernetes 1.2

sze, 2016-03-23 16:44
KubeCon EU, held in London March 10th, was the second conference dedicated to the Kubernetes container orchestration system. The sold-out attendance of 500 showed how popular the project has become since the release of version 1.0 by Google in July 2015. One week after the conference, version 1.2 was released, which included many long-awaited features.

Subscribers can click below for part 1 of our coverage—two talks about new 1.2 features—by guest author Josh Berkus.

Kategóriák: Linux

KDE Plasma 5.6 Release

k, 2016-03-22 21:16
KDE Plasma 5.6 has been released. This version brings many improvements to the task manager, KRunner, activities, and Wayland support. The look and feel has been enhanced with a slicker Plasma theme and smoother widgets. For those that missed having a weather widget, that feature has returned. See the changelog for details.
Kategóriák: Linux

Andy Grove——dead at 79 (Ars Technica)

k, 2016-03-22 20:46
Ars Technica reports that former Intel CEO, chairman, and first employee hired Andy Grove has died. "Intel may have been a footnote in history were it not for Grove. The company started its life making DRAM chips. With this business under pressure from dumped Japanese DRAM, Grove changed the company's direction, deciding to build microprocessors instead. After a few early iterations, this work led to the development of the x86 processor line that made Intel a household name and one of the largest companies in the world. Grove was also instrumental in persuading IBM to use Intel's x86 processors for its newly invented Personal Computer."
Kategóriák: Linux

Security updates for Tuesday

k, 2016-03-22 17:53

CentOS has updated openssh (C7; C6: two vulnerabilities).

Fedora has updated gnome-photos (F23: code execution) and seamonkey (F23: multiple vulnerabilities).

openSUSE has updated shotwell (Leap42.1; 13.2: validate TLS certificates).

Oracle has updated openssh (OL7; OL6: two vulnerabilities).

Red Hat has updated openssh (RHEL7; RHEL6: two vulnerabilities).

Scientific Linux has updated openssh (SL7; SL6: two vulnerabilities).

Ubuntu has updated git (code execution) and webkitgtk (15.10, 14.04: multiple vulnerabilities).

Kategóriák: Linux

Library Freedom Project, Werner Koch win 2015 FSF awards

k, 2016-03-22 10:38
The Free Software Foundation has announced the winners of its 2015 Software Freedom Awards: the Library Freedom Project won the award for projects of social benefit, while GnuPG maintainer Werner Koch received the award for the advancement of free software.
Kategóriák: Linux

Rust's Redox OS could show Linux a few new tricks (InfoWorld)

h, 2016-03-21 20:56
InfoWorld takes a look at Redox OS. "Redox uses Rust for its kernel-level code to provide more memory safety considerations than C allows by default. But the project doesn't simply rewrite Linux in a new language. Redox discards as much from Linux's version of the Unix tradition as it keeps. As explained in the project's wiki and design documents, Redox uses a minimal set of syscalls -- a deliberately smaller subset than what Linux supports so as to avoid legacy bloat. The OS also uses a microkernel design to stay slender, in contrast to Linux's monolithic kernel."
Kategóriák: Linux

Security advisories for Monday

h, 2016-03-21 19:27

Arch Linux has updated git (code execution) and thunderbird (multiple vulnerabilities).

Debian has updated activemq (unsafe deserialization), git (code execution), icedove (multiple vulnerabilities), iceweasel (multiple vulnerabilities), and squid3 (denial of service).

Fedora has updated drupal6-emfield (F23; F22: access bypass), firefox (F23: multiple vulnerabilities), git (F23: code execution), libotr (F23; F22: code execution), libvpx (F23: code execution), mod_auth_mellon (F23: denial of service), proftpd (F23; F22: weak key usage), webkitgtk3 (F23: multiple vulnerabilities), websvn (F23; F22: cross-site scripting), and xen (F23; F22: multiple vulnerabilities).

Gentoo has updated openssl (multiple vulnerabilities).

openSUSE has updated bind (13.2; 13.1; 11.4: two vulnerabilities), bsh2 (13.2: code execution), cgit (13.1; 11.4: code execution), Chromium (13.1: multiple vulnerabilities), git (13.1; 11.4: code execution), and rubygem-actionpack-3_2 (13.2: two vulnerabilities).

SUSE has updated bind (SLE11-SP2,3,4: two vulnerabilities), firefox (SLES10-SP4: multiple vulnerabilities), samba (SLE11-SP4: privilege escalation), tomcat (SLES12: multiple vulnerabilities), and tomcat6 (SLES11-SP4: multiple vulnerabilities).

Kategóriák: Linux

xdg-app 0.5 released

szo, 2016-03-19 00:58

At his blog, Alexander Larsson announces the release of version 0.5 of the GNOME xdg-app application sandboxing framework. The mailing list announcement provides a bit more detail on what is new, such as an API for creating graphical xdg-app front-ends, support for AppData metadata, and a new helper tool for those building app bundles. Larsson notes that his initial goals for the project were "make it possible for 3rd parties to create and distribute applications that work on multiple distributions" and "run applications with as little access as possible to the host. (For example access to the network or the users files.)" With the 0.5 release, he said, he considers the first goal met.

Kategóriák: Linux

Friday's security updates

p, 2016-03-18 18:25

Debian has updated xen (multiple vulnerabilities).

Fedora has updated jenkins (F23; F22: multiple vulnerabilities), jenkins-remoting (F23; F22: multiple vulnerabilities), python-django (F23; F22: multiple vulnerabilities), rubygem-actionpack (F23; F22: code injection), and rubygem-actionview (F23; F22: code injection).

openSUSE has updated Chromium (13.2, Leap 42.1; SLE12 Package Hub: multiple vulnerabilities) and samba (13.2: multiple vulnerabilities).

Scientific Linux has updated OpenAFS (SL 5,6,7: multiple vulnerabilities).

Slackware has updated mozilla-firefox (multiple vulnerabilities).

SUSE has updated samba (SLE12; SLE12-SP1: file permission overwriting).

Ubuntu has updated pam (12.04: multiple vulnerabilities).

Kategóriák: Linux

A Government Error Just Revealed Snowden Was the Target in the Lavabit Case (WIRED)

p, 2016-03-18 00:05
The information is unsurprising, since it has been strongly suspected for years, but its method of disclosure is rather amusing: Edward Snowden was the target when the US government went after the Lavabit email service. In the response to a request that the government unseal more documents in its case against him, Lavabit owner Ladar Levison got more than he bargained for—the target email address, Ed_Snowden@lavabit.com, was not redacted in one place, as WIRED reports. "WIRED spoke with Levison, prior to his learning that the government had made the redaction error, about his struggle to obtain transparency. 'Three years later, I still cannot tell you who they were after. I keep getting asked the question, and I can't answer.' Now, it appears he doesn't have to. The government has answered for him."
Kategóriák: Linux

Security updates for Thursday

cs, 2016-03-17 17:35

CentOS has updated bind (C5; C6; C7: two vulnerabilities), bind97 (C5: two vulnerabilities), kernel (C5: two vulnerabilities, one from 2013), and thunderbird (C5; C6; C7: multiple vulnerabilities).

Mageia has updated dropbear (information disclosure), nss (code execution), putty (code execution), shotwell (multiple vulnerabilities), and thunderbird (multiple vulnerabilities).

openSUSE has updated bsh2 (42.1: code execution), cgit (42.1, 13.2: two code execution flaws), git (42.1, 13.2: two code execution flaws), graphite2 (13.2: multiple vulnerabilities), and rubygem-actionview-4_2 (42.1: code execution).

Oracle has updated bind (OL5; OL6; OL7: two vulnerabilities), bind97 (OL5: two vulnerabilities), kernel (OL5: two vulnerabilities, one from 2013), and thunderbird (OL6; OL7: multiple vulnerabilities).

Red Hat has updated bind (two vulnerabilities), bind97 (RHEL5: two vulnerabilities), and thunderbird (multiple vulnerabilities).

Scientific Linux has updated bind (two vulnerabilities) and thunderbird (multiple vulnerabilities).

SUSE has updated git (SLE11SP4; SLE12SP1: two code execution flaws).

Ubuntu has updated pam (regression in earlier security update).

Kategóriák: Linux

LWN.net Weekly Edition for March 17, 2016

cs, 2016-03-17 02:06
The LWN.net Weekly Edition for March 17, 2016 is available.
Kategóriák: Linux

Stable kernel updates

sze, 2016-03-16 22:21
Greg Kroah Hartman has released stable kernels 4.4.6, 3.14.65, and 3.10.101. Each contains the usual set of important fixes.
Kategóriák: Linux

[$] The Car Hacker's Handbook

sze, 2016-03-16 20:48

No Starch Press recently released a book about working with automotive software systems: The Car Hacker's Handbook: A Guide for the Penetration Tester, written by Craig Smith. The book is an expansion of Smith's popular and widely circulated e-book of the same title. The old version remains available online at no cost, but there is considerably more content in the new revision—enough to make it a tempting purchase not just for automotive-software fans in general, but for those interested in embedded-device security and in reverse engineering other classes of consumer product.


Kategóriák: Linux

[$] Thread-level control with resource groups

sze, 2016-03-16 18:24
The kernel's control-group mechanism allows processes to be divided into groups for the purposes of tracking and resource control. Both the API and underlying implementation of this mechanism have been going through considerable change in recent years. As part of that change, the newer control-group API has lost the ability to separately manage threads within a process, a loss that is not welcome in some quarters. Current work to replace that functionality is not finding an entirely warm reception either, though.
Kategóriák: Linux

Security advisories for Wednesday

sze, 2016-03-16 18:18

CentOS has updated samba (C7; C6: arbitrary file access) and samba4 (C6: arbitrary file access).

Debian has updated spip (two vulnerabilities).

Fedora has updated bind99 (F23: multiple vulnerabilities), firefox (F22: multiple vulnerabilities), and pcre (F22: denial of service).

Oracle has updated kernel (OL5: two vulnerabilities), samba (OL7; OL6: arbitrary file access), and samba4 (OL6: arbitrary file access).

Red Hat has updated kernel (RHEL5: two vulnerabilities), rh-php56-php (RHSCL: multiple vulnerabilities), rh-ror41-rubygem-actionview (RHSCL: two vulnerabilities), ror40 (RHSCL: multiple vulnerabilities), and ruby193 (RHSCL: multiple vulnerabilities).

Scientific Linux has updated kernel (SL5: two vulnerabilities), samba (SL6,7: arbitrary file access), and samba4 (SL6: arbitrary file access).

Slackware has updated git (code execution) and seamonkey (multiple vulnerabilities).

SUSE has updated bind (SLE12: two vulnerabilities), graphite2 (SLE12-SP1: multiple vulnerabilities), java-1_6_0-ibm (SLES11-SP3; SLES10-SP4: multiple vulnerabilities), firefox, nspr, nss (SLE11-SP4: multiple vulnerabilities), sles11sp4-docker-image (SLEM12: multiple vulnerabilities), sles12-docker-image (SLEM12: multiple vulnerabilities), and kernel (SLE12: multiple vulnerabilities).

Ubuntu has updated linux-raspi2 (15.10: multiple vulnerabilities) and pam (multiple vulnerabilities).

Kategóriák: Linux

The first CyanogenMod 13.0 release

sze, 2016-03-16 08:52
The CyanogenMod Android distribution has finally moved into the "Marshmallow" era with CM13.0 Release 1. "We left the M release builds in the oven longer than we thought, but nothing a little graham cracker and chocolate can’t make that much better. CM13.0 brings Android 6.0.1 (r17) goodies such as the battery saving ‘doze’ functionality and new permissions model, alongside the CM features you’d expect." Other changes include the removal of WhisperPush, the removal of the "quick unlock" feature, a switch to the standard Android messaging app, a new "Snap" camera app, and more.
Kategóriák: Linux