| |||||||||||||
Welcome to LWN.netHeadlines for May 20, 2013Security advisories for Monday
[Security] Posted May 20, 2013 16:32 UTC (Mon) by ris
Fedora has updated mediawiki (F18; F17: multiple vulnerabilities) and libtiff (F17: buffer overflows). Mageia has updated kernel (multiple vulnerabilities), kernel-linus (multiple vulnerabilities), kernel-tmb (multiple vulnerabilities), kernel-rt (multiple vulnerabilities), and kernel-vserver (multiple vulnerabilities). openSUSE has updated telepathy-idle (certificate validation error) and gnutls (plaintext recovery). SUSE has updated acroread (multiple vulnerabilities), and oracle-update (SM 1.7; SM 1.2: multiple vulnerabilities).
Stable kernels 3.9.3, 3.4.46, and 3.0.79
[Kernel] Posted May 19, 2013 20:16 UTC (Sun) by jake
Greg Kroah-Hartman has announced the release of the 3.9.3, 3.4.46, and 3.0.79 stable kernels. As always, they contain important fixes throughout the tree, so users should upgrade.
NetBSD 6.1
[Distributions] Posted May 19, 2013 19:49 UTC (Sun) by ris
The NetBSD Project has announced NetBSD 6.1, the first feature update of the NetBSD 6 release branch. "It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements." See the changelog for details.
Mageia 3 released
[Distributions] Posted May 19, 2013 13:42 UTC (Sun) by corbet
The much-delayed Mageia 3 release is out. "We dedicate this release to the memory of Eugeni Dodonov, our friend, our colleague and a great inspiration to those he left behind. We miss his brilliance, his courtesy and his dedication." Changes include an RPM upgrade, the 3.8 kernel, availability of GRUB2 (but GRUB is still the default bootloader), and more. See the release notes for lots of details.
Perl 5.18.0 released
[Development] Posted May 19, 2013 13:37 UTC (Sun) by corbet
The Perl 5.18.0 release is out. "Perl v5.18.0 represents approximately 12 months of development since Perl v5.16.0 and contains approximately 400,000 lines of changes across 2,100 files from 113 authors." See this perldelta page for details on what has changed.
Sony opens up the Xperia Tablet Z
[Announcements] Posted May 17, 2013 20:06 UTC (Fri) by corbet
Sony has announced the availability of an Android Open Source Project distribution for its Xperia Tablet Z device. "For all you developers out there, of course this means you can now access the software and contribute to this project. And this is all before the tablet is even available in the US. A special thanks to our Sony Mobile team for helping us create the package early and a huge thanks to the Android developer community for all your support. We can’t wait to see what you’ll do with the code." Source is available on GitHub.
Friday's security updates
[Security] Posted May 17, 2013 16:30 UTC (Fri) by n8willis
CentOS has updated kernel (C6; perf privilege escalation) and libvirt (denial of service). Fedora has updated thunderbird (multiple vulnerabilities). openSUSE has updated flash-player (multiple vulnerabilities). Oracle has updated kernel (OL5, OL6; perf privilege escalation) and libvirt (denial of service). Red Hat has updated kernel (RHEL 6, RHEL 6.3; perf privilege escalation) and libvirt (denial of service). Scientific Linux has updated kernel (perf privilege escalation) and libvirt (denial of service). Slackware has updated ruby (object taint bypassing) and thunderbird (multiple vulnerabilities). SUSE has updated flash-player (multiple vulnerabilities). Ubuntu has updated kernel-ec2 (10.04 LTS; multiple vulnerabilities), openstack-keystone (delayed token invalidation) and openstack-nova (denial of service).
Strongbox and Aaron Swartz (The New Yorker)
[Security] Posted May 16, 2013 21:14 UTC (Thu) by jake
The New Yorker magazine has started a service called Strongbox that allows anonymous information to be sent to magazine. It is based on the DeadDrop free software project that was created by the late Aaron Swartz, which uses the Tor network to preserve anonymity. The magazine also has an article by Kevin Poulsen, who organized the project, about its history. "In New York, a computer-security expert named James Dolan persuaded a trio of his industry colleagues to meet with Aaron to review the architecture and, later, the code. We wanted to be reasonably confident that the system wouldn't be compromised, and that sources would be able to submit documents anonymously—so that even the media outlets receiving the materials wouldn't be able to tell the government where they came from."
Ten years of Groklaw
[Announcements] Posted May 16, 2013 15:59 UTC (Thu) by corbet
Groklaw is celebrating its tenth anniversary. "Thank you for sticking to the job for ten years without giving out, and for funding the necessary activities that make Groklaw Groklaw. We made a difference in this old world. It's an achievement we can tell our grandchildren about some day. Not everyone can say that, but we actually made a difference. And nobody can take that away from us."
Thursday's security advisories
[Security] Posted May 16, 2013 15:29 UTC (Thu) by jake
CentOS has updated openswan (C5; C6: code execution). Debian has updated kernel (many vulnerabilities). Fedora has updated openvpn (F17; F18: possible plaintext recovery) and clamav (F18: multiple vulnerabilities). Mageia has updated flash-player-plugin (many vulnerabilities). Oracle has updated thunderbird (OL6: multiple vulnerabilities), firefox (OL5; OL6: multiple vulnerabilities), and openswan (OL5; OL6: code execution). Red Hat has updated openswan (code execution). Slackware has updated firefox (multiple vulnerabilities) and thunderbird (multiple vulnerabilities). Ubuntu has updated kernel (10.04: multiple vulnerabilities) and kernel (12.04; 12.10; 13.04; 12.04 Quantal hardware enablement kernel: perf privilege escalation).
Blender dives into 3D printing industry (Libre Graphics World)
[Development] Posted May 16, 2013 15:16 UTC (Thu) by corbet
Libre Graphics World looks at the use of Blender in 3D printing; the recent 2.67 release includes a "3D printing toolbox." "While Blender cannot help with making actual devices easier to use, it definitely could improve designing printable objects. And that's exactly what happened last week, when Blender 2.67 was released."
[$] LWN.net Weekly Edition for May 16, 2013
Posted May 16, 2013 1:08 UTC (Thu)The LWN.net Weekly Edition for May 16, 2013 is available. Inside this week's LWN.net Weekly Edition
Security advisories for Wednesday
[Security] Posted May 15, 2013 17:19 UTC (Wed) by ris
CentOS has updated firefox (C6; C5: multiple vulnerabilities) and thunderbird (C6; C5: multiple vulnerabilities). CentOS has also released a testing kernel that fixes CVE-2013-2094 (more information). Debian has updated kernel (multiple vulnerabilities). Fedora has updated tinc (F18; F17: code execution), xen (F18; F17: denial of service), and curl (F18: cookie information disclosure). Mandriva has updated firefox (multiple vulnerabilities). Red Hat has updated firefox (multiple vulnerabilities), thunderbird (multiple vulnerabilities), java-1.7.0-ibm (multiple vulnerabilities), java-1.6.0-ibm (multiple vulnerabilities), flash-plugin (multiple vulnerabilities), and acroread (multiple vulnerabilities). Scientific Linux has updated firefox (multiple vulnerabilities) and thunderbird (multiple vulnerabilities). Ubuntu has updated firefox (multiple vulnerabilities) and thunderbird (multiple vulnerabilities).
[$] A look at the PyPy 2.0 release
[Front] Posted May 15, 2013 15:31 UTC (Wed) by jake
It's hard to say why, but May appears to be the month where we look in on PyPy. Three years ago, we had a May 2010 introduction to PyPy, followed by an experiment using it in May 2011. This year, the PyPy 2.0 release was made on May 9—that, coupled with our evident tradition, makes for a good reason to look in on this Python interpreter written in Python. Subscribers can click below for our report on the release from this week's edition.
Local root vulnerability in the kernel
[Security] Posted May 15, 2013 14:05 UTC (Wed) by corbet
Commit b0a873ebb, merged for the 2.6.37 kernel, included an out of bounds reference bug that went undetected until Tommi Rantala discovered it with the Trinity fuzzing tool this April. It wasn't seen as a security bug by the kernel developers until an exploit was posted; the problem is now known as CVE-2013-2094. Mainline kernels 2.6.37-3.9 are vulnerable, but Red Hat also backported the bug into the 2.6.32-based kernel found in RHEL6. Expect distributor updates shortly.
[$] PostgreSQL 9.3 beta: Federated databases and more
[Development] Posted May 14, 2013 20:04 UTC (Tue) by jake
In Berkeley, California — the birthplace of PostgreSQL — it's spring: plum and cherry blossoms, courting finches and college students, new plans for the summer, and the first beta release of the database system. Every year, the first beta of the next PostgreSQL version comes out in April or May, for a final release in September. PostgreSQL 9.3 beta 1 was released to the public on May 13th, and contains a couple dozen new features both for database administrators and application developers. Subscribers can click below for a look at some of the new features by guest author Josh Berkus.
Extended stable support for the 3.8 kernel
[Kernel] Posted May 14, 2013 19:46 UTC (Tue) by corbet
Canonical has announced that the Ubuntu kernel team will be providing stable updates for the 3.8 kernel now that Greg Kroah-Hartman has moved on. This support will last as long as support for the Ubuntu 13.04 release: through August 2014. "We welcome any feedback and contribution to this effort. We will be posting the first review cycle patch set in a week or two."
Stable kernel 3.2.45
[Kernel] Posted May 14, 2013 18:30 UTC (Tue) by ris
Ben Hutchings has released stable kernel 3.2.45 with lots of important fixes throughout the tree.
Tuesday's security updates
[Security] Posted May 14, 2013 18:27 UTC (Tue) by ris
CentOS has updated httpd (C6; C5: multiple vulnerabilities). Fedora has updated php-geshi (F18; F17: multiple vulnerabilities) and libtiff (F18: multiple vulnerabilities). Oracle has updated httpd (OL6; OL5: multiple vulnerabilities). Red Hat has updated httpd (multiple vulnerabilities). Scientific Linux has updated httpd (multiple vulnerabilities). SUSE has updated kernel (multiple vulnerabilities).
Go language 1.1 released
[Development] Posted May 13, 2013 23:19 UTC (Mon) by corbet
Version 1.1 of the "Go" programming language has been released. The bulk of the work seems to be in performance improvements, but there's a number of new features as well, including a race detector and an expanded library. See the release notes for details.
|
|||||||||||||