LWN.net Logo

LWN.net Weekly Edition for December 9, 2004

The Linux roadmap

Certain proprietary vendors have long liked to criticize Linux for its lack of a "roadmap," a multi-year plan with release dates and included features. Without such a roadmap, they say, customers have no idea where the technology is going, cannot plan for the future, and have no assurance that needed features and capabilities will be built into Linux. This Information Week article is the latest contribution to this debate; the way the Linux kernel is developed, says the author, "...makes it even harder for technology professionals using Linux to plan around one major release that's, say, 18 months down the road." The lack of a roadmap is said to be a sign that the kernel development process has not yet "grown up."

We contend, instead, that the lack of a PowerPoint-friendly release and feature plan is a sign that the free software development process is different - and better.

It would be interesting to ask the aforementioned "technology professionals" how useful corporate roadmaps truly are - especially in the software arena. Betting the company on another vendor's promised future software releases seems risky at best. Relying on a vendor's claims for software which is available now is dangerous enough; competent "technology professionals" know that reality often fails to live up to those claims. The only way to know whether a given software release will work in a given situation is to try it, and trying it is difficult for releases which exist only on a timeline in some roadmap.

Then again, Linux can be said to have a roadmap which can make reasonably reliable predictions fairly far into the future. One need only look at the projects which are being worked on now. With a bit of research, anybody can see what features are contemplated, which of them work now, the amount of development effort which is going into those features, whose priorities are driving development, and more. So, for example, one might make some reasonable predictions about future distributions by looking at what the developers are doing today:

  • They will almost certainly include enhanced security technologies, including mandatory access control mechanisms and, perhaps, heavier use of encrypted filesystems. SELinux looks likely to be the technology deployed by many distributors, unless the ongoing complexity issues end up forcing a shift to something else.

  • The kernel will continue to scale to larger systems with more processors, memory, and disks. Some additional scalability work will be done for 32-bit systems, but the emphasis will be on using 64-bit processors to the fullest extent. There will be improved support for clustered filesystems, and, perhaps, for leading-edge, transactional filesystems as well. Future hardware will be quickly supported as long as the requisite information is made available to developers.

  • The desktop experience will continue to improve, especially for business users. The available applications will continue to develop quickly, and future distributions will include advanced search capabilities. More home-oriented applications, including personal finance, high-end games, Feng Shui garden layout assistants, etc. will be rather slower to develop.

And so on. Predictions of this sort are somewhat unreliable, but they are nonetheless far more trustworthy than a corporate marketing department's rendition of an otherwise obscure development process.

Roadmaps can also force a company to ship what it promised, rather than what is best. Imagine if IBM were in charge of the Linux kernel, and that IBM had promised that 2.6 would include its own EVMS volume management software. Can you imagine IBM subsequently announcing that EVMS would be passed over for inclusion because the developers like the device mapper code better? If you make promises about future releases, you have to at least try to live up to those promises. It is hard to switch to an idea which turns out to be better in practice without losing credibility. Without this ability to make decisions based on what actually works and is maintainable, the free software development process would be weaker.

The final problem is that the free software development model is resistant to central planning in general. Linus Torvalds can express his vision and desire for future kernel developments, but he is unable (and unwilling) to force anybody to work on those developments. The community makes its own decisions about what it thinks is important. The results are often surprising, but the success of Linux so far makes it clear that they are meeting somebody's needs. Trying to impose a roadmap on this process is unlikely to improve it.

Comments (32 posted)

Vector graphics with Inkscape

December 8, 2004

This article was contributed by Joe 'Zonker' Brockmeier.

With the release of Inkscape 0.40, we decided to take a look at the latest release and get up to speed with the status of the project. Inkscape started as a fork of the Sodipodi project, but has evolved into a robust project in its own right.

Inkscape is a drawing tool that uses the Scalable Vector Graphics (SVG) specification for its native format, and also exports to PNG, as well as saving in Adobe Illustrator format, PostScript, Encapsulated PostScript and PovRay formats. Inkscape will open or import graphics from Adobe Illustrator and Dia, other programs' SVG documents and a wide array of bitmap graphics formats. Inkscape runs on Linux, Windows and Mac OS X.

We installed the Inkscape static RPM on a SUSE 9.2 system to see what the program is capable of, and whether Inkscape was stable and feature-complete enough for productive use. The Inkscape download page on SourceForge includes source packages, RPMs and Windows binaries.

To test Inkscape we started off by creating basic shapes using Inkscape's rectangle and ellipse tools and fiddling with color fills, stroke styles, rotation and so forth just to get a feel for Inkscape's [Screenshot] tools. It took about fifteen minutes for this writer to get comfortable with the Inkscape interface.

With an application like Inkscape, using a mouse (or tablet) is almost unavoidable. However, Inkscape's shortcut keys allow the user to perform a lot of actions, such as selecting different tools or raising and lowering an object from one layer to another, from the keyboard -- rather than having to grab the mouse to switch between tools or adjust layers. For example, to toggle the current tool from Inkscape's path tool to the select tool, all that's necessary is to hit the space bar or F1. To move an object up one layer, simply hit "Page Up" or "Page Down" to move it lower.

Speaking of layers, layer management is one of the major new features in Inkscape with the 0.40 release, according to the release notes.

Another new feature in 0.40 is a "text-on-path" feature. This allows the user to conform text to a path -- which is useful for creating interesting logos and other artwork that requires text to wrap text to a shape other than a rectangle. The feature is certainly easy to use. All that's required is to select a path and the text object that is to conform to the path. Rectangles, ellipses and other objects must be converted to a path before the user can wrap text to fit that object. By manipulating that object, the user can change the flow of the text even if the text has been removed from the object or if the object is "invisible" because there is no fill color or stroke color associated with the object. The only thing we couldn't figure out was how to specify a starting point on a path for the text.

We also enjoyed Inkscape's "Trace Bitmap" feature, which allows the user to trace an imported bitmap. By importing a photo or other bitmap, it's possible to create an scalable object that can then be turned into paths or otherwise edited in Inkscape. Inkscape has incorporated the potrace utility for this. The trace bitmap feature works best with line art, but can be used to produce some fun effects with photos or other artwork.

Inkscape's performance and stability are excellent. We created a number of documents using Inkscape, exported our documents and some of the Inkscape tutorials to PNG, EPS and PS, and didn't see any glitches. The program never crashed while we were testing, and all of the features that are currently in Inkscape seem to work as advertised. We did notice that some detail was lost when exporting to EPS from the tutorials, but this may not be an Inkscape limitation.

Though Inkscape doesn't have a full user manual at this stage, it does include several useful tutorials for basic and advanced concepts when working with Inkscape, as well as an excellent man page. It also features an "Elements of Design" document, which may be useful for users who lack a background in art and design. The Inkscape interface also features context help for most tools as well as context-sensitive tips in the bottom status bar.

For the most part, this writer found the interface to be straightforward and intuitive. The "Vacuum Defs" item under the File menu was a bit of a puzzler at first, though it was finally determined that it was for removing unused information from the defs tags in a document. We presume this is a good thing.

Some of Inkscape's functions can be used without even needing to start the Inkscape GUI. For example, inkscape file.svg -e file.png will convert an SVG file to a PNG. This can be particularly useful for users who wish to convert a number of SVG files into PNG format.

SVG experts can edit an SVG document directly, if they so choose, by using Inkscape's built-in XML editor. Very few users will be likely to need this tool, but it's there for those who need or want to edit a document's elements directly.

Inkscape may not be at the same level of functionality as Adobe Illustrator or Corel Draw, but it's certainly capable of creating some excellent graphics -- even if this writer isn't quite up to the task of fully exploiting its potential. With other open source applications like The Gimp and Scribus, Linux is a serious contender for users who are looking for a desktop publishing platform.

Comments (10 posted)

The Common Development and Distribution License

Sun has submitted a new license (the "Common Development and Distribution License" or CDDL) to the Open Source Initiative's license-discuss mailing list. This license, derived from the Mozilla Public License, may (or may not) be what Sun chooses to use for its possible open-source Solaris release, so it is worth a look.

This license is GPL-like in its intent, but (as Sun acknowledges up front) it is not compatible with the GPL. There are certain extra terms in the CDDL which, while not necessarily objectionable in their own right, conflict with the GPL's "no additional restrictions" terms. This incompatibility came as a surprise to few people; nobody has ever expected Sun to encourage the mixing of Solaris and Linux kernel code.

The CDDL licenses the copyrights in the code for use, distribution, and modification - the usual free software rights. It also contains a patent grant, but here the language is a bit more constrained:

(b) under Patent Claims infringed by the making, using or selling of Original Software, to make, have made, use, practice, sell, and offer for sale, and/or otherwise dispose of the Original Software (or portions thereof).

In other words, the CDDL does not license any patents for use in derived products. Other terms in the license suggest that Sun is concerned about patent infringements caused by modifications, but the above exclusion is not restricted to such infringements.

The license requires that anybody distributing the code in binary form make the associated source available under the CDDL. The license says nothing about how the source must be made available; in theory, one could satisfy the license by requiring people to pick up the source in person at one's Mongolian software distribution center. Interestingly, the license allows the binaries themselves to be distributed under any license, so long as (1) the source is available under the CDDL, and (2) the person distributing binaries under a different license indemnifies the copyright holders for any liabilities.

Unlike the GPL, the CDDL allows developers to make modifications to the license text itself (for their own code).

The CDDL contains patent defense language: if you sue a copyright holder for patent infringement, you can lose your rights to use the code under the license. In any patent litigation settlement talks, the value of the patent license granted by the CDDL must be taken into account - essentially, the party initiating the lawsuit loses any patent license granted by the CDDL. There is one other strange term:

6.4. In the event of termination under Sections 6.1 or 6.2 above, all end user licenses (excluding distributors and resellers) that have been validly granted by You or any distributor hereunder prior to termination (excluding licenses granted to You by any distributor) shall survive termination.

So if you are a software distributor, and you got the code from somebody who later turns around and sues Sun, you can lose your rights to the software under the license.

The discussion has been relatively muted; there seems to be an early consensus that the license, possibly with some small tweaks, is, indeed, a free software license. It will probably get the stamp of approval that Sun seeks. What Sun will then do with this license remains to be seen, however.

Comments (7 posted)

Page editor: Jonathan Corbet

Security

Book review: Introduction to Computer Security

One of the biggest fringe benefits of writing book reviews is that publishers are happy to send you samples of their wares. Sometimes they [cover] are a little too enthusiastic; your editor has been buried under books on .NET programming, XML for legacy business applications, DBA certification, and more. The pile of such books threatens to fall over and make a big mess in the otherwise immaculate LWN.net data center. When an envelope showed up with a book called Introduction to Computer Security (by Matt Bishop), it almost joined that pile. Your editor hardly needs another book on password policies, anti-virus software, and attachment filtering.

Consigning this book to that pile would have been a mistake, however. "Introduction" might be an accurate description of this book, but only with a suitable understanding of the target audience: this book could serve for an introductory, graduate-level course for security researchers. People looking for ways to lock down their Windows boxes will not find it here; if, instead, you want to argue about the theoretical limitations of the type enforcement model with the SELinux folks, you're in the right place.

Chapter 1 (available online (PDF)) starts with the real introduction, where a number of important terms are defined: integrity, confidentiality, availability, assurance, etc. Chapter 2 gets into protection models, access matrices, and state transitions. Chapter 3 turns up the rigor by proving some theorems on whether a given system can be proven to be safe or not.

The fourth chapter gets into security policies, and makes some interesting distinctions: a "military" policy is one oriented primarily around confidentiality, while a "commercial" policy is aimed at integrity. Chapter 5 goes military with a more detailed look at confidentiality policies, with more theorems and a look at mandatory access control. Integrity policies are covered in the following chapter; a few integrity models are introduced. Chapter 7 addresses the fact that most organizations want both integrity and confidentiality by looking at hybrid models: chinese walls, etc.

Then the focus shifts to cryptography. Chapter 8 is a whirlwind introduction, starting with basic ciphers and progressing through DES, public key encryption, and more. The crucial problem of key management is chapter 9's topic; chapter 10 looks at ciphers in more detail. There is some discussion there about how ciphers and network stacks can be brought together, ending with an overview of IPSec. Chapter 11 is about authentication; here your editor got his discussion of password policies after all, though in a bit more depth than usual.

Chapter 12 gets into design principles for secure systems: least privilege, fail-safe defaults, complete mediation, open design (with a discussion of DeCSS), etc. Chapter 13 looks at identity representations, certificates, and anonymity, and chapter 14 returns to access control mechanisms in more detail.

The book then gets into a more serious look at information flow and how it might be controlled in a secure system. Chapter 16 moves on to confinement - keeping processes within their defined boundaries; it looks at virtual machines, sandboxes, and the covert channel problem. Chapter 17 is an introduction to assurance - how one can be reasonably sure that a given system meets its security criteria. Then an introduction to evaluation techniques is given: TCSEC, FIPS, Common Criteria, etc.

After those dry chapters, chapter 19 ("malicious logic") is a relatively fun look at malware: trojan horses, viruses, worms, and how to defend against them. Chapter 20 is on vulnerability analysis, penetration testing, flaw models, etc. with a number of real-world examples. The next two chapters look at auditing and intrusion detection. Then follows a series of relatively high-level chapters on network, system, user, and program security techniques - firewalls, user policies, programming techniques, and more. The book finishes up with some background material (lattices, virtual machines) and a 63-page, 968-entry bibliography.

Introduction to Computer Security is an intense reading experience. Interestingly, this book can be seen as a watered-down version of another book by the same author: Computer Security: Art and Science. According to the introduction, Introduction to Computer Security is a shorter book (a mere 750 pages) with much of the mathematical formalism left out. For most readers, however, the shortened version is likely to be enough - and to be an important resource for anybody who wishes to truly understand what secure computing means.

Comments (4 posted)

New vulnerabilities

hpsockd: missing input sanitizing

Package(s):hpsockd CVE #(s):CAN-2004-0993
Created:December 3, 2004 Updated:December 8, 2004
Description: "infamous41md" discovered a buffer overflow condition in hpsockd, the socks server written at Hewlett-Packard. An exploit could cause the program to crash or may have worse effect.
Alerts:
Debian DSA-604-1 2004-12-03

Comments (none posted)

imlib: buffer overflows in image decoding

Package(s):imlib CVE #(s):CAN-2004-1026
Created:December 6, 2004 Updated:January 13, 2005
Description: Pavel Kankovsky discovered that several overflows found in the libXpm library also applied to imlib. He also fixed a number of other potential flaws. A remote attacker could entice a user to view a carefully-crafted image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the imlib library.
Alerts:
Mandrake MDKSA-2005:007 2005-01-12
Gentoo 200501-19 2005-01-11
Ubuntu USN-55-1 2005-01-06
Debian DSA-628-1 2005-01-06
Ubuntu USN-53-1 2004-12-29
Debian DSA-618-1 2004-12-24
Red Hat RHSA-2004:651-01 2004-12-10
Gentoo 200412-03 2004-12-06

Comments (none posted)

mirrorselect: insecure temporary file creation

Package(s):mirrorselect CVE #(s):
Created:December 7, 2004 Updated:December 8, 2004
Description: Ervin Nemeth discovered that mirrorselect creates temporary files in world-writable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When mirrorselect is executed, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.
Alerts:
Gentoo 200412-05:02 2004-12-07

Comments (none posted)

rssh, scponly: unrestricted command execution

Package(s):rssh, scponly CVE #(s):
Created:December 3, 2004 Updated:December 8, 2004
Description: Jason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host. Using a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh. See this Bugtraq post for more details.
Alerts:
Gentoo 200412-01 2004-12-03

Comments (none posted)

viewcvs settings not honored

Package(s):viewcvs CVE #(s):CAN-2004-0915
Created:December 6, 2004 Updated:December 28, 2004
Description: Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility for viewing CVS and Subversion repositories via HTTP. When exporting a repository as a tar archive the hide_cvsroot and forbidden settings were not honored.
Alerts:
Gentoo 200412-26 2004-12-28
Debian DSA-605-1 2004-12-06

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):a2ps CVE #(s):CAN-2004-1170 CAN-2004-1377
Created:November 26, 2004 Updated:December 19, 2005
Description: The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:
Fedora-Legacy FLSA:152870 2005-12-17
Mandriva MDKSA-2005:097 2005-06-07
OpenPKG OpenPKG-SA-2005.003 2005-01-17
Gentoo 200501-02 2005-01-04
Debian DSA-612-1 2004-12-20
Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

apache: arbitrary code execution

Package(s):apache CVE #(s):CAN-2004-0940
Created:October 29, 2004 Updated:December 14, 2004
Description: According to an Apache announcement, a vulnerability exists in the Apache HTTP server, version 1.3. The problem is a potential buffer overflow in the "get_tag" function of Apache's SSI module "mod_include". It allows local users who can create SSI documents to execute arbitrary code as the Apache run-time user via SSI documents that trigger a content length calculation error.
Alerts:
Red Hat RHSA-2004:600-01 2004-12-13
Mandrake MDKSA-2004:134 2004-11-15
Debian DSA-594-1 2004-11-17
Trustix TSLSA-2004-0056 2004-11-05
Gentoo 200411-03 2004-11-02
Slackware SSA:2004-305-01 2004-11-01
OpenPKG OpenPKG-SA-2004.047 2004-10-29

Comments (none posted)

aspell: bounds checking problem

Package(s):aspell CVE #(s):CAN-2004-0548
Created:June 17, 2004 Updated:December 20, 2004
Description: Aspell's word-list-compress utility fails to properly check bounds when dealing with words that are more than 256 bytes long. This can lead to arbitrary code execution by an attacker.
Alerts:
Mandrake MDKSA-2004:153 2004-12-20
OpenPKG OpenPKG-SA-2004.042 2004-09-15
Gentoo 200406-14 2004-06-17

Comments (none posted)

BNC: Buffer overflow vulnerability

Package(s):bnc CVE #(s):
Created:November 16, 2004 Updated:December 1, 2004
Description: Leon Juranic discovered that BNC fails to do proper bounds checking when checking server response. An attacker could exploit this to cause a Denial of Service and potentially execute arbitrary code with the permissions of the user running BNC.
Alerts:
Debian DSA-595-1 2004-11-24
Gentoo 200411-24 2004-11-16

Comments (none posted)

cdrecord: failure to drop privilege

Package(s):cdrecord CVE #(s):CAN-2004-0806
Created:September 8, 2004 Updated:February 21, 2005
Description: The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program.
Alerts:
Fedora-Legacy FLSA:2058 2005-02-20
Gentoo 200409-18 2004-09-14
Fedora FEDORA-2004-298 2004-09-09
Fedora FEDORA-2004-297 2004-09-09
Mandrake MDKSA-2004:091 2004-09-07

Comments (none posted)

ncompress: Buffer overflow

Package(s):compress uncompress ncompress CVE #(s):CAN-2001-1413
Created:October 11, 2004 Updated:December 14, 2004
Description: compress and uncompress do not properly check bounds on command line options, including the filename. Large parameters would trigger a buffer overflow. By supplying a carefully crafted filename or other option, an attacker could execute arbitrary code on the system. A local attacker could only execute code with his own rights, but since compress and uncompress are called by various daemon programs, this might also allow a remote attacker to execute code with the rights of the daemon making use of ncompress.
Alerts:
Red Hat RHSA-2004:536-01 2004-12-13
Gentoo 200410-08 2004-10-09

Comments (none posted)

cyrus-imap: multiple remote vulnerabilities

Package(s):cyrus-imap CVE #(s):CAN-2004-1012 CAN-2004-1013
Created:November 23, 2004 Updated:December 3, 2004
Description: Several vulnerabilities have been found in Cyrus IMAP Server <= 2.2.8 that could allow remote execution of arbitrary code.
Alerts:
SuSE SUSE-SA:2004:043 2004-12-03
Ubuntu USN-37-1 2004-12-02
Fedora FEDORA-2004-487 2004-12-01
Fedora FEDORA-2004-489 2004-12-01
Conectiva CLA-2004:904 2004-12-01
OpenPKG OpenPKG-SA-2004.051 2004-11-29
Mandrake MDKSA-2004:139 2004-11-25
Gentoo 200411-34 2004-11-25
Debian DSA-597-1 2004-11-25
Ubuntu USN-31-1 2004-11-23

Comments (none posted)

cyrus-sasl: remote buffer overflow

Package(s):cyrus-sasl CVE #(s):CAN-2004-0884
Created:October 7, 2004 Updated:March 16, 2005
Description: cyrus-sasl has a vulnerability involving a buffer overflow in the digestmda5.c file. A remote attacker may be able to compromise the system. Also, a local user may be able to exploit a vulnerability by using the SASL_PATH environment variable.
Alerts:
Mandrake MDKSA-2005:054 2005-03-15
SuSE SUSE-SA:2005:013 2005-03-03
Fedora-Legacy FLSA:2137 2005-02-17
OpenPKG OpenPKG-SA-2005.004 2005-01-28
Conectiva CLA-2004:889 2004-11-11
Debian DSA-568-1 2004-10-16
Debian DSA-563-3 2004-10-14
Debian DSA-563-2 2004-10-12
Debian DSA-563-1 2004-10-12
Trustix TSLSA-2004-0053 2004-10-08
Mandrake MDKSA-2004:106 2004-10-07
Red Hat RHSA-2004:546-02 2004-10-07
Gentoo 200410-05 2004-10-07

Comments (none posted)

dhcp: format string vulnerability

Package(s):dhcp CVE #(s):CAN-2004-1006
Created:November 4, 2004 Updated:July 13, 2005
Description: Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:
Fedora-Legacy FLSA:152835 2005-07-10
Red Hat RHSA-2005:212-01 2005-04-12
Debian DSA-584-1 2004-11-04

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):fam CVE #(s):CAN-2002-0875
Created:August 19, 2002 Updated:January 5, 2005
Description: "fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:
Red Hat RHSA-2005:005-01 2005-01-05
Debian DSA-154-1 2002-08-15

Comments (none posted)

flim: insecure file creation

Package(s):flim CVE #(s):CAN-2004-0422
Created:May 5, 2004 Updated:December 16, 2004
Description: The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files.
Alerts:
Fedora FEDORA-2004-546 2004-12-15
Red Hat RHSA-2004:344-01 2004-08-18
Debian DSA-500-1 2004-05-01

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):foomatic CVE #(s):CAN-2004-0801
Created:September 20, 2004 Updated:May 31, 2006
Description: There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:
SuSE SUSE-SA:2006:026 2006-05-30
Fedora-Legacy FLSA:2076 2004-11-05
Conectiva CLA-2004:880 2004-10-27
Fedora FEDORA-2004-303 2004-09-21
Gentoo 200409-24 2004-09-20

Comments (none posted)

FreeRADIUS: denial of service

Package(s):freeradius CVE #(s):CAN-2004-0938 CAN-2004-0960 CAN-2004-0961
Created:September 22, 2004 Updated:February 2, 2005
Description: FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code.
Alerts:
Fedora-Legacy FLSA:2187 2005-02-01
Red Hat RHSA-2004:609-01 2004-11-12
Gentoo 200409-29 2004-09-22

Comments (none posted)

gaim: buffer overflow in MSN protocol

Package(s):gaim CVE #(s):CAN-2004-0891
Created:October 25, 2004 Updated:February 11, 2005
Description: A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.
Alerts:
Fedora-Legacy FLSA:2188 2005-02-10
Red Hat RHSA-2004:604-01 2004-10-20
Mandrake MDKSA-2004:117 2004-11-01
Ubuntu USN-8-1 2004-10-27
Gentoo 200410-23 2004-10-24
Slackware SSA:2004-296-01 2004-10-25

Comments (none posted)

Gallery: cross-site scripting vulnerability

Package(s):Gallery CVE #(s):CAN-2004-1106
Created:November 8, 2004 Updated:January 17, 2005
Description: Jim Paris has discovered a cross-site scripting vulnerability in Gallery. By sending a carefully crafted URL, an attacker can inject and execute script code in the victim's browser window, and potentially compromise the users gallery.
Alerts:
Debian DSA-642-1 2005-01-17
Gentoo 200411-10:01 2004-11-06

Comments (none posted)

gtk2, gdk-pixbuf: buffer overflows

Package(s):gdk-pixbuf gtk2 CVE #(s):CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788
Created:September 15, 2004 Updated:February 25, 2005
Description: The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Alerts:
Fedora-Legacy FLSA:2005 2005-02-23
Conectiva CLA-2004:875 2004-10-18
Slackware SSA:2004-266-02 2004-09-22
Gentoo 200409-28 2004-09-21
Mandrake MDKSA-2004:095-1 2004-09-17
SuSE SUSE-SA:2004:033 2004-09-17
Debian DSA-549-1 2004-09-17
Red Hat RHSA-2004:447-02 2004-09-15
Debian DSA-546-1 2004-09-16
Red Hat RHSA-2004:466-01 2004-09-15
Red Hat RHSA-2004:447-01 2004-09-15
Mandrake MDKSA-2004:095 2004-09-15
Fedora FEDORA-2004-289 2004-09-15
Fedora FEDORA-2004-288 2004-09-15
Fedora FEDORA-2004-287 2004-09-15
Fedora FEDORA-2004-286 2004-09-15

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):gettext CVE #(s):CAN-2004-0966
Created:October 11, 2004 Updated:March 1, 2006
Description: gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:
Mandriva MDKSA-2006:051 2006-02-28
Fedora-Legacy FLSA:136323 2006-01-09
Gentoo 200410-10:02 2004-10-10
OpenPKG OpenPKG-SA-2004.055 2004-12-23
Ubuntu USN-5-1 2004-10-27
Gentoo 200410-10 2004-10-10

Comments (1 posted)

ghostscript: symlink vulnerabilities

Package(s):ghostscript CVE #(s):CAN-2004-0967
Created:October 20, 2004 Updated:September 28, 2005
Description: The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:
Red Hat RHSA-2005:081-01 2005-09-28
Ubuntu USN-3-1 2004-10-27
Gentoo 200410-18 2004-10-20

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):glibc CVE #(s):CAN-2004-1453
Created:August 17, 2004 Updated:May 26, 2005
Description: Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:
Red Hat RHSA-2005:256-01 2005-05-18
Gentoo 200408-16 2004-08-16

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):glibc CVE #(s):CAN-2004-0968
Created:October 21, 2004 Updated:November 14, 2005
Description: The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:
Fedora-Legacy FLSA:152848 2005-11-13
Red Hat RHSA-2005:261-01 2005-04-28
Debian DSA-636-1 2005-01-12
Mandrake MDKSA-2004:159 2004-12-29
Red Hat RHSA-2004:586-01 2004-12-20
Fedora FEDORA-2004-356 2004-11-11
Ubuntu USN-4-1 2004-10-27
Gentoo 200410-19 2004-10-21

Comments (none posted)

gnome-vfs: backend script vulnerabilities

Package(s):gnome-vfs CVE #(s):CAN-2004-0494
Created:August 4, 2004 Updated:February 21, 2005
Description: Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:
Fedora-Legacy FLSA:1944 2005-02-20
Whitebox WBSA-2004:373-01 2004-08-19
Red Hat RHSA-2004:373-01 2004-08-04

Comments (none posted)

groff: insecure temporary directory

Package(s):groff CVE #(s):CAN-2004-0969
Created:November 1, 2004 Updated:February 9, 2006
Description: Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Mandriva MDKSA-2006:038 2006-02-08
Gentoo 200411-15 2004-11-08
Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):gtkhtml CVE #(s):CAN-2003-0133 CAN-2003-0541
Created:April 14, 2003 Updated:April 18, 2005
Description: GtkHTML is the HTML rendering widget used by the Evolution mail reader.

GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.

Alerts:
Debian DSA-710-1 2005-04-18
Mandrake MDKSA-2003:093 2003-09-18
Conectiva CLA-2003:737 2003-09-12
Red Hat RHSA-2003:264-01 2003-09-09
Mandrake MDKSA-2003:046 2003-04-15
Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

gzip: insecure temporary files

Package(s):gzip CVE #(s):CAN-2004-0970
Created:November 8, 2004 Updated:December 7, 2004
Description: Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack.
Alerts:
Mandrake MDKSA-2004:142 2004-12-06
Debian DSA-588-1 2004-11-08

Comments (none posted)

ImageMagick: EXIF buffer overflow

Package(s):ImageMagick CVE #(s):CAN-2004-0981
Created:November 8, 2004 Updated:December 8, 2004
Description: ImageMagick fails to do proper bounds checking when handling image files with EXIF information. An attacker could use an image file with specially-crafted EXIF information to cause arbitrary code execution with the permissions of the user running ImageMagick. See this advisory for more information.
Alerts:
Red Hat RHSA-2004:636-01 2004-12-08
Mandrake MDKSA-2004:143 2004-12-06
Debian DSA-593-1 2004-11-16
Gentoo 200411-11:01 2004-11-06

Comments (none posted)

imlib2: buffer overflows

Package(s):imlib2 CVE #(s):CAN-2004-0802 CAN-2004-0817
Created:September 8, 2004 Updated:October 26, 2005
Description: The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:
Debian DSA-548-2 2005-10-26
Conectiva CLA-2004:870 2004-09-28
Debian DSA-552-1 2004-09-22
Debian DSA-548-1 2004-09-16
Red Hat RHSA-2004:465-01 2004-09-15
Gentoo 200409-12 2004-09-08
Fedora FEDORA-2004-301 2004-09-09
Fedora FEDORA-2004-300 2004-09-09
Mandrake MDKSA-2004:089 2004-09-07

Comments (none posted)

iproute: local denial of service

Package(s):iproute net-tools CVE #(s):CAN-2003-0856
Created:November 25, 2003 Updated:December 14, 2004
Description: The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:
Mandrake MDKSA-2004:148 2004-12-13
Fedora FEDORA-2004-154 2004-06-03
Fedora FEDORA-2004-115 2004-05-11
Debian DSA-492-1 2004-04-18
Gentoo 200404-10 2004-04-09
Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

iptables: missing initialization

Package(s):iptables CVE #(s):CAN-2004-0986
Created:November 1, 2004 Updated:February 11, 2005
Description: Faheem Mitha noticed that the iptables command, an administration tool for IPv4 packet filtering and NAT, did not always load the required modules on its own as it was supposed to. This could lead to firewall rules not being loaded on system startup. This caused a failure in connection with rules provided by lokkit at least.
Alerts:
Fedora-Legacy FLSA:2252 2005-02-10
Ubuntu USN-81-1 2005-02-11
Mandrake MDKSA-2004:125 2004-11-04
Debian DSA-580-1 2004-11-01

Comments (none posted)

kernel: vulnerabilities in the smb file system

Package(s):kernel CVE #(s):CAN-2004-0883 CAN-2004-0949
Created:November 19, 2004 Updated:December 14, 2004
Description: During an audit of the smb file system implementation within Linux, several vulnerabilities were discovered ranging from out of bounds read accesses to kernel level buffer overflows. See these advisories: Linux kernel binfmt_elf loader vulnerabilities and Memory leak in 2.4.27 kernel for more information.
Alerts:
Red Hat RHSA-2004:504-01 2004-12-13
Red Hat RHSA-2004:505-01 2004-12-13
Red Hat RHSA-2004:549-01 2004-12-02
SuSE SUSE-SA:2004:042 2004-12-01
Ubuntu USN-30-1 2004-11-18

Comments (1 posted)

kernel-utils: setuid vulnerability

Package(s):kernel-utils CVE #(s):CAN-2003-0019
Created:February 7, 2003 Updated:January 21, 2005
Description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.

Alternatively, as a work-around to this vulnerability issue the following command as root:

chmod -s /usr/bin/uml_net

Alerts:
Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):libgd2 CVE #(s):CAN-2004-0990 CAN-2004-0941
Created:October 29, 2004 Updated:June 28, 2006
Description: Several buffer overflows have been discovered in libgd's PNG handling functions.
If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:
Mandriva MDKSA-2006:114 2006-06-27
Red Hat RHSA-2006:0194-01 2006-02-01
Fedora-Legacy FLSA:152838 2005-07-15
Red Hat RHSA-2004:638-01 2004-12-17
Ubuntu USN-33-1 2004-11-29
Debian DSA-602-1 2004-11-29
Debian DSA-601-1 2004-11-29
Mandrake MDKSA-2004:132 2004-11-15
Ubuntu USN-25-1 2004-11-15
Fedora FEDORA-2004-412 2004-11-11
Fedora FEDORA-2004-411 2004-11-11
Ubuntu USN-21-1 2004-11-09
Debian DSA-591-1 2004-11-09
Debian DSA-589-1 2004-11-09
Gentoo 200411-08 2004-11-03
OpenPKG OpenPKG-SA-2004.049 2004-10-30
Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):libpng CVE #(s):CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:August 4, 2004 Updated:February 10, 2005
Description: There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:
Fedora-Legacy FLSA:1943 2005-02-08
Red Hat RHSA-2004:421-01 2004-08-04
Gentoo 200408-22 2004-08-23
Whitebox WBSA-2004:402-01 2004-08-19
Mandrake MDKSA-2004:082 2004-08-12
Slackware SSA:2004-223-01 2004-08-09
Slackware SSA:2004-223-02 2004-08-07
Slackware SSA:2004-222-01b 2004-08-10
Slackware SSA:2004-222-01 2004-08-07
Conectiva CLA-2004:856 2004-08-06
Trustix TSLSA-2004-0040 2004-08-05
Gentoo 200408-03 2004-08-05
Debian DSA-536-1 2004-08-04
Mandrake MDKSA-2004:079 2004-08-04
SuSE SUSE-SA:2004:023 2004-08-04
Red Hat RHSA-2004:402-01 2004-08-04
OpenPKG OpenPKG-SA-2004.035 2004-08-04

Comments (1 posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libxpm4: stack and integer overflows

Package(s):libxpm4 CVE #(s):CAN-2004-0687 CAN-2004-0688
Created:September 16, 2004 Updated:February 14, 2005
Description: There are several stack and integer overflow bugs in the libXpm code of XFree86 that may be used for a denial of service.
Alerts:
Conectiva CLA-2005:924 2005-02-14
Red Hat RHSA-2005:004-01 2005-01-12
Red Hat RHSA-2004:537-01 2004-12-02
Ubuntu USN-27-1 2004-11-17
Mandrake MDKSA-2004:124 2004-11-04
Debian DSA-561-1 2004-10-11
Gentoo 200410-09 2004-10-09
Debian DSA-560-1 2004-10-07
Red Hat RHSA-2004:479-01 2004-10-06
Red Hat RHSA-2004:478-01 2004-10-04
Gentoo 200409-34 2004-09-27
SuSE SUSE-SA:2004:034 2004-09-17
Mandrake MDKSA-2004:099 2004-09-15
Mandrake MDKSA-2004:098 2004-09-15

Comments (none posted)

logcheck: symlink vulnerability

Package(s):logcheck CVE #(s):CAN-2004-0404
Created:April 21, 2004 Updated:December 22, 2004
Description: The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:
Mandrake MDKSA-2004:155 2004-12-22
Debian DSA-488-1 2004-04-16

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):lvm10 CVE #(s):CAN-2004-0972
Created:November 1, 2004 Updated:July 25, 2005
Description: Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:
Fedora-Legacy FLSA:152842 2005-07-24
Mandrake MDKSA-2004:144 2004-12-06
Gentoo 200411-22 2004-11-11
Debian DSA-583-1 2004-11-03
Ubuntu USN-15-1 2004-11-01

Comments (none posted)

Midnight Commander: extfs vfs vulnerability

Package(s):mc CVE #(s):CAN-2004-0494
Created:September 2, 2004 Updated:January 5, 2005
Description: Midnight Commander has a vfs vulnerability with shell quoting in extfs perl scripts.
Alerts:
Red Hat RHSA-2004:464-02 2005-01-05
Red Hat RHSA-2004:464-01 2004-09-15
Fedora FEDORA-2004-273 2004-09-01
Fedora FEDORA-2004-272 2004-09-01

Comments (none posted)

mikmod: buffer overflow

Package(s):mikmod CVE #(s):CAN-2003-0427
Created:June 16, 2003 Updated:June 16, 2005
Description: Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:
Fedora FEDORA-2005-405 2005-06-16
Red Hat RHSA-2005:506-01 2005-06-13
Fedora FEDORA-2005-404 2005-06-09
Gentoo 200307-01 2003-07-02
Debian DSA-320-1 2003-06-13

Comments (none posted)

mozilla products: arbitrary code execution and other vulnerabilities

Package(s):mozilla firefox thunderbird CVE #(s):CAN-2004-0902 CAN-2004-0903 CAN-2004-0904 CAN-2004-0905 CAN-2004-0908
Created:September 20, 2004 Updated:January 13, 2005
Description: Several vulnerabilities exist in the Mozilla web browser and derived products, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system. See the CERT advisory for details.
Alerts:
Gentoo 200501-03 2005-01-05
Fedora-Legacy FLSA:2089 2004-10-27
Conectiva CLA-2004:877 2004-10-22
Mandrake MDKSA-2004:107 2004-10-19
SuSE SUSE-SA:2004:036 2004-10-06
Red Hat RHSA-2004:486-01 2004-09-30
Slackware SSA:2004-266-03 2004-09-22
Gentoo 200409-26 2004-09-20

Comments (none posted)

mpg123: buffer overflow bug

Package(s):mpg123 CVE #(s):CAN-2004-0805
Created:September 16, 2004 Updated:January 11, 2005
Description: The mpg123 audio playing utility has a buffer overflow bug that may allow arbitrary execution of code.
Alerts:
Gentoo 200501-14 2005-01-10
Debian DSA-564-1 2004-10-13
Mandrake MDKSA-2004:100 2004-09-22
Gentoo 200409-20 2004-09-16

Comments (none posted)

mpg321: format string vulnerability

Package(s):mpg321 CVE #(s):CAN-2003-0969
Created:January 6, 2004 Updated:March 28, 2005
Description: A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:
Gentoo 200503-34 2005-03-28
Debian DSA-411-1 2004-01-05

Comments (none posted)

mysql: several vulnerabilities

Package(s):mysql CVE #(s):CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
Created:October 11, 2004 Updated:April 6, 2005
Description: Several problems have been discovered in MySQL. Oleksandr Byelkin noticed that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis noticed that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall. (CAN-2004-0837)
Alerts:
Ubuntu USN-109-1 2005-04-06
Fedora FEDORA-2004-530 2004-12-08
Ubuntu USN-32-1 2004-11-25
Conectiva CLA-2004:892 2004-11-18
Mandrake MDKSA-2004:119 2004-11-01
OpenPKG OpenPKG-SA-2004.045 2004-10-30
Red Hat RHSA-2004:611-01 2004-10-27
Gentoo 200410-22 2004-10-24
Red Hat RHSA-2004:569-01 2004-10-20
Red Hat RHSA-2004:597-01 2004-10-20
Debian DSA-562-1 2004-10-11

Comments (none posted)

netkit-telnet: invalid free pointer

Package(s):netkit-telnet CVE #(s):CAN-2004-0911
Created:October 4, 2004 Updated:March 28, 2005
Description: Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service (inetd will disable the service if telnetd is crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user).
Alerts:
Ubuntu USN-101-1 2005-03-28
Debian DSA-556-2 2004-10-18
Debian DSA-569-1 2004-10-18
Debian DSA-556-1 2004-10-02

Comments (none posted)

netpbm: insecure temporary files

Package(s):netpbm CVE #(s):CAN-2003-0924
Created:January 19, 2004 Updated:December 29, 2004
Description: netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:
Conectiva CLA-2004:909 2004-12-29
Gentoo 200410-02 2004-10-04
Mandrake MDKSA-2004:011-1 2004-09-27
Whitebox WBSA-2004:031-01 2004-02-12
Mandrake MDKSA-2004:011 2004-02-11
Red Hat RHSA-2004:030-01 2004-02-05
Fedora FEDORA-2004-068 2004-02-06
Red Hat RHSA-2004:031-01 2004-01-22
Debian DSA-426-1 2004-01-18

Comments (1 posted)

nfs-utils: denial of service

Package(s):nfs-utils CVE #(s):CAN-2004-1014
Created:December 1, 2004 Updated:May 15, 2005
Description: The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker.
Alerts:
Fedora-Legacy FLSA:152871 2005-05-12
Red Hat RHSA-2004:583-01 2004-12-20
Gentoo 200412-08 2004-12-14
Trustix TSLSA-2004-0065 2004-01-09
Debian DSA-606-1 2004-12-08
Mandrake MDKSA-2004:146 2004-12-06
Ubuntu USN-36-1 2004-12-01

Comments (none posted)

Open DC Hub: remote code execution

Package(s):opendchub CVE #(s):
Created:November 29, 2004 Updated:December 1, 2004
Description: Donato Ferrante discovered a buffer overflow vulnerability in the RedirectAll command of the Open DC Hub. Upon exploitation, a remote user with administrative privileges can execute arbitrary code on the system running the Open DC Hub. See this advisory.
Alerts:
Gentoo 200411-37 2004-11-28

Comments (none posted)

openssl: der_chop script temp file vulnerability

Package(s):openssl CVE #(s):CAN-2004-0975
Created:November 11, 2004 Updated:July 19, 2005
Description: The der_chop script in openssl has a temp file vulnerability that may allow an attacker to overwrite arbitrary files with the permissions that the script is running under.
Alerts:
Fedora-Legacy FLSA:152841 2005-07-15
Mandrake MDKSA-2004:147 2004-12-06
Debian DSA-603-1 2004-12-01
Ubuntu USN-24-1 2004-11-11

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):OpenSSL CVE #(s):CAN-2004-0081 CAN-2003-0851
Created:March 17, 2004 Updated:November 2, 2005
Description: Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:
Red Hat RHSA-2005:830-00 2005-11-02
Red Hat RHSA-2005:829-00 2005-11-02
Fedora FEDORA-2005-1042 2005-10-31
Fedora-Legacy FLSA:1395 2004-05-08
Conectiva CLA-2004:834 2004-03-31
Whitebox WBSA-2004:084-01 2004-03-23
Red Hat RHSA-2004:084-01 2004-03-23
Fedora FEDORA-2004-095 2004-03-19
Whitebox WBSA-2004:120-01 2004-03-22
Trustix TSLSA-2004-0012 2004-03-17
Slackware SSA:2004-077-01 2004-03-17
Red Hat RHSA-2004:121-01 2004-03-17
OpenPKG OpenPKG-SA-2004.007 2004-03-18
Gentoo 200403-03 2004-03-17
Debian DSA-465-1 2004-03-17
Netwosix NW-2004-0005 2004-03-17
Mandrake MDKSA-2004:023 2004-03-17
SuSE SuSE-SA:2004:007 2004-03-17
Red Hat RHSA-2004:120-01 2004-03-17
Red Hat RHSA-2004:119-01 2004-03-17
EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl: insecure temp file creation

Package(s):perl CVE #(s):CAN-2004-0976
Created:November 2, 2004 Updated:December 7, 2004
Description: Trustix Secure Linux has discovered some vulnerabilities in the perl package. The utility "instmodsh", the Perl package "PPPort.pm", and several test scripts (which are not shipped and only used during build) created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program, or building the perl package, respectively.
Alerts:
Gentoo 200412-04 2004-12-07
Ubuntu USN-16-1 2004-11-02

Comments (none posted)

php: remotely exploitable memory errors

Package(s):php CVE #(s):CAN-2004-0594
Created:July 14, 2004 Updated:February 7, 2005
Description: Stefan Esser has issued an advisory regarding a remotely exploitable hole in PHP (through version 4.3.7). If the memory_limit feature is in use (as it should be, to prevent denial of service attacks), allocation failures can be forced at highly inopportune times, and those failures can be exploited to execute arbitrary code. The exploit is described as "quite easy," and it can be done regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the problem; yesterday's PHP 5.0 release also contains the fix (but the final release candidate did not).
Alerts:
Debian DSA-669-1 2005-02-07
Whitebox WBSA-2004:392-01 2004-08-19
Fedora FEDORA-2004-223 2004-07-23
Fedora FEDORA-2004-222 2004-07-23
OpenPKG OpenPKG-SA-2004.034 2004-07-22
Slackware SSA:2004-202-01 2004-07-20
Debian DSA-531-1 2004-07-20
Red Hat RHSA-2004:392-01 2004-07-19
Red Hat RHSA-2004:395-01 2004-07-19
Conectiva CLA-2004:847 2004-07-16
SuSE SUSE-SA:2004:021 2004-07-16
Mandrake MDKSA-2004:068 2004-07-14
Gentoo 200407-13 2004-07-15
tinysofa TSSA-2004-013 2004-07-14

Comments (none posted)

phpbb: input sanitizing

Package(s):phpbb CVE #(s):
Created:December 1, 2004 Updated:December 1, 2004
Description: phpBB fails to sanitize input properly; this vulnerability may be exploited by a remote attacker to execute arbitrary code. Version 2.0.11 contains the fix.
Alerts:
Gentoo 200411-32 2004-11-24

Comments (none posted)

phpMyAdmin: cross-site scripting

Package(s):phpMyAdmin CVE #(s):CAN-2004-1055
Created:November 29, 2004 Updated:December 1, 2004
Description: Cedric Cochin has discovered multiple cross-site scripting vulnerabilities in phpMyAdmin. These vulnerabilities can be exploited through the PmaAbsoluteUri parameter, the zero_rows parameter in read_dump.php, the confirm form, or an error message generated by the internal phpMyAdmin parser. By sending a specially-crafted request, an attacker can inject and execute malicious script code, potentially compromising the victim's browser.
Alerts:
Gentoo 200411-36 2004-11-27

Comments (none posted)

phpWebSite: HTTP response splitting

Package(s):phpWebSite CVE #(s):
Created:November 26, 2004 Updated:December 1, 2004
Description: phpWebSite is vulnerable to HTTP response splitting attacks. A malicious user could inject arbitrary response data, leading to content spoofing, web cache poisoning and other cross-site scripting or HTTP response splitting attacks.
Alerts:
Gentoo 200411-35:02 2004-11-26

Comments (none posted)

PostgreSQL: Insecure temporary file use in make_oidjoins_check

Package(s):PostgreSQL CVE #(s):CAN-2004-0977
Created:October 18, 2004 Updated:December 20, 2004
Description: The make_oidjoins_check script insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When make_oidjoins_check is called, this would result in file overwrite with the rights of the user running the utility, which could be the root user.
Alerts:
Red Hat RHSA-2004:489-01 2004-12-20
Mandrake MDKSA-2004:149 2004-12-13
OpenPKG OpenPKG-SA-2004.046 2004-10-29
Debian DSA-577-1 2004-10-29
Ubuntu USN-6-1 2004-10-27
Gentoo 200410-16 2004-10-18

Comments (none posted)

ProZilla: Multiple vulnerabilities

Package(s):ProZilla CVE #(s):CAN-2004-1120
Created:November 23, 2004 Updated:February 1, 2005
Description: ProZilla contains several exploitable buffer overflows in the code handling the network protocols. A remote attacker could setup a malicious server and entice a user to retrieve files from that server using ProZilla. This could lead to the execution of arbitrary code with the rights of the user running ProZilla.
Alerts:
Debian DSA-663-1 2005-02-01
Gentoo 200411-31 2004-11-23

Comments (none posted)

qt3: BMP image parser heap overflow

Package(s):qt3/qt3-non-mt/qt3-32bit/qt3-static CVE #(s):CAN-2004-0691 CAN-2004-0692 CAN-2004-0693
Created:August 19, 2004 Updated:May 15, 2005
Description: A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution.
Alerts:
Fedora-Legacy FLSA:152763 2005-05-12
Conectiva CLA-2004:866 2004-09-22
Whitebox WBSA-2004:414-01 2004-09-20
Debian DSA-542-1 2004-08-30
Fedora FEDORA-2004-271 2004-08-23
Fedora FEDORA-2004-270 2004-08-23
Gentoo 200408-20 2004-08-22
Red Hat RHSA-2004:414-01 2004-08-20
Mandrake MDKSA-2004:085 2004-08-18
SuSE SUSE-SA:2004:027 2004-08-19

Comments (none posted)

rp-pppoe, pppoe: missing privilege dropping

Package(s):rp-pppoe, pppoe CVE #(s):CAN-2004-0564
Created:October 4, 2004 Updated:November 15, 2005
Description: Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver from Roaring Penguin. When the program is running setuid root (which is not the case in a default Debian installation), an attacker could overwrite any file on the file system.
Alerts:
Fedora-Legacy FLSA:152794 2005-11-14
Mandrake MDKSA-2004:145 2004-12-06
Debian DSA-557-1 2004-10-04

Comments (none posted)

ruby: infinite loop

Package(s):ruby CVE #(s):CAN-2004-0983
Created:November 8, 2004 Updated:May 15, 2005
Description: The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.
Alerts:
Fedora-Legacy FLSA:152768 2005-05-12
Red Hat RHSA-2004:635-01 2004-12-13
Gentoo 200411-23 2004-11-16
Fedora FEDORA-2004-403 2004-11-11
Fedora FEDORA-2004-402 2004-11-11
Ubuntu USN-20-1 2004-11-08
Mandrake MDKSA-2004:128 2004-11-08
Debian DSA-586-1 2004-11-08

Comments (none posted)

samba: remote DoS vulnerability

Package(s):samba CVE #(s):CAN-2004-0930 CAN-2004-0882
Created:November 8, 2004 Updated:December 1, 2004
Description: According to this Samba advisory a remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters. Versions of Samba 3.0.x up to and including 3.0.7 are vulnerable.

There is also an advisory about possible buffer overruns in smbd.

Alerts:
Fedora FEDORA-2004-459 2004-11-29
Fedora FEDORA-2004-460 2004-11-29
Conectiva CLA-2004:899 2004-11-25
Mandrake MDKSA-2004:136 2004-11-18
Ubuntu USN-29-1 2004-11-18
Red Hat RHSA-2004:632-01 2004-11-16
Trustix TSLSA-2004-0058 2004-11-15
SuSE SUSE-SA:2004:040 2004-11-15
Mandrake MDKSA-2004:131 2004-11-10
Gentoo 200411-21 2004-11-11
Ubuntu USN-22-1 2004-11-10

Comments (none posted)

sharutils: arbitrary code execution

Package(s):sharutils CVE #(s):CAN-2004-1772
Created:October 1, 2004 Updated:April 26, 2005
Description: sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c. An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.
Alerts:
Red Hat RHSA-2005:377-01 2005-04-26
Fedora FEDORA-2005-281 2005-04-01
Fedora FEDORA-2005-280 2005-04-01
Ubuntu USN-102-1 2005-03-29
Fedora-Legacy FLSA:2155 2005-03-24
Gentoo 200410-01 2004-10-01

Comments (none posted)

sox: buffer overflow

Package(s):sox CVE #(s):CAN-2004-0557
Created:July 28, 2004 Updated:February 21, 2005
Description: Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file.
Alerts:
Fedora-Legacy FLSA:1945 2005-02-20
Debian DSA-565-1 2004-10-13
Whitebox WBSA-2004:409-01 2004-08-19
Slackware SSA:2004-223-03 2004-08-07
Conectiva CLA-2004:855 2004-07-30
Gentoo 200407-23 2004-07-30
Mandrake MDKSA-2004:076 2004-07-28
Red Hat RHSA-2004:409-01 2004-07-29
Fedora FEDORA-2004-244 2004-07-28
Fedora FEDORA-2004-235 2004-07-28

Comments (none posted)

SpamAssassin: Denial of Service vulnerability

Package(s):spamassassin CVE #(s):CAN-2004-0796
Created:August 9, 2004 Updated:August 11, 2005
Description: SpamAssassin contains an unspecified Denial of Service vulnerability. By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin service.
Alerts:
Fedora-Legacy FLSA:129284 2005-08-10
Fedora-Legacy FLSA:2268 2005-03-24
Red Hat RHSA-2004:451-01 2004-09-30
Conectiva CLA-2004:867 2004-09-22
OpenPKG OpenPKG-SA-2004.041 2004-09-15
Mandrake MDKSA-2004:084 2004-08-18
Gentoo 200408-06 2004-08-09

Comments (none posted)

SquirrelMail: cross-site scripting

Package(s):squirrelmail CVE #(s):CAN-2004-1036
Created:November 17, 2004 Updated:December 23, 2004
Description: Squirrelmail (through version 1.4.3a-r2) suffers from yet another cross-site scripting vulnerability.
Alerts:
Red Hat RHSA-2004:654-01 2004-12-23
Conectiva CLA-2004:905 2004-12-02
Fedora FEDORA-2004-472 2004-11-28
Fedora FEDORA-2004-471 2004-11-28
Gentoo 200411-25 2004-11-17

Comments (none posted)

Subversion: Remote heap overflow

Package(s):subversion CVE #(s):CAN-2004-0413
Created:June 11, 2004 Updated:March 7, 2005
Description: Subversion has a remote Denial of Service vulnerability that may allow a server that runs svnserve to execute arbitrary code. See this advisory for more information.
Alerts:
Fedora-Legacy FLSA:1748 2005-03-07
SuSE SuSE-SA:2004:018 2004-06-17
Fedora FEDORA-2004-166 2004-06-11
Fedora FEDORA-2004-165 2004-06-11
OpenPKG OpenPKG-SA-2004.028 2004-06-11
Gentoo 200406-07 2004-06-10

Comments (none posted)

sudo: environment variable sanitizing

Package(s):sudo CVE #(s):CAN-2004-1051
Created:November 17, 2004 Updated:May 15, 2005
Description: Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information.
Alerts:
Fedora-Legacy FLSA:152856 2005-05-12
OpenPKG OpenPKG-SA-2005.002 2005-01-17
Debian DSA-596-2 2004-11-24
Debian DSA-596-1 2004-11-24
Ubuntu USN-28-1 2004-11-17
Mandrake MDKSA-2004:133 2004-11-15

Comments (none posted)

sun-jre: Java plugin vulnerability

Package(s):sun-jre CVE #(s):CAN-2004-1029
Created:November 26, 2004 Updated:December 1, 2004
Description: Jouko Pynnonen reported a vulnerability in the plugin mechanism which allows remote attackers to bypass the Java sandbox through the use of javascript.
Alerts:
Gentoo 200411-38 2004-11-29
Conectiva CLA-2004:900 2004-11-26

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tiff: buffer overflows

Package(s):tiff CVE #(s):CAN-2004-0803
Created:October 13, 2004 Updated:April 12, 2005
Description: The tiff library contains several buffer overflows which may be exploited by way of maliciously-crafted image files. See this advisory for more information.
Alerts:
Red Hat RHSA-2005:021-01 2005-04-12
Conectiva CLA-2005:914 2005-01-06
Gentoo 200412-17 2004-12-19
Gentoo 200412-02 2004-12-05
Conectiva CLA-2004:888 2004-11-08
Slackware SSA:2004-305-02 2004-11-01
Red Hat RHSA-2004:577-01 2004-10-22
SuSE SUSE-SA:2004:038 2004-10-22
Mandrake MDKSA-2004:111 2004-10-21
Mandrake MDKSA-2004:109 2004-10-19
Debian DSA-567-1 2004-10-15
Fedora FEDORA-2004-334 2004-10-14
OpenPKG OpenPKG-SA-2004.043 2004-10-14
Gentoo 200410-11 2004-10-13

Comments (none posted)

TWiki: input sanitizing

Package(s):twiki CVE #(s):CAN-2004-1037
Created:December 1, 2004 Updated:December 1, 2004
Description: The TWiki search function does not properly sanitize input, enabling a remote attacker to execute arbitrary commands.
Alerts:
Gentoo 200411-33 2004-11-24

Comments (1 posted)

unarj: buffer overflow vulnerability

Package(s):unarj CVE #(s):CAN-2004-0947
Created:November 11, 2004 Updated:February 2, 2005
Description: The unarj uncompression utility has a buffer overflow vulnerability from handling long file names in an archive. An attacker can cause unarj to crash or execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:2272 2005-02-01
Debian DSA-652-1 2005-01-21
Red Hat RHSA-2005:007-01 2005-01-12
Gentoo 200411-29 2004-11-19
Fedora FEDORA-2004-414 2004-11-11

Comments (none posted)

WordPress: HTTP response splitting and XSS vulnerabilities

Package(s):wordpress CVE #(s):
Created:October 14, 2004 Updated:December 20, 2004
Description: WordPress is vulnerable to HTTP response splitting and cross-site scripting attacks, due to the lack of input validation in the administration panel scripts. A malicious user could inject arbitrary response data, leading to content spoofing, web cache poisoning and other cross-site scripting or HTTP response splitting attacks. This could result in compromising the victim's data or browser.
Alerts:
Gentoo 200410-12:02 2004-10-14
Gentoo 200410-12 2004-10-14

Comments (none posted)

wv: buffer overflow

Package(s):wv CVE #(s):CAN-2004-0645
Created:July 14, 2004 Updated:February 10, 2005
Description: wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem.
Alerts:
Fedora-Legacy FLSA:1906 2005-02-08
Conectiva CLA-2004:902 2004-12-01
Debian DSA-579-1 2004-11-01
Debian DSA-550-1 2004-09-20
Conectiva CLA-2004:863 2004-09-10
Mandrake MDKSA-2004:077 2004-07-29
Fedora FEDORA-2004-225 2004-07-23
Fedora FEDORA-2004-224 2004-07-23
Gentoo 200407-11 2004-07-14

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):xchat CVE #(s):CAN-2004-0409
Created:April 19, 2004 Updated:November 15, 2005
Description: XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:
Fedora-Legacy FLSA:123013 2005-11-14
Red Hat RHSA-2004:585-01 2004-10-27
Netwosix NW-2004-0014 2004-05-01
Red Hat RHSA-2004:177-01 2004-04-30
Mandrake MDKSA-2004:036 2004-04-21
Debian DSA-493-1 2004-04-21
Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-lib: buffer overflows

Package(s):xine-lib CVE #(s):CAN-2004-1379
Created:September 22, 2004 Updated:April 10, 2006
Description: xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:
Fedora-Legacy FLSA:152873 2006-04-04
Debian DSA-657-1 2005-01-25
Mandrake MDKSA-2004:105 2004-10-06
Slackware SSA:2004-266-04 2004-09-22
Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):xine-ui CVE #(s):CAN-2004-0372
Created:April 6, 2004 Updated:April 27, 2006
Description: Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:
Gentoo 200404-20 2004-04-27
Slackware SSA:2004-111-01 2004-04-20
Mandrake MDKSA-2004:033 2004-04-19
Debian DSA-477-1 2004-04-06

Comments (none posted)

xorg-x11: integer overflows

Package(s):xorg-x11 CVE #(s):CAN-2004-0914
Created:November 18, 2004 Updated:September 12, 2005
Description: The X.Org libXpm library has several integer overflow vulnerabilities An attacker can modify XPM images to execute malicious code.
Alerts:
Ubuntu USN-83-2 2005-09-12
Fedora-Legacy FLSA:152804 2005-05-12
Ubuntu USN-83-1 2005-02-16
Gentoo 200502-07 2005-02-07
Gentoo 200502-06 2005-02-06
Red Hat RHSA-2004:612-01 2004-12-20
Red Hat RHSA-2004:610-01 2004-12-20
Debian DSA-607-1 2004-12-10
Mandrake MDKSA-2004:137-1 2004-11-29
Mandrake MDKSA-2004:137 2004-11-22
Mandrake MDKSA-2004:138 2004-11-22
Gentoo 200411-28 2004-11-19
Fedora FEDORA-2004-434 2004-11-17
Fedora FEDORA-2004-433 2004-11-17
SuSE SUSE-SA:2004:041 2004-11-17

Comments (none posted)

xpdf: integer overflows

Package(s):xpdf kpdf cupsys CVE #(s):CAN-2004-0888 CAN-2004-0889
Created:October 21, 2004 Updated:February 18, 2005
Description: Several xpdf integer overflow vulnerabilities can be exploited via a mal-formed PDF document. Similar vulnerabilities can be found in kpdf and in cupsys which share code. Additional information can be found in this KDE security advisory.
Alerts:
Fedora FEDORA-2005-138 2005-02-09
Fedora FEDORA-2005-137 2005-02-09
Fedora FEDORA-2005-133 2005-02-09
Fedora FEDORA-2005-134 2005-02-09
Fedora FEDORA-2005-136 2005-02-09
Fedora FEDORA-2005-135 2005-02-09
Fedora FEDORA-2005-123 2005-02-08
Fedora FEDORA-2005-122 2005-02-08
Debian DSA-599-1 2004-11-25
Gentoo 200411-30 2004-11-23
Conectiva CLA-2004:886 2004-11-08
Gentoo 200410-30:02 2004-10-28
Gentoo 200410-20:02 2004-10-21
Debian DSA-581-1 2004-11-02
Ubuntu USN-14-1 2004-11-01
Ubuntu USN-9-1 2004-10-27
Gentoo 200410-30 2004-10-28
Fedora FEDORA-2004-358 2004-10-28
Fedora FEDORA-2004-357 2004-10-28
Red Hat RHSA-2004:592-01 2004-10-27
Fedora FEDORA-2004-337 2004-10-26
SuSE SUSE-SA:2004:039 2004-10-26
Ubuntu USN-2-1 2004-10-22
Red Hat RHSA-2004:543-01 2004-10-22
Mandrake MDKSA-2004:115 2004-10-21
Mandrake MDKSA-2004:116 2004-10-21
Mandrake MDKSA-2004:114 2004-10-21
Mandrake MDKSA-2004:113 2004-10-21
Gentoo 200410-20 2004-10-21
Fedora FEDORA-2004-348 2004-10-21
Debian DSA-573-1 2004-10-21

Comments (none posted)

yardradius: buffer overflow

Package(s):yardradius CVE #(s):CAN-2004-0987
Created:November 26, 2004 Updated:December 1, 2004
Description: Max Vozeler noticed that yardradius, the YARD radius authentication and accounting server, contained a stack overflow similar to the one from radiusd which is referenced as CAN-2001-0534. This could lead to the execution of arbitrary code as root.
Alerts:
Debian DSA-598-1 2004-11-25

Comments (none posted)

zgv: multiple buffer overflows

Package(s):zgv CVE #(s):
Created:November 8, 2004 Updated:December 14, 2004
Description: Multiple arithmetic overflows have been detected in the image processing code of zgv. An attacker could entice a user to open a specially-crafted image file, potentially resulting in execution of arbitrary code with the rights of the user running zgv. See this BugTraq advisory for more information.
Alerts:
Debian DSA-608-1 2004-12-14
Gentoo 200411-12:01 2004-11-07

Comments (none posted)

zip: arbitrary code execution

Package(s):zip CVE #(s):CAN-2004-1010
Created:November 5, 2004 Updated:February 2, 2005
Description: HexView discovered a buffer overflow in the zip package. The overflow is triggered by creating a ZIP archive of files with very long path names. This vulnerability might result in execution of arbitrary code with the privileges of the user who calls zip. This flaw may lead to privilege escalation on systems which automatically create ZIP archives of user supplied files, like backup systems or web applications.
Alerts:
Fedora-Legacy FLSA:2255 2005-02-01
Debian DSA-624-1 2004-01-05
Red Hat RHSA-2004:634-01 2004-12-16
Mandrake MDKSA-2004:141 2004-11-25
Gentoo 200411-16 2004-11-09
Fedora FEDORA-2004-399 2004-11-08
Fedora FEDORA-2004-400 2004-11-08
Ubuntu USN-18-1 2004-11-05

Comments (1 posted)

zlib: denial of service

Package(s):zlib CVE #(s):CAN-2004-0797
Created:August 25, 2004 Updated:June 10, 2005
Description: Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks.
Alerts:
OpenPKG OpenPKG-SA-2005.007 2005-06-10
Fedora-Legacy FLSA:2043 2005-02-23
Conectiva CLA-2004:878 2004-10-25
Slackware SSA:2004-278-02 2004-10-04
Conectiva CLA-2004:865 2004-09-13
Mandrake MDKSA-2004:090 2004-09-07
SuSE SUSE-SA:2004:029 2004-09-02
Gentoo 200408-26 2004-08-27
OpenPKG OpenPKG-SA-2004.038 2004-08-25

Comments (none posted)

Resources

OpenPMF M3 released

OpenPMF/M3 (a framework which allows for site-wide management of security policies) has been released under the GPL; click below for the details.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.10-rc3, announced by Linus on December 3. Changes since -rc2 include the un-deprecation of MODULE_PARM() (it is generating too many warnings, and the fixes will not be merged before 2.6.10), a new major number (180) for the "ub" USB storage driver, some x86 single-stepping fixes, a large number of "sparse" annotations, the token-based memory management fix, a memory technology device (and JFFS2) update, a frame buffer device update, some user-mode Linux patches, some page allocator tuning, and a few architecture updates. See the long-format changelog for the details.

Linus's BitKeeper repository currently holds a DVB update and a set of bug fixes. Very few patches are being accepted currently as the kernel hackers try to stabilize things for the final 2.6.10 release.

Andrew Morton has released no -mm patches over the last week.

The current bugfix patch from Alan Cox is 2.6.9-ac13.

The current 2.4 prepatch remains 2.4.29-pre1; Marcelo has released no prepatches since November 25.

Comments (2 posted)

Kernel development news

Quote of the week

That's the problem with C++; it is far too easy to misuse. And with a project as big as the Linux Kernel, and with as many contributors as the Linux Kernel, at the end of the day, it's all about damage control. If we depend on peer review to understand whether or not a patch is busted, it is rather important that something as simple as
	a = b + c;
does what we think it does, and not something else because someone has overloaded the '+' operator. Or God help us, as I have mentioned earlier, the comma operator.

-- Ted Ts'o

Comments (27 posted)

Article: SELinux performance improvements

James Morris has posted an article on recent SELinux performance improvements. "The use of RCU solved a serious scalability problem with the AVC, thanks to the work of Kaigai and the RCU developers. It seems likely to be a useful approach for dealing with similar problems, and specifically with some of the SELinux networking code as mentioned."

Comments (none posted)

Improving page fault scalability

Beyond doubt, many LWN readers have been concerned with how page fault performance might be improved on their 512-processor desktop systems. Christoph Lameter has been working on the answer for some months now; his page fault scalability patches are reaching a point where they will likely be considered for inclusion after 2.6.10 comes out. This patch is an interesting example of the kind of changes which must be made to support large numbers of processors.

One of the virtual memory subsystem's core data structures is struct mm_struct. This structure tracks the virtual address space used by one or more processes. It contains pointers to the page tables, to the virtual memory area (VMA) structures, and more. Processes typically have their own struct mm_struct, but threads which share memory also share the same mm_struct.

Access to this structure is serialized by two mechanisms. A semaphore (mmap_sem) controls access to the mm_struct structure itself, and a spinlock (page_table_lock) guards the page tables. When the status of a page must be changed in the page tables, the kernel must first take the page_table_lock to avoid creating confusion with the other processors on the system. When he looked at the scalability of the kernel's page fault handling code, Christoph identified this lock as a problem. When many processors are trying to simultaneously make changes to a single set of page tables, they end up spending a lot of time busy-waiting for the page table lock. Improving the performance of this code thus requires reducing the use of that lock.

The first step in this process is a patch which causes the VM subsystem to hold page_table_lock for shorter periods of time. The lock is dropped for portions of the code which have no need of it, and later reacquired if needed. It is a fairly straightforward exercise in lock breaking which helps scalability, but does not solve the whole problem.

The core of the patch is a set of atomic page table entry functions which can modify individual PTEs with no locking required. Rather than acquiring page_table_lock, making a PTE change, then dropping the lock, the kernel can simply make a call to:

    int ptep_cmpxchg(struct vm_area_struct *vma, unsigned long address, 
                     pte_t *ptep, pte_t oldval, pte_t newval);

This function uses the cmpxchg instruction (or whatever variant or emulation may be available, depending on the architecture) to compare the page table entry pointed to by ptep with oldval; if the two match, the entry is set to newval and oldval is returned. If the two do not match, the current thread lost a race with another processor which changed the PTE first; in that case, the PTE is not modified further and the function returns zero. Kernel code which uses cmpxchg typically will retry a modification when this sort of race occurs; Christoph's code, instead, is able to assume that the competing thread did the same thing as the one it raced against: marked the page as being present in memory. So no retries are needed.

With that change, pages can be brought into the working set and made available without having to take the page_table_lock - except for one last place. The mm_struct structure contains two fields (rss and anon_rss) which track the total number of in-memory pages referenced by this address space (the "resident set size"). When a page is brought in (or forced out), these fields must be incremented or decremented accordingly. Access to rss and anon_rss is controlled by page_table_lock. Getting rid of that last use of the lock has required a surprising amount of work on Christoph's part.

The first implementation turned the RSS fields into atomic_t variables, so that they could be operated on without locking. This solution worked, but it had some shortcomings: (1) they could only be 32-bit variables, since not all architectures support 64-bit atomic types, (2) the atomic operations are still relatively expensive, and (3) having all processors on the system updating a single pair of variables caused a great deal of cache line bouncing, which hurt performance.

The next attempt was called "sloppy_rss." Essentially, the sloppy approach retains the old unsigned long type for rss and anon_rss, and simply updates them without the lock. The result is incorrect RSS values, but Christoph noted that the errors tended not to exceed 1%. This approach is faster than using atomic operations. The incorrect values bugged some developers, however, and the cache bouncing problem remained.

Another approach which was to do away with the RSS counters entirely, on the theory that these values were not actually needed very often. When an attempt to query the resident set size was made (generally by reading files in /proc from user space), the kernel would scan through the process's page tables and count the number of resident pages. This idea did not get very far, however; the cost of querying RSS values was simply too high.

The current approach was suggested by Linus last month. A new set of counters is added to the task structure; when a thread brings a page into memory, that thread's counters are incremented accordingly. When a real RSS value is needed, the per-thread values are summed to yield the answer. So querying the RSS still requires a loop, but iterating through a list of tasks is much faster than walking an entire set of page tables. This algorithm avoids locking issues (since each thread takes care of its own page fault accounting and does not contend with others); it also minimizes the cache line problems. The "split RSS" approach still requires rss and anon_rss counters in the mm_struct itself; they are used to track pages brought in by threads which have since exited, and they are decremented when pages are forced out. This change also requires that RCU be used when freeing the mm_struct structure to ensure that no other processor is still trying to calculate an RSS value.

The current version of the patch has convinced Linus, so expect it to go in at some point. The biggest roadblock, at this point, may be that the four-level page table patch is at the front of the queue for 2.6.11. That patch currently conflicts with Christoph's work, and, in general, has made it hard for other VM work to get done. Once the four-level patch goes into the mainline, however, things should stabilize somewhat - at least, from the point of view of hackers working on other VM-related patches.

Comments (1 posted)

Toward better kernel releases

It was asked recently: is the 2.6.10 release coming sometime soon? Andrew Morton replied that the latter part of December looked like when it might happen. He also noted that he is trying to produce a higher-quality release this time around:

We need to be be achieving higher-quality major releases than we did in 2.6.8 and 2.6.9. Really the only tool we have to ensure this is longer stabilisation periods.

Andrew also noted that getting people to test anything other than the final releases is hard, with the result that many bugs are only reported after a new "stable" kernel is out. If things don't get better, says Andrew, it may be necessary to start doing point releases (e.g. 2.6.10.1) for the final stabilization steps. Alternatively, the kernel developers could switch to a new sort of even/odd scheme, so that 2.6.11 would be a new features release, and 2.6.12 would be bug fixes only.

Much of the discussion, however, centered around regression testing. If only there were more automated testing, the reasoning goes, fewer bugs would make it into final kernel releases. This wish may eventually come true, but, for now, it appears that regression testing is not as helpful as many would like.

OSDL has pointed out that it runs a whole set of tests every day. The problem, they say, is getting people to actually look at the results. It may be that not enough people know about OSDL's work, and, for that reason, the output is not being used. But it also may be that the testing results are simply not that useful.

Consider this posting from Andrew Morton on regression testing:

However I have my doubts about how useful it will end up being. These test suites don't seem to pick up many regressions.... We simply get far better coverage testing by releasing code, because of all the wild, whacky and weird things which people do with their computers. Bless them.

The test suites, it seems, are not testing for the right things. One could argue that the test suites simply have not, yet, been developed to the point where they are performing comprehensive testing of the kernel. This gap could be slowly filled in by having kernel bug fixes be accompanied by new tests which verify that the bug remains fixed. Much of the code in the kernel, however, is hardware-specific, and that code is where a lot of bugs tend to be found. Hardware-specific code can only be tested in the presence of the hardware in question. Outfitting a testing lab with even a fraction of the hardware supported by Linux would be a massively expensive undertaking.

So the wider Linux community is likely to remain the testing lab of last resort for the kernel; the community as a whole, after all, does have all that hardware. And the truth of the matter is that helping with testing is part of the cost of free software (and of the proprietary variety as well). So the best results might be had by trying to get more widespread testing earlier in the process. Getting Linus to distinguish between intermediate and release candidate kernels might help in that regard. If that can't be done, then, perhaps, going with point releases may be required.

Comments (8 posted)

Which is the fairest I/O scheduler of them all?

Certain parts of the kernel, it seems, can be tweaked forever; I/O schedulers would count as one of those parts. Linux has three of them currently (plus a no-op scheduler), and its block I/O performance is generally quite good. But that doesn't mean it can't be improved.

Jens Axboe recently decided to do some more hacking on his "completely fair queueing" (CFQ) scheduler; the result is the new time-sliced CFQ scheduler, which has since seen a second third fourth revision. The CFQ scheduler has always tried to divide the bandwidth of each block device fairly among the processes performing I/O to that device; the time-sliced version goes further by giving each process exclusive access to the device for a period of time.

In particular, the time-sliced scheduler picks a process, and dispatches only that process's requests to the device for some tens of milliseconds. The device is allowed to go idle for a few milliseconds if all of the selected process's requests have been satisfied, with the idea that the process may generate more requests within that window. If those requests don't come, that process's time slice ends. Later revisions of the patch check to see whether the given process is actually likely to run within the idle window, and preempt the slice immediately if the answer is "no."

Jens claims some very good results for the new scheduler. The bandwidth numbers are nearly as good as those obtained with the anticipatory scheduler (AS), while the maximum latency is much less. These results may not be surprising; Jens has borrowed code from AS, and the idle window has a similar effect to the brief I/O stalls used by AS to improve read bandwidth. As the I/O schedulers poach the best ideas from each other, they may well become more alike. The use of time slices may also improve the locality of accesses to the drive, reducing the amount of time lost to seeks.

The new CFQ scheduler has spawned a low-key debate over which scheduler should be used by default. The default scheduler currently is AS, but some people (Andrea Arcangeli in particular) are saying that it should be CFQ instead. SUSE apparently already makes CFQ the default scheduler for its enterprise kernel. Andrew Morton is unsure; AS still seems to be better for desktop systems and IDE disks. Even so, he is ready to consider a change in the default scheduler:

That being said, yeah, once we get the time-sliced-CFQ happening, it should probably be made the default, at least until AS gets fixed up. We need to run the numbers and settle on that.

The AS scheduler has already seen one improvement: a fix for a bug that caused horrible performance for processes doing direct writes. Expect other changes as AS hacker Nick Piggin works at improving its performance. However this friendly competition turns out, better disk I/O performance for Linux users will be part of it.

Comments (4 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

Documentation

Filesystems and block I/O

Janitorial

Memory management

Architecture-specific

Security-related

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

Fedora Core 3 on AMD64

December 8, 2004

This article was contributed by Ladislav Bodnar

We continue our series of articles on AMD64 ports of various distributions with a brief look at Fedora Core 3. Based on product reviews and user experiences as expressed on various mailing lists and forums, version 3 is probably the best Fedora release to date. The distribution comes with the very latest kernel, X.Org, GNOME and KDE, the developers seem to have resolved most of the reported issues with SELinux, and the distribution feels polished and generally well-designed. Although not without its flaws, of course, but still a solid and innovative product worthy of an install, even if you prefer another distribution.

After downloading the 2.5 GB x86_64 ISO image, we burned it onto a DVD, and proceeded with installation. For the record, here are the system specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2 (Socket939) mainboard from Micro-Star International, 1 GB of DDR SDRAM, 2 x 120 GB Maxtor hard disks, Plextor PX-712A DVD/CD Rewritable Drive, and NVIDIA GeForce4 Ti 4600 graphics card. Although we chose to install a complete workstation with both GNOME and KDE, as well as all server applications, the installation completed in under 15 minutes. There are no obvious differences between installing Fedora's x86_64 port and its i386 counterpart and once you reboot into your new system, you might be wondering whether this operating system has really been optimized for your 64-bit processor.

We were wondering too, so we decided to take a look at how many of the available Fedora RPMs were compiled for x86_64 systems. Looking through the RPM directories, we found that the x86_64 branch contains a total of 1,619 "x86_64" and "noarch" RPM packages, while the i386 branch lists a total of 1,652 RPM packages. This means that over 98% of Fedora packages have been ported to the AMD64 architecture. By comparison, the Debian unstable branch for AMD64 currently holds 14,911 DEB packages, which represent nearly 96% of all DEB packages found in the i386 architecture.

The remaining packages in Fedora Core were compiled for i386 and are available for installation alongside the x86_64 packages - the most noteworthy among them are Helix Player and OpenOffice.org. Because of this likely mix of 64-bit 32-bit applications on most users' systems, many libraries come in two variants. In fact, looking through the install log, we found no fewer than 52 packages, of which both i386 and x86_64 flavors were installed; this included libgcc, glibc, perl, xorg-x11-libs, gtk2 and many others. On a Fedora system, these two sets of libraries are placed into two separate directories - /lib and /lib64. This is somewhat different from the Debian approach where /lib is just a symbolic link to /lib64, while the ia32 libraries are stored in the /emul/ia32-linux directory. Unlike Debian, Fedora doesn't offer a possibility to install the 32-bit part of the system into a separate, "chroot-ed" environment and the 32-bit and 64-bit libraries and applications coexist on the same system, only separated by the layout of system directories.

The 64-bit Fedora Core 3 has been running rather smoothly on this system. We were impressed by the hardware auto-detection and setup, as well as the overall look and feel of the GNOME 2.8 desktop. But as Fedora Core 3 is really just a base for the upcoming Red Hat Enterprise Linux 4 and therefore lacks many popular desktop applications, we were curious about the availability of third-party RPMs to enhance the multimedia capabilities of the distribution. These are generally made for i386, but what about x86_64? We headed over to freshrpms.net to find out. This turned out to be a mixed-bag experience - there is plenty of good software compiled for i386, but not that much for x86_64. As an example, we tried to install the xmms-mp3 package, but since it was only available for i386, it wouldn't install until we "downgraded" our 64-bit xmms to 32-bit xmms. Other applications fared better and we located pre-compiled 64-bit RPMs of MPlayer, xine, Audacity, Ogle, libdvdcss and other software. Disappointingly, using "apt" to install them proved impossible as each 'apt-get install' command was immediately followed by an enormous list of unmet dependencies. We had better luck with "yum", which worked like magic, even correctly detecting the architecture and automatically downloading and installing 64-bit packages, whenever available.

Given the extra overhead in terms of disk space and memory usage while running two "editions" of the same libraries, as well as the limited number of third-party RPMs, is there a case for running a 64-bit Fedora Core? In other words, are there any advantages of running a 64-bit system on a 64-bit processor, as opposed to running a 32-bit system on a 64-bit processor? As always, it depends. Unfortunately, it seems that right now, and for the majority of users, the disadvantages outweigh the benefits. While we haven't done any speed benchmarks, from what we know about the 64-bit CPUs, most users are unlikely to notice much difference. There might be cases where the 64-bit processors clearly outperform the 32-bit ones, especially in tasks which involve encoding large media files, heavy web serving with scripts and output compression, or running massive databases that require substantial amounts of memory. But users performing everyday office tasks will benefit little from the 64-bit technology.

So why run it at all? Maybe just for that feeling of satisfaction of riding on the cutting edge of consumer technology, not too dissimilar from the feeling of a mountain climber who just conquered Mt. Everest, although he could have chosen to climb a smaller mountain. But there is a second, much more legitimate reason - to avoid the upcoming Year 2038 Bug. That's because on January 19, 2038, at 03:14:07 GMT, exactly 231 seconds will have passed since the beginning of the UNIX epoch on January 1st, 1970. One second later, all 32-bit UNIX systems will revert back to the year 1970. We'll leave it to your imagination as to what will happen unless you migrate your data and applications to a 64-bit system before then.

Comments (27 posted)

Distribution News

Xandros Desktop Version 3 released

Xandros has announced the availability of version 3 of its desktop Linux distribution; click below for the details. "Xandros Desktop 3 provides the ultimate Linux desktop experience for laptops and PCs with enhanced wireless support, drag-and-drop DVD burning, and automatic alerts to Xandros Networks updates. Employing a Xandros-enhanced KDE 3.3 and an underlying 2.6.9 Linux kernel, the new version also provides enhanced security with a Personal Firewall wizard, simple access to virtual private networks, and automatic encryption of user home folders."

Full Story (comments: none)

Mandrakelinux

Mandrakelinux 10.1 Official is now available for download. There are three ISO CD images, a DVD ISO image and a mini-CD ISO image.

Here's the Cooker Weekly News, issue 14 with a look at what's been cooking at Mandrakesoft from November 15 to December 5, 2004.

Mandrakelinux updates: drakxtools (updated to point users of stable releases to Bugzilla - 10.1) and dietlibc (provides proper support for the AMD64 architecture - 10.0).

Comments (1 posted)

Concurrent RedHawk Version 2.2 Real-Time Linux Operating System For Intel And AMD Processors Now Available

Concurrent has announced the availability of version 2.2 of its RedHawk Linux real-time operating system. "RedHawk 2.2 is one of the most deterministic Linux operating systems available today supporting both 32-bit Intel(R) Xeon(TM) and the 64-bit AMD(R) Opteron(TM) platforms in the same release. RedHawk 2.2 adds support of Intel's latest Xeon EM64T (Nocona) based systems."

Comments (none posted)

Fedora Core

Fedora Core 3 updates: boost (upgrade to current release, 1.32.0), selinux-policy-targeted (update policy to fix problems with htdig, mysql, and ntpd), selinux-policy-strict (update to latest version in rawhide), cyrus-imapd (fixes a package installation problem), netatalk (patch temp file vulnerability with etc2ps), gaim (upgrade 1.1.0 - bugfixes), rhpl (remove synaptics requires), ttfonts-ja (plays nice with ghostscript), mc (security fixes, better UTF-8), udev (039-10.FC3.4), udev (039-10.FC3.5 - fixed udev.rules for cdrom symlinks), gnome-bluetooth (fixed gnome-bluetooth-manager script for 64 bit), rsh (fixed rexec fails with "Invalid Argument"), and Omni (upgrade to 0.9.2).

Fedora Core 2 updates: cyrus-imapd (fixes a package installation problem), netatalk (patch temp file vulnerability with etc2ps), and gaim (upgrade 1.1.0 - bugfixes).

JPackage 1.6 has been released. JPackage serves as the upstream of numerous FC Java packages.

Comments (none posted)

SUSE Security Summary Report SUSE-SR:2004:003

SUSE Linux has fixed a bunch of minor security issues in the kernel, cyrus-imapd, imlib, unarj and zip. Click below for more information.

Full Story (comments: none)

New Distributions

Downloadable Linux Audio Live CD ISO

An iso image of the Linux Audio Live CD, published by German Keyboards, is available for download.

Full Story (comments: none)

Games Knoppix released

The first release of the Games Knoppix (St. Nicholas Day Release) is ready for download. This is a Knoppix 3.7 based CD with Castle-Combat, Globulation 2, Hatman, Kobodeluxe, Miniracer, Pingus, Rafkill, and lots of other games.

Comments (none posted)

Distribution Newsletters

Debian Weekly News

The Debian Weekly News for December 7, 2004 is out. In this issue: Frank Ronneburg has updated his book about Debian and will present it on December 14th in Berlin, Germany. Europcar has switched 1,500 computers in branch offices to Debian based thin clients, and is now moving 3,500 more machines in headquarters to GNU/Linux, also Hot Babe and non-US?, Sarge Release Update, and more.

Full Story (comments: none)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of December 6, 2004 is out. Topics this week include the Gentoo Developer Meeting at the 21st Chaos Communication Congress (21C3) in Berlin, Germany on December 28, the release of Gentoo Linux 2004.3-r1, and more.

Full Story (comments: none)

DistroWatch Weekly, Issue 78

The DistroWatch Weekly for December 6, 2004 is out. "Welcome to this year's 48th edition of DistroWatch Weekly. This week we'll talk about the Knoppix live CD, feature the Damn Small Linux mini distribution, and present several upcoming distribution releases, including Mandrakelinux 10.2 and NetBSD 2.0. Happy reading!"

Comments (none posted)

Minor distribution updates

FlashLinux 0.3.2 - now available (GnomeDesktop)

GnomeDesktop reports the release of Flash Linux 0.3.2. "Hopefully this release fixes "everything" and adds some nice new features."

Comments (none posted)

New Quantian release 0.6.9.2 available

Quantian 0.6.9.2 is out, with over 475 new packages from CRAN and BioConductor for statistical computing, data analysis and graphical methods via the R environment and language.

Full Story (comments: none)

Newsletters and articles of interest

True Stories of Knoppix Rescues (O'ReillyNet)

O'ReillyNet has some tales of Knoppix rescues. "As a battle-hardened sysadmin, I've seen a lot of broken systems (some I broke, and some were broken for me). I've carried a number of rescue disks, including tomsrtbt and the LinuxCare Bootable Business Card, but over the past year or two, I've started to rely completely on Knoppix as an all-in-one rescue disk. Below are some real-life accounts of how I've saved some broken systems with just my Knoppix CD."

Comments (none posted)

My workstation OS: Xandros Desktop 2.0 Deluxe (NewsForge)

NewsForge presents a user's view of Xandros. "I've been using Xandros Desktop 2.0 for about a year now. It has all the features I need in a desktop to keep my business, my family, and myself happy. Xandros 2.0 has made administering my home computer easier and allowed me to move away from a dual-boot configuration."

Comments (none posted)

Interview with the head of the Caos Foundation (LinuxTimes.net)

LinuxTimes.net interviews Greg M. Kurtzer, the head of the Caos Foundation. "The cAos Foundation now hosts 2 major distribution projects. Today, the most popular is Centos, which is a rebuild of the freely distributable sources in Enterprise Linux. The second project is cAos Linux which is a new distribution which offers a nice cross between bleeding edge, stability, and longevity. cAos Linux was the first project of the Foundation, thus it shares the name."

Comments (none posted)

BeatrIX Linux 0.1b (addict3d.org)

Addict3d.com takes a quick look at BeatrIX Linux. "BeatrIX Linux is a live-CD containing kernel 2.6.7, Gnome 2.6, Open Office 1.1.2, Firefox, Evolution, GAIM and more. It doesn't touch your hard drive or in any way mess up your current O.S. It was designed primarily for the new breed of Via mini-ITX motherboards that are fanless, low-powered and tiny, but will run on just about any Pentium-class computer with at least 64 megs of RAM."

Comments (none posted)

ShipIt Deus Ex: Ubuntu, good for Disorder?

Click below for a a tribute to Ubuntu (warty warthog) as posted to linux-elitists by Greg Folkert.

Full Story (comments: none)

Distribution reviews

Fedora Core 3: A whole new level (NewsForge)

NewsForge looks at Fedora Core 3. "If I were a movie reviewer, I would give FC3 a thumbs-up. It is a solid release with few problems, and most of those are specific to certain hardware. Its ease of installation and package management system make it an excellent choice for newbies who want to learn Linux without the horrendous learning curve associated with having to compile everything yourself. Its functional SELinux component is a powerful incentive to install it just to learn what will certainly become a standard in the near future. Indeed, SELinux alone probably takes FC3 to a whole new level."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The HP Linux Imaging and Printing System

Hewlett Packard has launched a new open-source Linux project that supports its printing, scanning, and digital camera products, HPLIP. HPLIP has been released under version 2 of the GNU General Public License.

Hewlett-Packard is proud to announce the initial release of HP Linux Imaging and Printing System (HPLIP). HPLIP is a complete single and multi-function printing device connectivity solution for users of Linux OS. The goal of this project is to provide "radically simple" printing, scanning, photo card access, and device management to the consumer and business Linux user.

HPLIP is part of the HP Linux Printing Project: "The HP driver project provides printing support for more than 300 printer models, including, DeskJet, OfficeJet, Photosmart, Business Inkjet and some LaserJet."

The HPLIP feature list includes:

  • Inkjet printer cartridge cleaning and alignment functions.
  • Status display for printer supplies.
  • Scanning capabilities via SANE.
  • A CUPS print spooler backend with bidirectional connectivity.
  • A photo card slot image downloading application.
  • Support for more than 300 HP printers.
  • Support for parallel port, USB, and network printer interfaces.
Instead of reinventing existing functions with a proprietary system, HPLIP works with existing open-source software. The list includes the Foomatic printer database from LinuxPrinting.org, the CUPS print spooler, and the SANE (Scanner Access Now Easy) project, all of which are commonly used Linux components. This strategy should insure better cooperation with the open-source developer world, and will allow for faster bug fixing and security updates.

The HP Inkjet Driver Project Readme document goes into more information on the project. One interesting detail of the project is the smorgasbord of licenses used: "In general all applications are covered by the GNU General Public License (GPL) and the backend is covered by a MIT license. The printer driver HPIJS uses a BSD license."

Dependencies include a Linux kernel at or above 2.4.19, GNU Ghostscript, Foomatic, Qt, PyQt, Python, CUPS, net-snmp, and most major Linux distributions. The initial (version 0.8.1) release was superseded by version 0.8.2, which fixes a number of newly discovered bugs. See the end of the Readme document for change details.

The software configured and built with no problems on a (crusty old) Red Hat 9 system, the documentation on installation is up to date, but the usage information is still forthcoming, according to the README.

HP should be commended for coming up with a genuine open-source solution for connecting their products to Linux, we hope the model encourages other companies to do the same.

Comments (12 posted)

System Applications

Backup Software

KDar 1.3.1 released

Version 1.3.1 of KDar, a GUI-based backup utility, is out with bug fixes.

Full Story (comments: none)

Database Software

Firebird relational database releases

The Firebird relational database project has announced version 1.5.2 Release Candidate 4 of Firebird, version 1.7 Beta 2 of the Firebird ADO.NET Data Provider, and version 1.5.5 of the Jaybird JDBC/JCA Driver.

Comments (none posted)

GLOM 0.8.10 released

Version 0.8.10 of GLOM, a database table definition GUI, is out with bug fixes, a new example document, and more.

Full Story (comments: none)

PostgreSQL 8.0.0 Release Candidate 1

The first release candidate for PostgreSQL 8.0.0 is available for download on all mirrors. You can find the complete list of changes/improvement since Beta 5 was released here.

Full Story (comments: 13)

pgAdmin III 1.2.0 Released

Version 1.2.0 of pgAdmin III, a cross-platform GUI PostgreSQL administration and management tool, is out. Changes include support for PostgreSQL 8.0.0, GUI improvements, query tool output to file, a new permissions grant tool, and much more.

Full Story (comments: none)

Filesystem Utilities

GParted 0.0.7 released

Version 0.0.7 of GParted, the Gnome Partition Editor, has been released. Changes include official support of extfs 2/3, and reiserfs, ntfs support, detection of drives without labels, support for creation of unformatted partitions, and more.

Full Story (comments: none)

Libraries

Pango 1.7.0 released

Unstable release 1.7.0 of Pango, a library for layout and rendering of text, is available. "The major change in this release is PangoRenderer, a base object holding the logic for rendering PangoLayout which was previously duplicated in many places. Also in this release, support has been added for the Lao and Syriac scripts."

Full Story (comments: 1)

Web Site Development

BBClone 0.4.6 released

Version 0.4.6 of BBClone, a PHP-based web counter, is out. Changes include a new look and feel, optional column display of last visited page and search engine queries, and a large translation update.

Comments (none posted)

LDAP Server Administration with GOsa (O'Reilly)

Alexander Prohorenko introduces GOsa in an O'Reilly article. "GOsa (GOnicus System Administrator) is a web administration tool for managing accounts and systems in LDAP databases, written in PHP and licensed under the GNU GPL. The author of GOsa is GONICUS GmbH, a German company. GOsa can manage users, groups, mail distribution lists, thin clients, and faxes. Users can retrieve information about themselves, use LDAP contact and telephone lists, change their passwords, and view fax statistics. Users can also configure their own mail accounts, but their configuration possibilities are limited."

Comments (none posted)

mnoGoSearch 3.2.26 announced

Version 3.2.26 of mnoGoSearch, a web site search engine, has been released. See the Change History document for details.

Comments (none posted)

ZopeMag Weekly News

The December 2, 2004 edition of the ZopeMag Weekly News is online with the latest Zope web development platform information.

Comments (none posted)

Miscellaneous

Logfmon 0.4 released (SourceForge)

Version 0.4 of Logfmon, a log file monitoring utility, is available. "This version adds the ability to apply rules to several files rather than just one or all, support for testing entries against a regexp to not match as well as a regexp to match and a number of bug fixes."

Comments (none posted)

Desktop Applications

Calendar Software

Mozilla Sunbird 0.2 beta Released

Version 0.2 beta of Mozilla Sunbird, a redesigned Mozilla Calendar component, is available. "These builds have been dubbed as Sunbird 0.2beta. This means that these builds will be the basis for an upcoming Sunbird 0.2 release if we do not find any major regressions."

Comments (none posted)

Desktop Environments

GNOME 2.9.2 Development Release

Version 2.9.2 of the GNOME Development Release is out. "Of special note in this release is the new 'gnome-menus' module, which you will need if you would like to have your... GNOME... menus. :-) It is a new XDG spec compliant menu system, brought to us by panel co-maintainer, Mark McLoughlin!"

Full Story (comments: none)

KDE 3.3.2 released

KDE 3.3.2 has been released. This release concentrates on bug fixes and translations; there's not much in the way of new applications or features. The release announcement has the details.

Comments (none posted)

Preview of KDE 3.4 (OSDir.com)

George Staikos gives a preview of KDE 3.4. "KDE 3.3.2 was tagged today, so we should see a new bug fix release of KDE in the first or second week of December. Earlier this past week, the plans for a KDE 3.4 release were also finalized. This will be the last major KDE 3 release before KDE 4. KDE 4 will make use of the Qt 4 library which promises to be quite a revolution for KDE and all Qt applications, but will break binary compatibility with previous releases. The release schedule for KDE 3.4 plans for an alpha release December 3, a beta release January 7, and a final release March 16 2005." Thanks to Steve Mallett.

Comments (none posted)

KDE CVS-Digest (KDE.News)

The December 3, 2004 edition of the KDE CVS-Digest is online. Here's the content summary: "KTTSD adds support for SSML /Sable. Kipi-Plugins implements remote gallery export of images. Kpdf adds watch file option. KOffice adds import support for PocketWord's PWD files. Speedups in KTTSD , kwin and khtml."

Comments (none posted)

KDevelop TechNotes Issues #1 and #2 (KDE.News)

KDE.News covers the launch of KDevelop TechNotes. The first article in the series, Browsing documentation with KDevAssistant and the second article RAD with KDevelop using C++/Qt/KDE are currently available.

Comments (none posted)

GARNOME 2.9.2 is out

Version 2.9.2 of GARNOME, the bleeding edge GNOME distribution, is out. "This release incorporates the GNOME 2.9.2 Desktop & Developer Platform, as well the usual assortment of third-party updates to keep even the most seasoned developer frustrated beyond belief."

Full Story (comments: none)

Metacity 2.8.8 released

Stable version 2.8.8 of Metacity, a simple window manager for GNOME 2, has been released with bug fixes.

Full Story (comments: none)

Metacity 2.9.1 released

Version 2.9.1 of Metacity, a simple window manager for GNOME 2, is out. "This is an unstable release heading towards Gnome 2.10, released a little late for Gnome 2.9.2 but there weren't many changes anyway this time..."

Full Story (comments: none)

Electronics

FreePCB 0.936 released

The Open Collector Database site has an announcement for FreePCB version 0.936, a printed circuit CAD application. Here is the change note: "This fixes a few bugs, and adds the following new features: The "Generate CAM files" dialog now allows metric or English units Pins in footprints can now be given alphanumeric identifiers The layer list in the main window now shows an indicator for the active routing layer. The User Guide has been updated."

Comments (1 posted)

XCircuit 3.3.3 released

Version 3.3.3 of XCircuit, an electronic schematic drawing application, is out. Here is the change notice: "Corrected a problem in which drawn subcircuits and subcircuits declared with an "X.." in the info label will share index numbers, by forcing SPICE output to generate a devname of "X" for each drawn subcircuit object. Also: Changed the behavior so that device numbering starts at zero, not one. Otherwise, if a device is numbered zero on the drawing (e.g., by having the index number entered by hand), xcircuit will generate a spurious "duplicate part" warning."

Comments (none posted)

Financial Applications

SQL-Ledger 2.4.6 released

Version 2.4.6 of SQL-Ledger, a web-based double entry accounting system, is out. Changes include updated translations, a new window menu link, and bug fixes.

Comments (none posted)

Games

gnome-games 2.8.2 released

Version 2.8.2 of gnome-games, a collection of games for the GNOME desktop, is out. "This is the third stable release of gnome-games in the 2.8 series. There are no new feature, only bug fixes and translation updates. Unless you are experiencing problems there is no need to upgrade."

Full Story (comments: none)

skstream 0.3.3 released

Version 0.3.3 of skstream, a C++ iostream based network library for the WorldForge game project, has been released. Changes include new methods for shutting down sockets, bug fixes, and code cleanup.

Comments (none posted)

Building a 3D Engine in Perl (O'Reilly)

Geoff Broadwell begins a series on 3d Gaming with Perl on O'Reilly. "This article is the first in a series aimed at building a full 3D engine. It could be the underlying technology for a video game, the visualization system for a scientific application, the walkthrough program for an architectural design suite, or whatever. "

Comments (none posted)

GUI Packages

GLib 2.4.8 released

Stable version 2.4.8 of GLib, the low-level core library that forms the basis for projects such as GTK+ and GNOME, is out. "This is a bug fix release and is source and binary compatible with 2.4.0."

Full Story (comments: none)

GTK+ 2.4.14 released

Version 2.4.14 of GTK+, a multi-platform toolkit for creating graphical user interfaces, has been released. "This is a bug fix release and is source and binary compatible with 2.4.0."

Full Story (comments: none)

gtkmm 2.5.2 announced

Version 2.5.2 of gtkmm, the wrapper for the GTK+ API, is out with lots of API changes and improved documentation.

Full Story (comments: none)

Gtk2-Perl 2.8.2 announced

Stable version 2.8.2 of Gtk2-Perl is out. "Gtk2-Perl is the collective name for a set of Perl bindings for GTK+ 2.x and various related libraries. These modules make it easy to write GTK+ and GNOME applications using a natural, Perlish, object-oriented syntax."

Full Story (comments: none)

Imaging Applications

Eye of Gnome 2.8.2 bugfix release

Bugfix release 2.8.2 of Eye of Gnome, an image viewer for the GNOME desktop, is available. "Recently a lot of crashes have been reported for Eye of Gnome into bugzilla. James Henstridge was so kind to fix some of these issues. f you noticed frequently crashes with Eye of Gnome please try out this release and see if it works for you."

Full Story (comments: none)

Instant Messaging

Gaim 1.1.0 Released (GnomeDesktop)

Version 1.1.0 of Gaim, an instant messaging client, has been announced. "finaly they have removed the "switchboard" error :D." Other changes include fallback IRC encodings, a new MSN protocol icon, bug fixes, and more.

Comments (none posted)

Konversation 0.15 Released (KDE.News)

Version 0.15 of Konversation has been announced. "Konversation is a simple and easy to use IRC client. New features include a brand-new Kontact integration, better KDE HIG compliance, DCC rewritten with KIO, support for SSL IRC servers and much more!"

Comments (none posted)

Interoperability

Wine 20041201 released

Release 20041201 of Wine has been announced. Changes include implementation of the RSAENH dll, work on the Direct3D 9 architecture, built-in debugger improvements, reorganization of the Developer's Guide, and bug fixes.

Comments (none posted)

Mail Clients

Evolution 2.0.3 is out

Stable version 2.0.3 of Evolution, the GNOME mail client, is out with a bunch of bug fixes.

Full Story (comments: none)

Thunderbird 1.0 released

Thunderbird 1.0 is out; see the release notes for details and download links.

Comments (none posted)

Office Suites

OpenOffice.org 1.1.4rc announced

OpenOffice.org 1.1.4rc is available. "It is the first release candidate for OpenOffice.org 1.1.4. The build includes bug fixes but no new features."

Full Story (comments: none)

PDA Software

Guikachu 1.5 (development) released

Development version 1.5 of Guikachu, the GNOME Resource editor for PalmOS projects, is out. "This release is part of the 1.5 development branch, so it's all about crazy experimentations and not about providing a polished, well-tested product -- so don't quite replace your 1.4 Guikachu just yet. New in this release: Due to popular request, the ImageMagick dependancy has been dropped. All image handling is now done by either GdkPixbuf, or Guikachu's own internal functions."

Full Story (comments: none)

Web Browsers

Aviary Branch Landing Puts Firefox on the Road to 1.1 (MozillaZine)

MozillaZine reports on the new Firefox Aviary branch. "Last week, the Aviary branch landed on the trunk, bringing the trunk builds of Mozilla Firefox into line with Firefox 1.0. The Aviary branch was cut from the 1.7 branch earlier this year, allowing Mozilla 1.8 development to continue on the trunk without the worry that radical changes (such as those made to Gecko) would adversely affect the stability of Firefox 1.0 and Thunderbird 1.0. Changes to core Mozilla components like Gecko were only checked into trunk and not the Aviary branch, while late-breaking Firefox 1.0 features (like the Find bar and the Plugin Finder Service) were only checked into the Aviary branch and not the trunk. Both Firefox 0.9 and 1.0 were released from the Aviary branch."

Comments (1 posted)

Word Processors

AbiWord 2.2 Unleashed (GnomeDesktop)

Version 2.2 of the AbiWord word processor has been announced. Here is an overview of new features:
  • A MacOSX port
  • Tables of contents
  • Document history/revisions
  • Better support for international scripts and locales
  • List folding
  • Text wrapping around images
  • Faster rendering
  • Dashboard integration
  • Visual drag and drop

Comments (none posted)

Miscellaneous

Coaster 0.1.3 announced

Version 0.1.3 of Coaster, a CD burning application for GNOME, is out. Changes include code cleanup, a help skeleton, support for exporting to and burning from ISO images, bug fixes, and more.

Full Story (comments: none)

gnome-panel 2.8.2 released

Version 2.8.2 of gnome-panel, the applet bar on the edge of the GNOME desktop, is out. "This is the "Enfin un tableau de bord traduit" release: since the last stable release, a lot of translations were updated, thanks to the wonderful translator teams."

Full Story (comments: none)

Languages and Tools

Caml

Caml Weekly News

The December 7, 2004 edition of the Caml Weekly News is available. Topics include Functional Reactive Programming in OCaml?, Developing Applications with Objective CAML reviewed on Slashdot, and Tools module for the Standard Lib.

Full Story (comments: none)

HTML

Nvu 0.60 Released (MozillaZine)

Version 0.60 of Nvu, an html editor, is available. "On the change list: a complete rewriting of the site manager and the rulers that solves many issues, and a lot of bug fixes".

Comments (none posted)

Lisp

CL-PPCRE 0.9.1 released

Version 0.9.1 of CL-PPCRE is available. "Version 0.9.1 adds shortcuts for group registration. CL-PPCRE is a Perl-compatible, fast, portable regular expression library written in Common Lisp. The library also supports a sexp-based syntax for specifying regular expressions."

Full Story (comments: none)

Casting SPELs in Lisp

A new Lisp comic book is out. "Conrad Barski has written the comic book "Casting SPELs in Lisp". The book, which is intended for novices, is a Lisp tutorial with the goal of taking the reader to appreciate the most advanced features of the language, particularly macros."

Full Story (comments: none)

Perl

This Fortnight in Perl 6

The November 16-30, 2004 edition of This Fortnight in Perl 6 is out with the latest Perl 6 developments.

Comments (none posted)

PostScript

GGV 2.8.1 is out

Version 2.8.1 of GGV, GNOME GhostView, is available: "the first bug-fix release in the 2.8 series, which is - besides being destined to update your wonderful 2.8 release of the fabulous Gnome desktop environment - also appropriate for the possible 2.9 development release that you might use to give you that feeling of living on the bleeding edge, never sure of what comes next."

Full Story (comments: none)

Python

SPE Tutorial

A new tutorial is available for SPE (Stani's Python Editor). "Spe is a stable, full-featured python IDE with auto-indentation, auto completion, call tips, syntax coloring, syntax highlighting, class explorer, source index, auto todo list, sticky notes, integrated pycrust shell, python file browser, recent file browser, drag&drop, context help, ..."

Comments (none posted)

Dr. Dobb's Python-URL!

The December 2, 2004 edition of Dr. Dobb's Python-URL is online with the latest Python article links.

Full Story (comments: none)

Py Magazine Issue 7

Issue #7 of Py Magazine is under construction. "We have just published the the third article and are busy working on more. Current articles are: "Taking advantage of COM with Python" (free), "Python on .NET", and "Python at both ends of the Web". Future articles will include "Click here: A GUI testing approach", "Docutils", "Using Python to create a mobile data collection system", and a review of the book "Dive into Python"."

Comments (none posted)

Test-Driven Development in Python (O'Reilly)

Jason Diamond discusses test-driven Python development on O'Reilly. "Test-driven development is not about testing. Test-driven development is about development (and design), specifically improving the quality and design of code. The resulting unit tests are just an extremely useful by-product. That's all I'm going to tell you about test-driven development. The rest of this article will show you how it works. Come work on a project with me; we'll build a very simple tool together. I'll make mistakes, fix them, and change designs in response to what the tests tell me."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The December 1, 2004 edition of Dr. Dobb's Tcl-URL is online with another week's worth of Tcl/Tk articles and resources.

Full Story (comments: none)

XML

How to Create a REST Protocol (O'Reilly)

Joe Gregorio introduces the REST architectural style on O'Reilly. "If you follow web services, then you may have heard of REST. REST is an architectural style that can be used to guide the construction of web services. Recently, there have been attempts to create such services that have met with mixed success. This article outlines a series of steps you can follow in creating your protocol--guidance that will help you get all the benefits that REST has to offer, while avoiding common pitfalls."

Comments (none posted)

Introducing XML canonical form (IBM developerWorks)

Uche Ogbuji discusses XML Canonicalization in an IBM developerWorks article. "XML is careful to separate details of a file or other data source, bit-by-bit, from the abstract model of an XML document. This can be an inconvenience when comparing two XML documents for equality -- either directly (for instance, as part of a test suite) or by comparing digital signatures for security purposes -- to determine whether an XML document has been tampered with in some way. The W3C addresses this problem with the XML Canonicalization spec (c14n), which defines a standard form for an XML document that is guaranteed to provide proper bit-wise comparisons and thus consistent digital signatures. In this article, Uche Ogbuji introduces XML Canonicalization."

Comments (none posted)

Editors

gedit 2.8.2 released

Version 2.8.2 of gedit, a text editor for GNOME, is out with bug fixes and translation improvements.

Full Story (comments: none)

IDEs

KDevelop TechNotes Issue #3 (KDE.News)

KDE.News summarizes the contents of issue 3 of the KDevelop TechNotes: "Improved Ruby programming language support with Qt Designer integration and Ruby debugger is considered as the "killer" feature of upcoming KDevelop 3.2. Therefore this issue describes new "hot" features, discusses RAD using Ruby language and Qt/KDE libraries and lays stress on integrated GUI design with KDevelop Designer."

Comments (none posted)

Profilers

Valgrind 2.2.0: Memory Debugging and Profiling (Linux Journal)

Reg. Charney demonstrates a Valgrind profiling session in a Linux Journal article. "Memory and performance problems plague most of us, but tools are available that can help. One of the best, most powerful and easiest to use is Valgrind. One thing stands out when you use Valgrind--you do not need to recompile, relink or modify your source code."

Comments (10 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

To Evil! November (OSDir.com)

In the November To Evil! Danny O'Brien vents his self-righteous indignation on script kiddies and spammers. "Thinking about it, I'm actually rather glad that SCO gets hacked so often. It gives me and many others a perfect opportunity to highlight how evil crackers are, with the not unpleasant side-effect of establishing ourselves as the moral paragons."

Comments (1 posted)

Open Source Wall Street for December 6

The Decatur Jones Open Source Wall Street newsletter for December 6 (PDF) is available, with looks at SCO, Red Hat, Novell, Mandrakesoft, Sun, and more. "We believe that SUNW had little choice other than to make its license incompatible with the GPL, otherwise the best parts of Solaris would have simply been usurped and added to Linux. Thus we are skeptical that a robust development community will form around SUNW's code, thereby defeating the benefits of Open Source. As we have stated in the past, we believe that SUNW is wasting critical resources by competing with broadly supported, and rapidly evolving, Open Source projects versus taking a more agnostic approach that caters to customer's desires."

Comments (10 posted)

Trade Shows and Conferences

Italian Linux Day 2004 (NewsForge)

NewsForge covers the fourth Italian National Day of Linux and Free Software conference. "During the whole day, the reception desk made it easy even for the casual passer-by to try GNU/Linux software safely. The LUG members had organized a no-stop, a-la-carte CD burning service for all visitors. The catalog offered a lot of LiveCD distributions, including specialized ones like So.Di.Linux's direct ancestor EduKnoppix (Live GNU/Linux for schools), the multimedia-oriented dyne:bolic, and BristolMorphix, which includes the video-editing suite Cinelerra."

Comments (none posted)

The SCO Problem

Lots of Activity in SCO v. IBM Land (Groklaw)

Groklaw has a new set of filings in SCO v. IBM, including SCO's memo opposing IBM's copyright (GPL) infringement summary judgment attempt. "One thing is now clear -- the validity of the GPL is not going to be tested in this case. SCO's incompetence has shut the door to them being able to do that. Now, they are wrapping themselves in the GPL flag."

Comments (9 posted)

Companies

Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft)

Netcraft is reporting some initial success by a controversial Lycos MakeLoveNotSpam screensaver, which attacks spammer sites. "A distributed denial of service (DDoS) attack launched by users of Lycos Europe's MakeLoveNotSpam.com screensaver has succeeded in crippling several spammer sites, but some of the targeted sites remain available. While Internet users debate the ethics of the initiative, Lycos Europe is denying reports that the MakeLoveNotSpam site was hacked and defaced last night. An intrusion by hackers would be a serious concern for an operation that controls an army of computers with DDoS capabilities. The site has been unreachable today, which could be related to traffic from Slashdot rather than a counterattack."

Comments (14 posted)

Sun open-source license could mean Solaris-Linux barrier (News.com)

News.com looks at compatibility issues between the GPL and Sun's CDDL, which may be used on the Solaris operating system. ""The CDDL is not expected to be compatible with the GPL, since it contains requirements that are not in the GPL," Claire Giordano of Sun's CDDL team said in its submission. "Thus, it is likely that files released under the CDDL will not be able to be combined with files released under the GPL to create a larger program.""

Comments (41 posted)

Legal

Linux in Government: The Government Open Code Collaborative (Linux Journal)

Tom Adelstein writes about the Government Open Code Collaborative or GOCC.gov, on Linux Journal. "As so many people have said, "Nothing is as powerful as an idea whose time has come." And GOCC.gov is an idea whose time is long overdue. Open-source advocates attempting to initiate legislation and fight the battles on the floors of the various Houses, only to discover the political might and opposition of Microsoft, now have an alternative. State agencies now can download software for free and use it to create a cohesive and standard government infrastructure."

Comments (3 posted)

Interviews

Interview with amaroK's Developers (OSnews)

OSnews.com interviews the core AmaroK developers. "The automatic album cover retrieval is a very popular feature with our users. It fetches album images from the Net or from your harddisk and displays the right image along with the music you play. Not only does this look extremely cool, but also it helps to associate the music with your memory - one image says more than 1000 words."

Comments (none posted)

Resources

Linux Clustering with Ruby Queue: Small Is Beautiful (Linux Journal)

This Linux Journal article shows how to use Ruby and SQLite to create Linux clusters. "Linux clusters have become the new supercomputers. The economics of teraflop performance built on commodity hardware is impossible to ignore in the current climate of dwindling research funding. However, one critical aspect of cluster-building, namely orchestration, frequently is overlooked by the people doing the buying. The problem facing a developer with clustered systems is analogous to the one facing a home buyer who can afford only a lot and some bricks--he's got a lot of building to do."

Comments (none posted)

Reviews

New kid on embedded Linux block -- Gentoo (LinuxDevices)

LinuxDevices takes a look at embedded Gentoo. "A project to create embedded versions of Gentoo Linux has achieved preliminary releases on x86, MIPS, PPC, and ARM. The releases include native core system binaries, cross-platform toolchains, and, for x86, an optional hardened toolchain. The year-old project needs developers to help add cross-compile awareness to source packages."

Comments (3 posted)

Linux needs better network file systems (NewsForge)

This NewsForge article covers a range of choices available for Linux network file systems. "Our current model of the network file system is defined by the paradigm of the enterprise workstation. In this model, a large enterprise has a number of knowledge workers based at a single campus, all using individual work stations that are tied together on a single local area network (LAN)."

Comments (45 posted)

Book Review - Open Source Software: Implementation and Management (Linux Journal)

Linux Journal reviews Open Source Software: Implementation and Management, a book by Paul Kavanagh. "Have you ever had a friend ask you how to introduce open source within an organization? Although some may have outstanding answers for this question, few of those answers carry the credibility that top management might require. If, as projected, half of IT professionals in 2005 will consider open source, this might be a question we all will be hearing more often. It would be nice to suggest a credible resource where those posing the question might be able to find some useful answers."

Comments (none posted)

Miscellaneous

Mozilla previews e-mail program (News.com)

News.com predicts the upcoming release of the Thunderbird 1.0 mail client may offer competition to Microsoft's Outlook Express. "If Thunderbird is to make any market inroads, analysts say, it will have to do what Mozilla's Firefox browser has succeeded in doing: capitalize on frustration with Microsoft's product. "I don't know if the same dissatisfaction is there with Outlook, but we're looking at Outlook Express and we're seeing a lot of parallels with IE," MacGregor said. "There are the nuisances of the Web, spyware slowing down your experience, spammers clogging your inbox, viruses in attachments...We think Thunderbird can help.""

Comments (none posted)

The Linux Kernel's Fuzzy Future (InformationWeek)

Information Week takes the kernel developers to task for not having published a Microsoft-style, three-year kernel development road map. "IBM's Frye sees no reason for the Linux camp to produce its own road map, arguing it's better to keep customers focused on 'what's there today.' Besides, he says, CIOs can get closed-door briefings from Linux distributors if necessary. Yet, his explanation seems a bit like a rationalization for a community-oriented development process that simply hasn't gotten around to centralized, long-term planning."

Comments (40 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Preliminary results for the 2004 GNOME Foundation elections (GnomeDesktop)

According to GnomeDesktop.org, the winners of the 2004 GNOME Foundation director election are Owen Taylor, Luis Villa, Jody Goldberg, Daniel Veillard, Jonathan Blandford, Federico Mena-Quintero, Tim Ney, Miguel de Icaza, Murray Cumming, Christian Schaller, and David Neary

Comments (none posted)

OSDL and Bull Cooperate on Open Source POSIX Test Suite

Open Source Development Labs, Inc. has announced cooperation with Bull on the Open POSIX Test Suite (OPTS). "OPTS is an open source community project designed to make it easier to port applications from other POSIX platforms to Linux. POSIX is a widely-used standard of the Institute of Electrical and Electronics Engineers (IEEE) that promotes portability among operating systems, primarily UNIX operating systems such as AIX, HP-UX and Solaris. In addition to making significant test contributions to the OPTS project, Bull led the effort to integrate the tests into STP to enable POSIX-compliance feedback in a manner that is timely to Linux/OSS developers."

Comments (none posted)

Software patents detrimental to European power supply business

The FSFE has sent an open letter to Austria's Joerg Haider concerning software patents and power grid blackouts. "The dependence of reliable power supplies on reliable software has steadily increased over the years and ever since the US-East Coast blackout of 2003 it has become a topic of public interest. Huge problems are often caused by small mistakes and thanks to networking effects, they can spread like wildfire, affecting huge areas."

Full Story (comments: 1)

No European software patent vote this year

The NoSoftwarePatents site is carrying the news that the EU Council will not proceed with software patents in 2004. "According to the Belgian minister of economic affairs, the past qualified majority for software patents no longer exists, and no decision will be taken under the current Dutch presidency. The latest development is that members of the European Parliament are looking at the possibility to restart the entire legislative process." (Thanks to James Heald).

Comments (14 posted)

Samba Call for Story Submissions

The Samba project has issued a Call for Story Submissions. "news.samba.org is looking for stories, especially those about successful Samba installations. It doesn't matter if yours is a recent install/migration or an existing setup that just works when you need it. We want to hear from our community about how Samba is being put to good use."

Comments (none posted)

Commercial announcements

PalmOS to be built on Linux

PalmSource has put out a press release announcing its acquisition of China MobileSoft. One of the reasons for this acquisition is to use China MobileSoft's Linux work as the base for a new version of PalmOS. There is an open letter to the Linux community (PDF) with more information on what the company has in mind. "We think the Linux platform will become a leading operating system for mobile devices, and we believe the endorsement and support of PalmSource for that platform will greatly accelerate that process. We think the combination of Palm OS and Linux can attract more mobile licensees and developers, create more new devices, and bring in more users than either could on its own." (Thanks to Bruce Perens).

Comments (16 posted)

Evermore Integrated Office to Liberate Computer Users

Evermore Software LLC has announced the new advanced edition of its cross-platform Evermore Integrated Office package. "Available in four international languages -- English, Traditional and Simplified Chinese, and Japanese -- Evermore Integrated Office 2004 Advanced (EIOffice 2004A) enhances performances, operates faster and includes new features requested by enterprise and small business. "EIOffice 2004 Advanced is the next step on the long march to liberate computer users from the Microsoft Office monoculture," said Gus Tsao, president and chief executive officer of Evermore Software LLC".

Comments (none posted)

Fluendo funds Xiph.org for Vorbis and Theora RTP specifications

Fluendo has announced that it is funding Xiph.org to enable Vorbis and Theora codecs for use with the standardized RTP protocol. "Phil Kerr of Xiph.org will be in charge of the development of the specifications, including the creation of reference implementations and working with the Internet Engineering Task Force and other stakeholders. The development will be conducted in an open fashion in the long-standing tradition of the Open Source community."

Full Story (comments: 1)

IBM announces the FairUCE mail filtering solution

IBM's AlphaWorks has an announcement for FairUCE, a Java-based commercial mail filtering system. "FairUCE (which stands for "Fair use of Unsolicited Commercial Email") is a spam filter that stops spam by verifying sender identity instead of filtering content. It can stop the vast majority of spam without the use of a content filter and without requiring a probable spam or bulk folder that needs to be checked periodically. As one of the first spam filters that uses sender identity rather than email content to determine if it is legitimate, all this can be accomplished quickly using simple, inexpensive tests."

Comments (none posted)

A new analyst report on Mandrakesoft

KBC Securities has released a new analysis of Mandrakesoft (PDF). "Overall, the 2003/04 results are very satisfying and should encourage management on the eve of the group's capital increase, which will open the door to accelerated growth and the transfer to a regulated market."

Comments (none posted)

Web Publishing Tool Nvu Now Available

Linspire, Inc. has announced the availability of Nvu, an open-source html editor. "Nvu gives non-technical computer users the power to create, edit and publish professional, attractive Web sites, much like Microsoft FrontPage or Macromedia Dreamweaver. Based on Mozilla Internet technology and Netscape Composer, the tool allows users to easily author and manage rich Web documents without programming or HTML coding."

Comments (none posted)

Survey Finds 55% of CIOs and IT Managers Would Consider Switching to Linux Email

Scalix Corporation has announced the results of a survey on corporate Linux adoption. "Linux continues to gain traction in the enterprise, with 55% of IT executives interviewed in a recent study saying they'd consider switching to Linux messaging over the next two years, if there were no disruption to end users. The independent study, undertaken by Osterman Research in October 2004, also showed that over 80% would consider switching to a web-based email client if it had the same functionality as current desktop clients."

Comments (none posted)

TimeSys Delivers 2.6-based Linux Development Kits for IBM PowerPC 750FX and 750GX Microprocessors

TimeSys Corporation has announced the availability of TimeStorm(R) Linux Development Kits (LDKs) for IBM PowerPC 750FX and 750GX microprocessors. "TimeStorm LDKs include a ready-to-run, hardware-optimized 2.6-based Linux distribution with advanced real-time capabilities such as schedulable hard and soft interrupt handlers and a fully preemptible kernel. 750FX and 750GX LDKs also include the Eclipse 3.0-based TimeStorm(R) Linux Development Suite (LDS)..."

Comments (none posted)

VA Linux Announces `VA FlexMessaging Solution'

VA Linux has announced the release of their commercial VA FlexMessaging Solution. "VA FlexMessaging Solution is an integrated mail system solution based on carefully tuned Open Source software including MTA, POP, IMAP, SPAM filter and so forth. It is an ideally flexible mail system for both small-to-medium setups and large-scale enterprises."

Full Story (comments: none)

Voltaire Announces Scalable Database Platform Solution for Oracle

Voltaire has announced a new scalable database platform solution. "Now available and tuned for Oracle Database 10g, the joint solution, called DBScale, provides a scalable high performance data management infrastructure using high performance, low cost storage and InfiniBand interconnect. This is the industry's only solution to solve file I/O problems for database clusters using industry standard platforms and technologies such as InfiniBand, iSER (iSCSI RDMA), Serial ATA (SATA) and Linux."

Comments (none posted)

New Books

Signate Announces E-Book Version of VoIP Telephony with Asterisk

Signate has announced the free availability of an online version of the book VoIP Telephony with Asterisk, which covers Asterisk, an open source Linux PBX application. A print version of the book is also for sale.

Comments (1 posted)

Resources

FSF Europe Newsletter

The December 5, 2004 edition of the FSF Europe Newsletter is online with the latest news from the Free Software Foundation Europe organization.

Full Story (comments: none)

Linux Gazette Issue #109

The December Linux Gazette is out. Articles include: Virtual Filesystem: Building A Linux Filesystem From An Ordinary File, SQLite Tutorial: Common Commands and Triggers, SuSE Linux 9.2 - An Early Evaluation, Discover the hidden 8 bit Sound card in your PC, and more.

Comments (none posted)

The LDP Weekly News

The December 8, 2004 edition of the Linux Documentation Project Weekly News is online with the latest new documentation resources.

Full Story (comments: none)

More Linux Audio magazine articles

LinuxUser & Developer magazine has published an article (in PDF format) on the Ardour multi-track audio application.

Full Story (comments: none)

"Guide to Open Content Licenses" released, freely available

Florian Cramer has announced a downloadable version of the Guide to Open Content Licenses by Lawrence Liang, the guide provides information on 19 open content licenses.

Full Story (comments: 1)

Upcoming Events

OMG Open Source Modeling and IDEs Workshop CFP

The OMG has announced a Call for Participation for the first annual Open Source Modeling and Integrated Development Environments Workshop. The event will take place in Orlando, Florida on March 21-24, 2005.

Comments (none posted)

GUADEC 2005 (GnomeDesktop)

GnomeDesktop reports that the call for papers is out for GUADEC 2005. The conference will be held in Stuttgart, Germany on May 29 - 31, 2005.

Comments (none posted)

PyCon DC 2005 CFP

A Call for Proposals has gone out for the PyCon DC 2005 conference. The event will take place in Washington, DC on March 23-25, 2005.

Comments (none posted)

Meet the Experts at OSDL's Enterprise Linux Summit

The Open Source Development Labs (OSDL) has announced that it will host a forum at the Enterprise Linux Summit, January 31 - February 2, 2005 in Burlingame, CA. The "OSDL Meet the Experts" forum will be located on the exhibition floor during the conference and will be staffed by OSDL Linux kernel developers, test engineers and other technical staff.

Full Story (comments: 1)

2005 O'Reilly Emerging Tech Conference Registration Opens

Registration has been opened for the 2005 O'Reilly Emerging Technology Conference. The event will take place in San Diego, California on March 14-17, 2005.

Full Story (comments: none)

PHP West Web Services conference

PHP West has announced a conference on Web Services. "PHP West is holding a conference on Web Services on January 14th, 2005 hosted in the beautiful Vancouver, British Columbia, Canada. This is the first of many conferences to come on a four month orbit - each focusing on a unique genre. The conference will be a jam packed one day event with leading speakers in the industry talking about the most important topics PHP developers are faced with."

Comments (none posted)

Events: December 9, 2004 - February 3, 2005

Date Event Location
December 9 - 18, 2004Ubuntu ConferenceMataró, Spain
December 9 - 22, 2004UMeet Virtual ConferenceOn the Net
December 13 - 17, 2004JavaPolis 2004(MetroPolis Antwerp)Antwerp, Belgium
December 27 - 29, 2004Chaos Communication Congress(21C3)(Berliner Congress Center)Berlin, Germany
January 14, 2005PHP West Web Services conference(HR MacMillan Space Centre)Vancouver, BC, Canada
January 28 - February 4, 2005Asia Source(Visthar training venue)Bangalore, India
January 31 - February 2, 2005OSDL Enterprise Linux Summit(Hyatt Hotel)Burlingame, California
February 2 - 3, 2005Solutions Linux 2004(CNIT, Paris la Défense)Paris, France

Comments (none posted)

Web sites

Netscape DevEdge Returns (MozillaZine)

MozillaZine reports on the return of the Netscape DevEdge site. "This follows the sudden disappearance of DevEdge in October. The last we heard, the Mozilla Foundation was trying to get the rights to the DevEdge material, so we suspect the reemergence of the Netscape DevEdge site is a temporary measure until the Mozilla Foundation can begin hosting the content itself."

Comments (none posted)

Open Source Applications in Radiology (LinuxMedNews)

LinuxMedNews mentions the OpenRAD site. "For those who are interested in getting under the hood of medical imaging applications, we have put together a virtual community of practice. OpenRAD has a repository tracking about 40 projects in the PACS space with an RSS news aggregator engine that automatically captures project updates. We are also compiling a tutorial series to demystify DICOM, the medical imaging standard."

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Real-time letters to the editor

The LWN.net Letters to the Editor page has suffered in recent years; the delay between when a letter is sent and when it is published is too long, especially for non-subscribers. We have recently hacked up a new letters page which displays letters as soon as we get them into our system; the first new letter to appear there is a note on "intellectual property" we just received from Richard Stallman. Enhancements (such as an RSS feed) will come soon. Have a look; we're curious to hear what you think.

Comments (10 posted)

Response to Collins' article

From:  Richard Stallman <rms-AT-gnu.org>
To:  lwn-AT-lwn.net
Subject:  Response to Collins' article
Date:  Mon, 06 Dec 2004 23:24:22 -0500

Dear Editors,
 
People who use the term "intellectual property rights" (*) are
generally either trying to confuse you, or already confused
themselves. Since Dr Collins is a trained specialist, I think he
knows what our point really is, and that he only feigns to
misunderstand.
 
I have been campaigning against software idea patents for 14 years,
and I welcome the support of Linus Torvalds. Both he and I are well
aware that copyright covers the details of expression of a program and
does not monopolize ideas--whereas every patent is an explicit
monopoly on use of some idea (**). This is precisely why we are
campaigning against software patents and not against software
copyrights. Both of us are noted for developing powerful, successful
software packages (which, taken together, form the basis of the
GNU/Linux operating system), and both of us are aware that such
projects entail combining thousands of different computational ideas.
If a country allows computational ideas to be patented, developing a
large useful program means running a gantlet of patent threats--which
only the megacorporations think they can do.
 
Offering us the opportunity (at great expense) to use patents to take
shots at other software developers would hardly assuage the damage
that others would do when they point their patents at us. The
European Parliament understood that the "patent protection" software
developers need is protection from patents.
 
Fortunately, Dr. Collins is mistaken in believing that the GATT
agreement (***) requires software patents. Several other countries
that adhere to the WTO reject software patents, and the European Union
would be wise to join them. In the past few years, the European
Patent Office has issued over 30,000 software patents, in blatant
defiance of the treaty which set it up. The Parliament's version of
the directive will reaffirm that these patents never had validity, and
will keep European software developers and users safe. Now the
question is whether the Council of Ministers will support developers
and users generally, or the megacorporations only.
 
Sincerely,
Richard Stallman
MacArthur Fellow
President, Free Software Foundation (www.fsf.org)
 
 
* See http://www.gnu.org/philosophy/not-ipr.xhtml for more explanation
of why the term "intellectual property" is harmful and should be
shunned.
 
** My dictionary defines an idea as "a product of thought". Every
patent covers some idea, in this everyday meaning of the word; a
software patent is therefore a patent covering an idea that can be
used in software, and idea for computation.
 
*** To avoid using the prejudiced term "intellectual property rights",
I refer to the part of GATT that deals with copyrights, patents and
trademarks as TRIPES rather than TRIPS. TRIPES stands for
Trade-Restricting Impediments to Production, Education and Science.

Comments (30 posted)

Page editor: Jonathan Corbet

Copyright © 2004, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds