LWN.net Logo

LWN.net Weekly Edition for January 6, 2005

The Grumpy Editor's guide to 2005

An inevitable part of the new-year ritual is the posting of predictions for the coming twelve months. Your editor, having access to a moderately high soapbox, feels it would be morally wrong to fail to make use of that soapbox to make an absolute fool out of himself. To that end, here are a few ideas for what we might see in the coming year. As always, these predictions are offered in the hope that they will be useful, but they carry NO WARRANTY regarding any correspondence with reality as experienced in your timezone or as to whether they make sense at all.

Development

This will be the year for free desktop infrastructure. Yes, there will be a long series of high-profile application releases, with OpenOffice.org 2.0 being, arguably, at the top of the list. But 2005 will be the year when projects like HAL and D-BUS stabilize and see wide deployment, and when the reinvigorated X.Org development team starts making some truly big strides. The kernel's support for contemporary video cards will be rationalized and improved. Perhaps there will even be a place for Mono. The convergence of all this new, low-level support code, combined with increased cooperation between desktop projects for low-level support, will build the base for the next generation of amazing free desktop applications.

Free databases will see some high-profile deployments. The adoption of free database management systems is still in an early stage. Things will progress in 2005, to the point that some proprietary database vendors will see the need to start competing directly against the free alternatives. Perhaps 2005 is when we'll see some real free database FUD.

There will be no 2.7 kernel in 2005, despite the requests for such a release from some quarters. The 2.6 process will continue to merge changes at a staggering rate, and nothing will come along which is so disruptive that it forces the creation of a new development series. The steady series of complaints about the quality of the 2.6 mainline releases will force some changes to the process - we may see more frequent releases or true "release candidates" for wider testing. But the simple fact is that the kernel developers - and the distributors who have the job of delivering stable kernels to their customers - are happy with things as they are, and will not be in a hurry to go back to the older way of doing things.

Commercial

Red Hat will find something to do with its cash pile. The company currently has about $1 billion (almost half of its market capitalization) in the bank - much of that cash is the result of a debt sale one year ago. As Red Hat's management tries to push the company's stock price back up, it will have to find something more productive to do with that money. It would not be surprising to see an acquisition or two happen in the near future.

The market for not-quite-enterprise distributions will grow. There are no end of companies looking to gain the benefits of switching to Linux, but who do not want to pay the hefty "enterprise Linux" price tag. Many of these companies will realize that high-quality Linux can be had for less, and will look to companies with credible support offerings. Companies like Progeny, Ubuntu, and Specifix may be well placed to thrive in this market. The UserLinux distributed support network model looks an awful lot like the early Red Hat "support partner" program, and risks ending up the same way.

Embedded Linux will gain a higher profile, especially as a base for a new round of "personal media player" gadgets. Expect some fireworks as some of these devices - and their built-in DRM schemes - prove to be more hackable than the entertainment industry would like.

Very few companies will buy Linux indemnification policies, making life difficult for insurance vendors like OSRM.

Distributions

Debian will get a new stable release out, one way or another. Much of the user base for stable Debian releases will, however, have moved on to offshoot distributions like Ubuntu. There will be a new round of soul-searching within the Debian Project over the value of its stable distribution and what that distribution should be.

Community involvement in Fedora will increase, mostly through outside maintenance of some non-core packages. Red Hat will maintain a firm grip on important decisions, however. Don't expect to see an open Fedora developers' conference in 2005.

Legal and political

Thanks to serious activism and the entry of several countries into the EU, software patents will not be enacted in Europe in 2005. One thing your editor has seen many times, however, is that the commercial forces behind this kind of legislation do not ever give up. While their current push looks to be headed for failure, the issue will remain, and the fight will go on.

A new round of copyright legislation will hit the U.S. Congress. The entertainment industry will attempt to strengthen its control and find some sort of legislative solution to file sharing over increasingly decentralized networks. Fair use activists will try again for copyright and DMCA reform. Neither side is likely to get far. The entertainment industry may get caught engaging in increasingly dirty denial of service attacks on peer-to-peer networks and their users.

This one should be fairly obvious: 2005 will see the end of SCO. The company's remaining cases will fall apart in court, and its cash will run out. In retrospect, it will become clear that the SCO lawsuit has actually been a good thing for free software: it has proved how clean our code is now, made developers more aware of the potential for such lawsuits in the future, and has made many large companies take a clear position in the defense of free software. The next company that tries to extract payments from the free software business world will find a climate which is far less hospitable to that sort of litigation; for this reason, your editor believes there will not be a new major intellectual property suit related to Linux in the coming year.

In conclusion...

More people will notice that Linux users don't have spyware and adware problems, which will be getting steadily worse on other platforms. This issue, alone, will cause more people to look at free software. Many will get their feet wet with Firefox and stop there, but others will take the full plunge. As proprietary systems are turned into zombies which spam and spy on their alleged owners, pure exasperation will push a new round of Linux adoption.

Your editor expects many things to continue as they have been. An increasing number of developers will work to create ever more powerful applications. More and more people will awaken to the value of free software, and they will look seriously at using it. Some people will even figure out ways to make money from it. And, inevitably, Linux will continue to be fun - even for a grumpy editor.

Comments (14 posted)

Looking forward to OpenOffice.org 2.0

January 5, 2005

This article was contributed by Joe 'Zonker' Brockmeier.

As the OpenOffice.org development team closes in on the 2.0 release, we thought we'd take a look at the suite and see how the 2.0 version is shaping up. Since OpenOffice.org 2.0 is still in development, it's to be expected that some features do not work or work poorly, and that its stability isn't at a level appropriate for a finished application. The 1.9.65 build of OpenOffice.org certainly lives up to that expectation, and should only be deployed for testing purposes.

We installed OpenOffice.org 1.9.65 from the snapshot builds page on a SUSE 9.2 system. Unlike previous versions of OpenOffice.org, version 1.9.x is being distributed in "native" installer format for various systems. The Linux build is available as an RPM rather than the old OpenOffice.org setup application.

One of the goals for the 2.0 release of OpenOffice.org is for the application to start faster than previous releases. At this point in development, the startup for OpenOffice 1.9.65 is not noticeably faster than 1.1.3, however.

Let's start with the word-processing application, Writer. The sad fact is that OpenOffice.org could be the best word processor ever invented -- but if it fails to import Microsoft Word documents well, it will have a tough time in the general market. This is also true of other OpenOffice.org applications, so we spent a good deal of time testing Office compatibility.

To test out the Word and other Microsoft document import features, this reporter searched for Microsoft Office documents on Google using the "filetype" search feature. Writer is still better at importing Microsoft Word documents than AbiWord, and 1.9.65 does a slightly better job of importing Microsoft Office files than 1.1.3. There still seem to be a few glitches. One Word document, for example, looked almost perfect, with the exception of a bulleted list presented outside the page borders.

The interface for Writer has changed very little, so users who are familiar with Writer already will be able to jump right in to the next version. There are a number of noteworthy new features in Writer aside from its Microsoft Word compatibility. This version of Writer allows an author to count words in a selection, in addition to counting words in the entire document. Nested table support has also improved in this version, which will also help with importing complex Microsoft Word documents. [OOo Impress screenshot]

The Impress interface has changed quite a bit, with floating toolbars for formatting and a tabbed interface to switch between views of the document. This reporter likes the new interface a little more, but the transitions between views are a bit jarring. The "slide sorter" view is particularly nice if one needs to re-arrange a presentation quickly.

Calc looks and feels the same as its predecessor. It has undergone a few improvements under the hood, however. In particular, Calc's limitation of 32,000 rows has been removed. Calc can now handle sheets with up to 65,536 rows, which is the same as Microsoft Excel. We tested this by importing a CSV document with 59,621 rows. Calc had no problem importing this document or saving it as a native OpenOffice.org file.

Calc is a bit better at importing Excel files with odd text formatting than Gnumeric, but Gnumeric does still seem to have the edge in supported functions. Calc fails several tests in Gnumeric's testing files which test for Excel compatibility.

One of the big additions to OpenOffice.org 2.0 is a database application like Microsoft Access. The OO.org Base application is, or should be, a nice addition to the OpenOffice.org suite when it's complete. Unfortunately, Base isn't very stable at the moment, and testing usually resulted in a complete crash in a short time. The Table Wizard is very user-friendly, but each time this reporter tried to create a database using the Wizard, OpenOffice.org would crash at the final step.

Unfortunately, the entire suite is only as stable as its least-stable component. When Base crashed, it brought down the entire suite in one fell swoop. This is a bit of a design flaw, as a user with Writer, Calc and Base open will have all applications crash simultaneously. This did give us a chance to work with the document recovery wizard. At startup, OpenOffice.org would try to recover all documents open at the time of the crash. OpenOffice.org's recovery feature was fairly dependable, but this reporter is looking forward to using it a little less often.

There are also a number of features that can be found throughout the OpenOffice.org suite rather than any specific application. The native file formats have changed to the OASIS Open Document Format for Office Applications. OpenOffice.org applications still support the older format, but new files are saved in the new format by default unless the user changes default file format preferences. Users have a great deal of flexibility in this area, including the ability to save in Microsoft Office formats if they prefer.

OpenOffice.org 2.0 also has a document conversion wizard that allows the user to convert older OpenOffice.org and Microsoft Office documents into the new OpenOffice.org document formats. Rather than forcing the user to convert documents one at a time, the wizard allows a user to convert all documents in a directory at once. This feature isn't quite error-free just yet.

We were also interested in OpenOffice.org 2.0's digital signatures feature. Apparently, OpenOffice.org will allow the user to sign or verify macros and documents in the new format. Unfortunately, this feature didn't seem to be working in the 1.9.65 build.

From a test of the 1.9.65 build, it's pretty clear that the OpenOffice.org project has a way to go before it's finished. However, this release does provide a pretty good overview of what to expect, and it does look like 2.0 will be a formidable suite when finished.

For LWN readers who wish to participate in testing, or just see what else is on the way, a feature guide to 2.0 is available. According to the roadmap, the OpenOffice.org project should be releasing a 2.0 beta some time this month, with a final release tentatively planned for March of this year.

Comments (9 posted)

The LWN.net 2004 Linux Timeline

Much happens in the Linux world over the course of a year. 2004 saw ongoing legal and political fights, new distributions, big releases of major applications, a new mode for kernel development, and more. This timeline is our attempt to separate out the most significant developments of the year and present them in a concise and enjoyable format. It continues an annual LWN tradition; it is the seventh in the series.

This is version 0.9 of the 2004 timeline. If you find any remaining major omissions, please send them to us at timeline@lwn.net; please do not post errors or omissions as comments until after we have had a chance to address them.

The development of the LWN.net Linux Timeline was supported by LWN subscribers; if you like what you see, please consider subscribing to LWN.

As usual, the timeline is split up by month. We apologize that a "one big page" version is not available at this time.

The LWN.net Linux timelines from the last six years are still available:

Comments (5 posted)

Page editor: Jonathan Corbet

Security

The Honeynet report on Linux life expectancy

Numerous electrons have been expended on the recently-released Honeynet report (PDF) on the life expectancy of systems exposed to the Internet. That report concluded that an unpatched Linux system would last, on the average, for about three months before being compromised, while a Windows system had a life expectancy measured in hours. That is an outcome which is certainly welcome to those who are concerned about the security of Linux systems.

If you actually read the report, however, you'll find some interesting things. The test, it would seem, was set up in a way designed to make the Linux systems as easy as possible to compromise. Among other things:

  • The Linux distributions installed were old: Red Hat Linux 7.2, SUSE Linux 6.3, etc. The most current distribution installed was Fedora Core 1, put on two boxes (neither of which was compromised)..

  • These systems had a number of services installed; some of those (i.e. SMB) are not necessarily something one would enable on systems directly connected to the net.

  • The systems were set up with easily guessed passwords as well.

Of the four Linux systems which were compromised, two of them fell to brute-force password guessing. This episode may be a good lesson in why choosing good passwords is still important, but it has nothing to do with Linux security.

The report authors note that the expected lifetime of Linux systems has increased - an interesting development, given that the net has not exactly become a friendlier place. The authors guess, as usual, that the relative popularity of Windows makes it a more attractive target. They also note, however, that default Linux installations have become more secure over time. Certainly much effort has gone toward that end; it is nice to see that it is having an effect.

Comments (6 posted)

New vulnerabilities

debmake: insecure temp directories

Package(s):debmake CVE #(s):CAN-2004-1179
Created:December 23, 2004 Updated:January 5, 2005
Description: debmake contains a script that can make insecure temporary directories. This can be used by a symlink attack to create and overwrite arbitrary files.
Alerts:
Ubuntu USN-49-1 2004-12-23

Comments (none posted)

htmlheadline: insecure temporary files

Package(s):htmlheadline CVE #(s):CAN-2004-1181
Created:January 3, 2005 Updated:January 5, 2005
Description: Javier Fernández-Sanguino Peña has discovered multiple insecure uses of temporary files that could lead to overwriting arbitrary files via a symlink attack.
Alerts:
Debian DSA-622-1 2005-01-03

Comments (none posted)

kdelibs: unwanted email origination

Package(s):kdelibs CVE #(s):
Created:January 5, 2005 Updated:January 5, 2005
Description: The Konqueror browser (via kdelibs) contains a vulnerability which can cause it to send email without the user's interaction or consent. See this bug report for details.
Alerts:
Mandrake MDKSA-2004:160 2004-12-29

Comments (none posted)

kernel: 32bit emulation privilege escalation

Package(s):kernel CVE #(s):CAN-2004-1144
Created:December 23, 2004 Updated:January 5, 2005
Description: The 2.4 Linux Kernel on the AMD64 platform has a missing argument checking vulnerability that can allow a local attacker to gain root privileges.
Alerts:
Red Hat RHSA-2004:689-01 2004-12-23
SuSE SUSE-SA:2004:046 2004-12-22

Comments (none posted)

LinPopUp: buffer overflow in message reply

Package(s):linpopup CVE #(s):CAN-2004-1282
Created:January 4, 2005 Updated:January 10, 2005
Description: Stephen Dranger discovered that LinPopUp contains a buffer overflow in string.c, triggered when replying to a remote user message. A remote attacker could craft a malicious message that, when replied to using LinPopUp, would exploit the buffer overflow. This would result in the execution of arbitrary code with the privileges of the user running LinPopUp.
Alerts:
Debian DSA-632-1 2005-01-10
Gentoo 200501-01 2005-01-04

Comments (none posted)

netkit-telnet-ssl: format string vulnerability

Package(s):netkit-telnet-ssl CVE #(s):CAN-2004-0998
Created:December 23, 2004 Updated:January 5, 2005
Description: telnetd-ssl has a format string vulnerability that may be exploitable for executing arbitrary code.
Alerts:
Debian DSA-616-1 2004-12-23

Comments (none posted)

pcal: buffer overflows

Package(s):pcal CVE #(s):CAN-2004-1289
Created:January 5, 2005 Updated:January 5, 2005
Description: Two buffer overflows have been found in the pcal utility; they could be exploited by a hostile calendar file to execute arbitrary code.
Alerts:
Debian DSA-625-1 2004-01-05

Comments (none posted)

PHProjekt: PHP code execution

Package(s):phprojekt CVE #(s):
Created:January 5, 2005 Updated:January 5, 2005
Description: PHProject, prior to version 4.2-r2, has a vulnerability wherein a remote attacker can define a global variable and execute arbitrary PHP code.
Alerts:
Gentoo 200412-27 2004-12-30

Comments (none posted)

shoutcast server: buffer overflow

Package(s):shoutcast-server CVE #(s):
Created:January 5, 2005 Updated:January 5, 2005
Description: The shoutcast server contains a remotely exploitable buffer overflow vulnerability; upgrading to version 1.9.5 fixes the problem.
Alerts:
Gentoo 200501-04 2005-01-05

Comments (none posted)

tetex: insecure temp files

Package(s):tetex CVE #(s):
Created:December 23, 2004 Updated:January 5, 2005
Description: The xdvizilla script can create insecure temporary files and directories, allowing a symbolic link attack that can overwrite arbitrary files.
Alerts:
Ubuntu USN-51-1 2004-12-23

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2004-1125
Created:December 23, 2004 Updated:April 1, 2005
Description: xpdf has a potential buffer overflow problem caused by insufficient input validation. A specially crafted PDF file can allow an attacker to execute code with privileges of the xpdf user.
Alerts:
Red Hat RHSA-2005:354-01 2005-04-01
Red Hat RHSA-2005:018-01 2005-01-12
Gentoo 200501-17 2005-01-11
Gentoo 200501-13 2005-01-10
Fedora FEDORA-2004-585 2005-01-03
Fedora FEDORA-2004-584 2005-01-03
Debian DSA-621-1 2004-12-31
Mandrake MDKSA-2004:166 2004-12-29
Mandrake MDKSA-2004:165 2004-12-29
Mandrake MDKSA-2004:162 2004-12-29
Mandrake MDKSA-2004:164 2004-12-29
Mandrake MDKSA-2004:163 2004-12-29
Mandrake MDKSA-2004:161 2004-12-29
Debian DSA-619-1 2004-12-30
Gentoo 200412-25 2004-12-28
Gentoo 200412-24 2004-12-28
Fedora FEDORA-2004-575 2004-12-22
Fedora FEDORA-2004-574 2004-12-22
Fedora FEDORA-2004-573 2004-12-22
Fedora FEDORA-2004-572 2004-12-22
Ubuntu USN-50-1 2004-12-23
Ubuntu USN-48-1 2004-12-23

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):a2ps CVE #(s):CAN-2004-1170 CAN-2004-1377
Created:November 26, 2004 Updated:December 19, 2005
Description: The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:
Fedora-Legacy FLSA:152870 2005-12-17
Mandriva MDKSA-2005:097 2005-06-07
OpenPKG OpenPKG-SA-2005.003 2005-01-17
Gentoo 200501-02 2005-01-04
Debian DSA-612-1 2004-12-20
Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

cdrecord: failure to drop privilege

Package(s):cdrecord CVE #(s):CAN-2004-0806
Created:September 8, 2004 Updated:February 21, 2005
Description: The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program.
Alerts:
Fedora-Legacy FLSA:2058 2005-02-20
Gentoo 200409-18 2004-09-14
Fedora FEDORA-2004-298 2004-09-09
Fedora FEDORA-2004-297 2004-09-09
Mandrake MDKSA-2004:091 2004-09-07

Comments (none posted)

cups: multiple vulnerabilities

Package(s):cups CVE #(s):CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270
Created:December 17, 2004 Updated:February 9, 2005
Description: cups has a denial of service vulnerability in the lppasswd utility and a remote code execution vulnerability in the hpgltops filter.
Alerts:
SuSE SUSE-SR:2005:003 2005-02-04
Mandrake MDKSA-2005:008 2005-01-17
Gentoo 200412-25:02 2004-12-28
Red Hat RHSA-2005:013-01 2005-01-12
Gentoo 200412-25 2004-12-28
Fedora FEDORA-2004-559 2004-12-17
Fedora FEDORA-2004-560 2004-12-17

Comments (none posted)

cyrus-sasl: remote buffer overflow

Package(s):cyrus-sasl CVE #(s):CAN-2004-0884
Created:October 7, 2004 Updated:March 16, 2005
Description: cyrus-sasl has a vulnerability involving a buffer overflow in the digestmda5.c file. A remote attacker may be able to compromise the system. Also, a local user may be able to exploit a vulnerability by using the SASL_PATH environment variable.
Alerts:
Mandrake MDKSA-2005:054 2005-03-15
SuSE SUSE-SA:2005:013 2005-03-03
Fedora-Legacy FLSA:2137 2005-02-17
OpenPKG OpenPKG-SA-2005.004 2005-01-28
Conectiva CLA-2004:889 2004-11-11
Debian DSA-568-1 2004-10-16
Debian DSA-563-3 2004-10-14
Debian DSA-563-2 2004-10-12
Debian DSA-563-1 2004-10-12
Trustix TSLSA-2004-0053 2004-10-08
Mandrake MDKSA-2004:106 2004-10-07
Red Hat RHSA-2004:546-02 2004-10-07
Gentoo 200410-05 2004-10-07

Comments (none posted)

dhcp: format string vulnerability

Package(s):dhcp CVE #(s):CAN-2004-1006
Created:November 4, 2004 Updated:July 13, 2005
Description: Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:
Fedora-Legacy FLSA:152835 2005-07-10
Red Hat RHSA-2005:212-01 2005-04-12
Debian DSA-584-1 2004-11-04

Comments (none posted)

ethereal: multiple vulnerabilities

Package(s):ethereal CVE #(s):CAN-2004-1139 CAN-2004-1140 CAN-2004-1141 CAN-2004-1142
Created:December 20, 2004 Updated:January 13, 2005
Description: There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.8, including:
  • Bug in DICOM dissection discovered by Bing could make Ethereal crash (CAN-2004-1139).
  • An invalid RTP timestamp could make Ethereal hang and create a large temporary file (CAN-2004-1140).
  • The HTTP dissector could access previously-freed memory (CAN-2004-1141).
  • Brian Caswell discovered that an improperly formatted SMB could make Ethereal hang (CAN-2004-1142).
Alerts:
Conectiva CLA-2005:916 2005-01-13
Debian DSA-613-1 2004-12-21
Mandrake MDKSA-2004:152 2004-12-20
Gentoo 200412-15 2004-12-19

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):fam CVE #(s):CAN-2002-0875
Created:August 19, 2002 Updated:January 5, 2005
Description: "fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:
Red Hat RHSA-2005:005-01 2005-01-05
Debian DSA-154-1 2002-08-15

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):foomatic CVE #(s):CAN-2004-0801
Created:September 20, 2004 Updated:May 31, 2006
Description: There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:
SuSE SUSE-SA:2006:026 2006-05-30
Fedora-Legacy FLSA:2076 2004-11-05
Conectiva CLA-2004:880 2004-10-27
Fedora FEDORA-2004-303 2004-09-21
Gentoo 200409-24 2004-09-20

Comments (none posted)

FreeRADIUS: denial of service

Package(s):freeradius CVE #(s):CAN-2004-0938 CAN-2004-0960 CAN-2004-0961
Created:September 22, 2004 Updated:February 2, 2005
Description: FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code.
Alerts:
Fedora-Legacy FLSA:2187 2005-02-01
Red Hat RHSA-2004:609-01 2004-11-12
Gentoo 200409-29 2004-09-22

Comments (none posted)

gaim: buffer overflow in MSN protocol

Package(s):gaim CVE #(s):CAN-2004-0891
Created:October 25, 2004 Updated:February 11, 2005
Description: A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.
Alerts:
Fedora-Legacy FLSA:2188 2005-02-10
Red Hat RHSA-2004:604-01 2004-10-20
Mandrake MDKSA-2004:117 2004-11-01
Ubuntu USN-8-1 2004-10-27
Gentoo 200410-23 2004-10-24
Slackware SSA:2004-296-01 2004-10-25

Comments (none posted)

Gallery: cross-site scripting vulnerability

Package(s):Gallery CVE #(s):CAN-2004-1106
Created:November 8, 2004 Updated:January 17, 2005
Description: Jim Paris has discovered a cross-site scripting vulnerability in Gallery. By sending a carefully crafted URL, an attacker can inject and execute script code in the victim's browser window, and potentially compromise the users gallery.
Alerts:
Debian DSA-642-1 2005-01-17
Gentoo 200411-10:01 2004-11-06

Comments (none posted)

gtk2, gdk-pixbuf: buffer overflows

Package(s):gdk-pixbuf gtk2 CVE #(s):CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788
Created:September 15, 2004 Updated:February 25, 2005
Description: The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Alerts:
Fedora-Legacy FLSA:2005 2005-02-23
Conectiva CLA-2004:875 2004-10-18
Slackware SSA:2004-266-02 2004-09-22
Gentoo 200409-28 2004-09-21
Mandrake MDKSA-2004:095-1 2004-09-17
SuSE SUSE-SA:2004:033 2004-09-17
Debian DSA-549-1 2004-09-17
Red Hat RHSA-2004:447-02 2004-09-15
Debian DSA-546-1 2004-09-16
Red Hat RHSA-2004:466-01 2004-09-15
Red Hat RHSA-2004:447-01 2004-09-15
Mandrake MDKSA-2004:095 2004-09-15
Fedora FEDORA-2004-289 2004-09-15
Fedora FEDORA-2004-288 2004-09-15
Fedora FEDORA-2004-287 2004-09-15
Fedora FEDORA-2004-286 2004-09-15

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):gettext CVE #(s):CAN-2004-0966
Created:October 11, 2004 Updated:March 1, 2006
Description: gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:
Mandriva MDKSA-2006:051 2006-02-28
Fedora-Legacy FLSA:136323 2006-01-09
Gentoo 200410-10:02 2004-10-10
OpenPKG OpenPKG-SA-2004.055 2004-12-23
Ubuntu USN-5-1 2004-10-27
Gentoo 200410-10 2004-10-10

Comments (1 posted)

ghostscript: symlink vulnerabilities

Package(s):ghostscript CVE #(s):CAN-2004-0967
Created:October 20, 2004 Updated:September 28, 2005
Description: The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:
Red Hat RHSA-2005:081-01 2005-09-28
Ubuntu USN-3-1 2004-10-27
Gentoo 200410-18 2004-10-20

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):glibc CVE #(s):CAN-2004-1453
Created:August 17, 2004 Updated:May 26, 2005
Description: Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:
Red Hat RHSA-2005:256-01 2005-05-18
Gentoo 200408-16 2004-08-16

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):glibc CVE #(s):CAN-2004-0968
Created:October 21, 2004 Updated:November 14, 2005
Description: The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:
Fedora-Legacy FLSA:152848 2005-11-13
Red Hat RHSA-2005:261-01 2005-04-28
Debian DSA-636-1 2005-01-12
Mandrake MDKSA-2004:159 2004-12-29
Red Hat RHSA-2004:586-01 2004-12-20
Fedora FEDORA-2004-356 2004-11-11
Ubuntu USN-4-1 2004-10-27
Gentoo 200410-19 2004-10-21

Comments (none posted)

gnome-vfs: backend script vulnerabilities

Package(s):gnome-vfs CVE #(s):CAN-2004-0494
Created:August 4, 2004 Updated:February 21, 2005
Description: Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:
Fedora-Legacy FLSA:1944 2005-02-20
Whitebox WBSA-2004:373-01 2004-08-19
Red Hat RHSA-2004:373-01 2004-08-04

Comments (none posted)

groff: insecure temp file

Package(s):groff CVE #(s):CAN-2004-1296
Created:December 20, 2004 Updated:January 17, 2005
Description: Javier Fernández-Sanguino Peña discovered that the auxiliary scripts "eqn2graph" and "pic2graph" created temporary files in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Ubuntu USN-43-1 2004-12-20

Comments (1 posted)

groff: insecure temporary directory

Package(s):groff CVE #(s):CAN-2004-0969
Created:November 1, 2004 Updated:February 9, 2006
Description: Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Mandriva MDKSA-2006:038 2006-02-08
Gentoo 200411-15 2004-11-08
Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):gtkhtml CVE #(s):CAN-2003-0133 CAN-2003-0541
Created:April 14, 2003 Updated:April 18, 2005
Description: GtkHTML is the HTML rendering widget used by the Evolution mail reader.

GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.

Alerts:
Debian DSA-710-1 2005-04-18
Mandrake MDKSA-2003:093 2003-09-18
Conectiva CLA-2003:737 2003-09-12
Red Hat RHSA-2003:264-01 2003-09-09
Mandrake MDKSA-2003:046 2003-04-15
Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

imlib: buffer overflows in image decoding

Package(s):imlib CVE #(s):CAN-2004-1026
Created:December 6, 2004 Updated:January 13, 2005
Description: Pavel Kankovsky discovered that several overflows found in the libXpm library also applied to imlib. He also fixed a number of other potential flaws. A remote attacker could entice a user to view a carefully-crafted image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the imlib library.
Alerts:
Mandrake MDKSA-2005:007 2005-01-12
Gentoo 200501-19 2005-01-11
Ubuntu USN-55-1 2005-01-06
Debian DSA-628-1 2005-01-06
Ubuntu USN-53-1 2004-12-29
Debian DSA-618-1 2004-12-24
Red Hat RHSA-2004:651-01 2004-12-10
Gentoo 200412-03 2004-12-06

Comments (none posted)

imlib2: buffer overflows

Package(s):imlib2 CVE #(s):CAN-2004-0802 CAN-2004-0817
Created:September 8, 2004 Updated:October 26, 2005
Description: The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:
Debian DSA-548-2 2005-10-26
Conectiva CLA-2004:870 2004-09-28
Debian DSA-552-1 2004-09-22
Debian DSA-548-1 2004-09-16
Red Hat RHSA-2004:465-01 2004-09-15
Gentoo 200409-12 2004-09-08
Fedora FEDORA-2004-301 2004-09-09
Fedora FEDORA-2004-300 2004-09-09
Mandrake MDKSA-2004:089 2004-09-07

Comments (none posted)

iptables: missing initialization

Package(s):iptables CVE #(s):CAN-2004-0986
Created:November 1, 2004 Updated:February 11, 2005
Description: Faheem Mitha noticed that the iptables command, an administration tool for IPv4 packet filtering and NAT, did not always load the required modules on its own as it was supposed to. This could lead to firewall rules not being loaded on system startup. This caused a failure in connection with rules provided by lokkit at least.
Alerts:
Fedora-Legacy FLSA:2252 2005-02-10
Ubuntu USN-81-1 2005-02-11
Mandrake MDKSA-2004:125 2004-11-04
Debian DSA-580-1 2004-11-01

Comments (none posted)

kerberos5: execution of arbitrary code by authenticated user

Package(s):kerberos5 CVE #(s):CAN-2004-1189
Created:December 21, 2004 Updated:February 15, 2005
Description: There is a buffer overflow in the password history handling code of libkadm5srv which could be exploited by an authenticated user to execute arbitrary code on a Key Distribution Center (KDC) server.
Alerts:
Red Hat RHSA-2005:045-01 2005-02-15
Red Hat RHSA-2005:012-01 2005-01-19
Conectiva CLA-2005:917 2005-01-13
Ubuntu USN-58-1 2005-01-10
Debian DSA-629-1 2005-01-07
Gentoo 200501-05 2005-01-05
Mandrake MDKSA-2004:156 2004-12-22
Fedora FEDORA-2004-564 2004-12-21
Fedora FEDORA-2004-563 2004-12-21
Trustix TSLSA-2004-0069 2004-12-21

Comments (none posted)

kernel: IGMP and scm_send vulnerabilities

Package(s):kernel CVE #(s):CAN-2004-1016 CAN-2004-1137
Created:December 14, 2004 Updated:January 4, 2005
Description: Paul Starzetz has discovered a new pair of kernel vulnerabilities. The IGMP code suffers from input validation and integer overflow vulnerabilities which could be remotely exploitable, and the socket function __scm_send() has a local denial of service vulnerability.
Alerts:
Fedora FEDORA-2004-582 2005-01-03
Fedora FEDORA-2004-581 2005-01-03
Ubuntu USN-47-1 2004-12-23
SuSE SUSE-SA:2004:044 2004-12-21
Trustix TSLSA-2004-0068 2004-01-19
Ubuntu USN-38-1 2004-12-14

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):kernel-utils CVE #(s):CAN-2003-0019
Created:February 7, 2003 Updated:January 21, 2005
Description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.

Alternatively, as a work-around to this vulnerability issue the following command as root:

chmod -s /usr/bin/uml_net

Alerts:
Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):libgd2 CVE #(s):CAN-2004-0990 CAN-2004-0941
Created:October 29, 2004 Updated:June 28, 2006
Description: Several buffer overflows have been discovered in libgd's PNG handling functions.
If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:
Mandriva MDKSA-2006:114 2006-06-27
Red Hat RHSA-2006:0194-01 2006-02-01
Fedora-Legacy FLSA:152838 2005-07-15
Red Hat RHSA-2004:638-01 2004-12-17
Ubuntu USN-33-1 2004-11-29
Debian DSA-602-1 2004-11-29
Debian DSA-601-1 2004-11-29
Mandrake MDKSA-2004:132 2004-11-15
Ubuntu USN-25-1 2004-11-15
Fedora FEDORA-2004-412 2004-11-11
Fedora FEDORA-2004-411 2004-11-11
Ubuntu USN-21-1 2004-11-09
Debian DSA-591-1 2004-11-09
Debian DSA-589-1 2004-11-09
Gentoo 200411-08 2004-11-03
OpenPKG OpenPKG-SA-2004.049 2004-10-30
Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):libpng CVE #(s):CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:August 4, 2004 Updated:February 10, 2005
Description: There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:
Fedora-Legacy FLSA:1943 2005-02-08
Red Hat RHSA-2004:421-01 2004-08-04
Gentoo 200408-22 2004-08-23
Whitebox WBSA-2004:402-01 2004-08-19
Mandrake MDKSA-2004:082 2004-08-12
Slackware SSA:2004-223-01 2004-08-09
Slackware SSA:2004-223-02 2004-08-07
Slackware SSA:2004-222-01b 2004-08-10
Slackware SSA:2004-222-01 2004-08-07
Conectiva CLA-2004:856 2004-08-06
Trustix TSLSA-2004-0040 2004-08-05
Gentoo 200408-03 2004-08-05
Debian DSA-536-1 2004-08-04
Mandrake MDKSA-2004:079 2004-08-04
SuSE SUSE-SA:2004:023 2004-08-04
Red Hat RHSA-2004:402-01 2004-08-04
OpenPKG OpenPKG-SA-2004.035 2004-08-04

Comments (1 posted)

libtiff: buffer overflow

Package(s):libtiff CVE #(s):CAN-2004-1308
Created:December 22, 2004 Updated:May 19, 2005
Description: The libtiff image manipulation library contains several exploitable buffer overflows.
Alerts:
Fedora-Legacy FLSA:152815 2005-05-18
Red Hat RHSA-2005:035-01 2005-02-15
Conectiva CLA-2005:920 2005-01-20
Red Hat RHSA-2005:019-01 2005-01-13
SuSE SUSE-SA:2005:001 2005-01-10
Fedora FEDORA-2005-598 2005-01-07
Fedora FEDORA-2005-597 2005-01-07
Ubuntu USN-54-1 2005-01-06
Mandrake MDKSA-2005:002 2005-01-06
Mandrake MDKSA-2005:001 2005-01-06
Gentoo 200501-06 2005-01-05
Debian DSA-626-1 2005-01-06
Debian DSA-617-1 2004-12-24
Fedora FEDORA-2004-577 2004-12-22
Fedora FEDORA-2004-576 2004-12-22
Ubuntu USN-46-1 2004-12-22

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libxpm4: stack and integer overflows

Package(s):libxpm4 CVE #(s):CAN-2004-0687 CAN-2004-0688
Created:September 16, 2004 Updated:February 14, 2005
Description: There are several stack and integer overflow bugs in the libXpm code of XFree86 that may be used for a denial of service.
Alerts:
Conectiva CLA-2005:924 2005-02-14
Red Hat RHSA-2005:004-01 2005-01-12
Red Hat RHSA-2004:537-01 2004-12-02
Ubuntu USN-27-1 2004-11-17
Mandrake MDKSA-2004:124 2004-11-04
Debian DSA-561-1 2004-10-11
Gentoo 200410-09 2004-10-09
Debian DSA-560-1 2004-10-07
Red Hat RHSA-2004:479-01 2004-10-06
Red Hat RHSA-2004:478-01 2004-10-04
Gentoo 200409-34 2004-09-27
SuSE SUSE-SA:2004:034 2004-09-17
Mandrake MDKSA-2004:099 2004-09-15
Mandrake MDKSA-2004:098 2004-09-15

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):lvm10 CVE #(s):CAN-2004-0972
Created:November 1, 2004 Updated:July 25, 2005
Description: Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:
Fedora-Legacy FLSA:152842 2005-07-24
Mandrake MDKSA-2004:144 2004-12-06
Gentoo 200411-22 2004-11-11
Debian DSA-583-1 2004-11-03
Ubuntu USN-15-1 2004-11-01

Comments (none posted)

Midnight Commander: extfs vfs vulnerability

Package(s):mc CVE #(s):CAN-2004-0494
Created:September 2, 2004 Updated:January 5, 2005
Description: Midnight Commander has a vfs vulnerability with shell quoting in extfs perl scripts.
Alerts:
Red Hat RHSA-2004:464-02 2005-01-05
Red Hat RHSA-2004:464-01 2004-09-15
Fedora FEDORA-2004-273 2004-09-01
Fedora FEDORA-2004-272 2004-09-01

Comments (none posted)

mikmod: buffer overflow

Package(s):mikmod CVE #(s):CAN-2003-0427
Created:June 16, 2003 Updated:June 16, 2005
Description: Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:
Fedora FEDORA-2005-405 2005-06-16
Red Hat RHSA-2005:506-01 2005-06-13
Fedora FEDORA-2005-404 2005-06-09
Gentoo 200307-01 2003-07-02
Debian DSA-320-1 2003-06-13

Comments (none posted)

mozilla products: arbitrary code execution and other vulnerabilities

Package(s):mozilla firefox thunderbird CVE #(s):CAN-2004-0902 CAN-2004-0903 CAN-2004-0904 CAN-2004-0905 CAN-2004-0908
Created:September 20, 2004 Updated:January 13, 2005
Description: Several vulnerabilities exist in the Mozilla web browser and derived products, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system. See the CERT advisory for details.
Alerts:
Gentoo 200501-03 2005-01-05
Fedora-Legacy FLSA:2089 2004-10-27
Conectiva CLA-2004:877 2004-10-22
Mandrake MDKSA-2004:107 2004-10-19
SuSE SUSE-SA:2004:036 2004-10-06
Red Hat RHSA-2004:486-01 2004-09-30
Slackware SSA:2004-266-03 2004-09-22
Gentoo 200409-26 2004-09-20

Comments (none posted)

mpg123: buffer overflow bug

Package(s):mpg123 CVE #(s):CAN-2004-0805
Created:September 16, 2004 Updated:January 11, 2005
Description: The mpg123 audio playing utility has a buffer overflow bug that may allow arbitrary execution of code.
Alerts:
Gentoo 200501-14 2005-01-10
Debian DSA-564-1 2004-10-13
Mandrake MDKSA-2004:100 2004-09-22
Gentoo 200409-20 2004-09-16

Comments (none posted)

mpg321: format string vulnerability

Package(s):mpg321 CVE #(s):CAN-2003-0969
Created:January 6, 2004 Updated:March 28, 2005
Description: A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:
Gentoo 200503-34 2005-03-28
Debian DSA-411-1 2004-01-05

Comments (none posted)

MPlayer: multiple overflows

Package(s):mplayer CVE #(s):
Created:December 20, 2004 Updated:January 5, 2005
Description: iDEFENSE, Ariel Berkman and the MPlayer development team found multiple vulnerabilities in MPlayer, potentially resulting in remote executing of arbitrary code. See iDEFENSE reports: MPlayer Bitmap Parsing Remote Heap Overflow Vulnerability, MPlayer MMST Streaming Stack Overflow Vulnerability and MPlayer Remote RTSP Heap Overflow Vulnerability.
Alerts:
Conectiva CLA-2005:910 2005-01-05
Mandrake MDKSA-2004:157 2004-12-22
Gentoo 200412-21 2004-12-20

Comments (none posted)

mysql: several vulnerabilities

Package(s):mysql CVE #(s):CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
Created:October 11, 2004 Updated:April 6, 2005
Description: Several problems have been discovered in MySQL. Oleksandr Byelkin noticed that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis noticed that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall. (CAN-2004-0837)
Alerts:
Ubuntu USN-109-1 2005-04-06
Fedora FEDORA-2004-530 2004-12-08
Ubuntu USN-32-1 2004-11-25
Conectiva CLA-2004:892 2004-11-18
Mandrake MDKSA-2004:119 2004-11-01
OpenPKG OpenPKG-SA-2004.045 2004-10-30
Red Hat RHSA-2004:611-01 2004-10-27
Gentoo 200410-22 2004-10-24
Red Hat RHSA-2004:569-01 2004-10-20
Red Hat RHSA-2004:597-01 2004-10-20
Debian DSA-562-1 2004-10-11

Comments (none posted)

nasm: Buffer overflow vulnerability

Package(s):nasm CVE #(s):CAN-2004-1287
Created:December 20, 2004 Updated:May 4, 2005
Description: Jonathan Rockway discovered that NASM-0.98.38 has an unprotected vsprintf() to an array in preproc.c. This code vulnerability may lead to a buffer overflow and potential execution of arbitrary code.
Alerts:
Red Hat RHSA-2005:381-01 2005-05-04
Fedora FEDORA-2005-322 2005-04-18
Mandrake MDKSA-2005:004 2005-01-06
Debian DSA-623-1 2004-01-04
Ubuntu USN-45-1 2004-12-22
Gentoo 200412-20 2004-12-20

Comments (4 posted)

netkit-telnet: invalid free pointer

Package(s):netkit-telnet CVE #(s):CAN-2004-0911
Created:October 4, 2004 Updated:March 28, 2005
Description: Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service (inetd will disable the service if telnetd is crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user).
Alerts:
Ubuntu USN-101-1 2005-03-28
Debian DSA-556-2 2004-10-18
Debian DSA-569-1 2004-10-18
Debian DSA-556-1 2004-10-02

Comments (none posted)

netpbm: insecure temporary files

Package(s):netpbm CVE #(s):CAN-2003-0924
Created:January 19, 2004 Updated:December 29, 2004
Description: netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:
Conectiva CLA-2004:909 2004-12-29
Gentoo 200410-02 2004-10-04
Mandrake MDKSA-2004:011-1 2004-09-27
Whitebox WBSA-2004:031-01 2004-02-12
Mandrake MDKSA-2004:011 2004-02-11
Red Hat RHSA-2004:030-01 2004-02-05
Fedora FEDORA-2004-068 2004-02-06
Red Hat RHSA-2004:031-01 2004-01-22
Debian DSA-426-1 2004-01-18

Comments (1 posted)

nfs-utils: denial of service

Package(s):nfs-utils CVE #(s):CAN-2004-1014
Created:December 1, 2004 Updated:May 15, 2005
Description: The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker.
Alerts:
Fedora-Legacy FLSA:152871 2005-05-12
Red Hat RHSA-2004:583-01 2004-12-20
Gentoo 200412-08 2004-12-14
Trustix TSLSA-2004-0065 2004-01-09
Debian DSA-606-1 2004-12-08
Mandrake MDKSA-2004:146 2004-12-06
Ubuntu USN-36-1 2004-12-01

Comments (none posted)

openssl: der_chop script temp file vulnerability

Package(s):openssl CVE #(s):CAN-2004-0975
Created:November 11, 2004 Updated:July 19, 2005
Description: The der_chop script in openssl has a temp file vulnerability that may allow an attacker to overwrite arbitrary files with the permissions that the script is running under.
Alerts:
Fedora-Legacy FLSA:152841 2005-07-15
Mandrake MDKSA-2004:147 2004-12-06
Debian DSA-603-1 2004-12-01
Ubuntu USN-24-1 2004-11-11

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):OpenSSL CVE #(s):CAN-2004-0081 CAN-2003-0851
Created:March 17, 2004 Updated:November 2, 2005
Description: Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:
Red Hat RHSA-2005:830-00 2005-11-02
Red Hat RHSA-2005:829-00 2005-11-02
Fedora FEDORA-2005-1042 2005-10-31
Fedora-Legacy FLSA:1395 2004-05-08
Conectiva CLA-2004:834 2004-03-31
Whitebox WBSA-2004:084-01 2004-03-23
Red Hat RHSA-2004:084-01 2004-03-23
Fedora FEDORA-2004-095 2004-03-19
Whitebox WBSA-2004:120-01 2004-03-22
Trustix TSLSA-2004-0012 2004-03-17
Slackware SSA:2004-077-01 2004-03-17
Red Hat RHSA-2004:121-01 2004-03-17
OpenPKG OpenPKG-SA-2004.007 2004-03-18
Gentoo 200403-03 2004-03-17
Debian DSA-465-1 2004-03-17
Netwosix NW-2004-0005 2004-03-17
Mandrake MDKSA-2004:023 2004-03-17
SuSE SuSE-SA:2004:007 2004-03-17
Red Hat RHSA-2004:120-01 2004-03-17
Red Hat RHSA-2004:119-01 2004-03-17
EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl information leak

Package(s):perl CVE #(s):CAN-2004-0452
Created:December 21, 2004 Updated:January 11, 2005
Description: A race condition and possible information leak has been discovered in Perl's File::Path::rmtree(). This function changes the permission of files and directories before removing them to avoid problems with wrong permissions. However, they were made readable and writable not only for the owner, but for the entire world, which opened a race condition and a possible information leak (if the actual removal of a file/directory failed for some reason).
Alerts:
OpenPKG OpenPKG-SA-2005.001 2005-01-11
Debian DSA-620-1 2004-12-30
Ubuntu USN-44-1 2004-12-21

Comments (none posted)

php: remotely exploitable memory errors

Package(s):php CVE #(s):CAN-2004-0594
Created:July 14, 2004 Updated:February 7, 2005
Description: Stefan Esser has issued an advisory regarding a remotely exploitable hole in PHP (through version 4.3.7). If the memory_limit feature is in use (as it should be, to prevent denial of service attacks), allocation failures can be forced at highly inopportune times, and those failures can be exploited to execute arbitrary code. The exploit is described as "quite easy," and it can be done regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the problem; yesterday's PHP 5.0 release also contains the fix (but the final release candidate did not).
Alerts:
Debian DSA-669-1 2005-02-07
Whitebox WBSA-2004:392-01 2004-08-19
Fedora FEDORA-2004-223 2004-07-23
Fedora FEDORA-2004-222 2004-07-23
OpenPKG OpenPKG-SA-2004.034 2004-07-22
Slackware SSA:2004-202-01 2004-07-20
Debian DSA-531-1 2004-07-20
Red Hat RHSA-2004:392-01 2004-07-19
Red Hat RHSA-2004:395-01 2004-07-19
Conectiva CLA-2004:847 2004-07-16
SuSE SUSE-SA:2004:021 2004-07-16
Mandrake MDKSA-2004:068 2004-07-14
Gentoo 200407-13 2004-07-15
tinysofa TSSA-2004-013 2004-07-14

Comments (none posted)

php: multiple vulnerabilities

Package(s):php CVE #(s):CAN-2004-1018 CAN-2004-1019 CAN-2004-1020 CAN-2004-1063 CAN-2004-1064 CAN-2004-1065
Created:December 16, 2004 Updated:March 24, 2005
Description: PHP has an out of bounds memory write access vulnerability and an integer overflow/underflow problem. See the PHP 4.3.10 Release Announcement for details.
Alerts:
Ubuntu USN-99-2 2005-03-24
Ubuntu USN-99-1 2005-03-18
Fedora-Legacy FLSA:2344 2005-03-07
Red Hat RHSA-2005:032-01 2005-02-15
Red Hat RHSA-2005:031-01 2005-01-19
SuSE SUSE-SA:2005:002 2005-01-17
Conectiva CLA-2005:915 2005-01-13
Fedora FEDORA-2004-567 2004-12-21
Fedora FEDORA-2004-568 2004-12-21
Red Hat RHSA-2004:687-01 2004-12-21
Trustix TSLSA-2004-0066 2004-12-17
Gentoo 200412-14 2004-12-19
Mandrake MDKSA-2004:151 2004-12-17
Ubuntu USN-40-1 2004-12-16
OpenPKG OpenPKG-SA-2004.053 2004-12-16

Comments (1 posted)

ProZilla: Multiple vulnerabilities

Package(s):ProZilla CVE #(s):CAN-2004-1120
Created:November 23, 2004 Updated:February 1, 2005
Description: ProZilla contains several exploitable buffer overflows in the code handling the network protocols. A remote attacker could setup a malicious server and entice a user to retrieve files from that server using ProZilla. This could lead to the execution of arbitrary code with the rights of the user running ProZilla.
Alerts:
Debian DSA-663-1 2005-02-01
Gentoo 200411-31 2004-11-23

Comments (none posted)

qt3: BMP image parser heap overflow

Package(s):qt3/qt3-non-mt/qt3-32bit/qt3-static CVE #(s):CAN-2004-0691 CAN-2004-0692 CAN-2004-0693
Created:August 19, 2004 Updated:May 15, 2005
Description: A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution.
Alerts:
Fedora-Legacy FLSA:152763 2005-05-12
Conectiva CLA-2004:866 2004-09-22
Whitebox WBSA-2004:414-01 2004-09-20
Debian DSA-542-1 2004-08-30
Fedora FEDORA-2004-271 2004-08-23
Fedora FEDORA-2004-270 2004-08-23
Gentoo 200408-20 2004-08-22
Red Hat RHSA-2004:414-01 2004-08-20
Mandrake MDKSA-2004:085 2004-08-18
SuSE SUSE-SA:2004:027 2004-08-19

Comments (none posted)

rp-pppoe, pppoe: missing privilege dropping

Package(s):rp-pppoe, pppoe CVE #(s):CAN-2004-0564
Created:October 4, 2004 Updated:November 15, 2005
Description: Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver from Roaring Penguin. When the program is running setuid root (which is not the case in a default Debian installation), an attacker could overwrite any file on the file system.
Alerts:
Fedora-Legacy FLSA:152794 2005-11-14
Mandrake MDKSA-2004:145 2004-12-06
Debian DSA-557-1 2004-10-04

Comments (none posted)

ruby: infinite loop

Package(s):ruby CVE #(s):CAN-2004-0983
Created:November 8, 2004 Updated:May 15, 2005
Description: The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.
Alerts:
Fedora-Legacy FLSA:152768 2005-05-12
Red Hat RHSA-2004:635-01 2004-12-13
Gentoo 200411-23 2004-11-16
Fedora FEDORA-2004-403 2004-11-11
Fedora FEDORA-2004-402 2004-11-11
Ubuntu USN-20-1 2004-11-08
Mandrake MDKSA-2004:128 2004-11-08
Debian DSA-586-1 2004-11-08

Comments (none posted)

samba: integer overflow vulnerability

Package(s):samba CVE #(s):CAN-2004-1154
Created:December 16, 2004 Updated:July 19, 2005
Description: Samba has an integer overflow vulnerability that may allow an authenticated remote user to execute arbitrary code on the Samba server.
Alerts:
Fedora-Legacy FLSA:152874 2005-07-15
Debian DSA-701-2 2005-04-21
Debian DSA-701-1 2005-03-31
Conectiva CLA-2005:913 2005-01-06
Red Hat RHSA-2005:020-01 2005-01-05
Mandrake MDKSA-2004:158 2004-12-27
SuSE SUSE-SA:2004:045 2004-12-22
Red Hat RHSA-2004:681-01 2004-12-21
Fedora FEDORA-2004-562 2004-12-20
Fedora FEDORA-2004-561 2004-12-20
Gentoo 200412-13 2004-12-17
Ubuntu USN-41-1 2004-12-17
OpenPKG OpenPKG-SA-2004.054 2004-12-17
Red Hat RHSA-2004:670-01 2004-12-16

Comments (none posted)

sharutils: arbitrary code execution

Package(s):sharutils CVE #(s):CAN-2004-1772
Created:October 1, 2004 Updated:April 26, 2005
Description: sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c. An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.
Alerts:
Red Hat RHSA-2005:377-01 2005-04-26
Fedora FEDORA-2005-281 2005-04-01
Fedora FEDORA-2005-280 2005-04-01
Ubuntu USN-102-1 2005-03-29
Fedora-Legacy FLSA:2155 2005-03-24
Gentoo 200410-01 2004-10-01

Comments (none posted)

sox: buffer overflow

Package(s):sox CVE #(s):CAN-2004-0557
Created:July 28, 2004 Updated:February 21, 2005
Description: Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file.
Alerts:
Fedora-Legacy FLSA:1945 2005-02-20
Debian DSA-565-1 2004-10-13
Whitebox WBSA-2004:409-01 2004-08-19
Slackware SSA:2004-223-03 2004-08-07
Conectiva CLA-2004:855 2004-07-30
Gentoo 200407-23 2004-07-30
Mandrake MDKSA-2004:076 2004-07-28
Red Hat RHSA-2004:409-01 2004-07-29
Fedora FEDORA-2004-244 2004-07-28
Fedora FEDORA-2004-235 2004-07-28

Comments (none posted)

SpamAssassin: Denial of Service vulnerability

Package(s):spamassassin CVE #(s):CAN-2004-0796
Created:August 9, 2004 Updated:August 11, 2005
Description: SpamAssassin contains an unspecified Denial of Service vulnerability. By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin service.
Alerts:
Fedora-Legacy FLSA:129284 2005-08-10
Fedora-Legacy FLSA:2268 2005-03-24
Red Hat RHSA-2004:451-01 2004-09-30
Conectiva CLA-2004:867 2004-09-22
OpenPKG OpenPKG-SA-2004.041 2004-09-15
Mandrake MDKSA-2004:084 2004-08-18
Gentoo 200408-06 2004-08-09

Comments (none posted)

Subversion: Remote heap overflow

Package(s):subversion CVE #(s):CAN-2004-0413
Created:June 11, 2004 Updated:March 7, 2005
Description: Subversion has a remote Denial of Service vulnerability that may allow a server that runs svnserve to execute arbitrary code. See this advisory for more information.
Alerts:
Fedora-Legacy FLSA:1748 2005-03-07
SuSE SuSE-SA:2004:018 2004-06-17
Fedora FEDORA-2004-166 2004-06-11
Fedora FEDORA-2004-165 2004-06-11
OpenPKG OpenPKG-SA-2004.028 2004-06-11
Gentoo 200406-07 2004-06-10

Comments (none posted)

sudo: environment variable sanitizing

Package(s):sudo CVE #(s):CAN-2004-1051
Created:November 17, 2004 Updated:May 15, 2005
Description: Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information.
Alerts:
Fedora-Legacy FLSA:152856 2005-05-12
OpenPKG OpenPKG-SA-2005.002 2005-01-17
Debian DSA-596-2 2004-11-24
Debian DSA-596-1 2004-11-24
Ubuntu USN-28-1 2004-11-17
Mandrake MDKSA-2004:133 2004-11-15

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tiff: buffer overflows

Package(s):tiff CVE #(s):CAN-2004-0803
Created:October 13, 2004 Updated:April 12, 2005
Description: The tiff library contains several buffer overflows which may be exploited by way of maliciously-crafted image files. See this advisory for more information.
Alerts:
Red Hat RHSA-2005:021-01 2005-04-12
Conectiva CLA-2005:914 2005-01-06
Gentoo 200412-17 2004-12-19
Gentoo 200412-02 2004-12-05
Conectiva CLA-2004:888 2004-11-08
Slackware SSA:2004-305-02 2004-11-01
Red Hat RHSA-2004:577-01 2004-10-22
SuSE SUSE-SA:2004:038 2004-10-22
Mandrake MDKSA-2004:111 2004-10-21
Mandrake MDKSA-2004:109 2004-10-19
Debian DSA-567-1 2004-10-15
Fedora FEDORA-2004-334 2004-10-14
OpenPKG OpenPKG-SA-2004.043 2004-10-14
Gentoo 200410-11 2004-10-13

Comments (none posted)

unarj: buffer overflow vulnerability

Package(s):unarj CVE #(s):CAN-2004-0947
Created:November 11, 2004 Updated:February 2, 2005
Description: The unarj uncompression utility has a buffer overflow vulnerability from handling long file names in an archive. An attacker can cause unarj to crash or execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:2272 2005-02-01
Debian DSA-652-1 2005-01-21
Red Hat RHSA-2005:007-01 2005-01-12
Gentoo 200411-29 2004-11-19
Fedora FEDORA-2004-414 2004-11-11

Comments (none posted)

vim: modeline problems

Package(s):vim CVE #(s):CAN-2004-1138
Created:December 15, 2004 Updated:February 24, 2005
Description: A new set of modeline-related vulnerabilities has been discovered in versions of vim prior to 6.3-r2. These vulnerabilities could conceivably be exploited by a local user to obtain the privileges of another user.
Alerts:
Fedora-Legacy FLSA:2343 2005-02-23
Mandrake MDKSA-2005:003 2005-01-06
Ubuntu USN-52-1 2004-12-23
Red Hat RHSA-2005:010-01 2005-01-05
OpenPKG OpenPKG-SA-2004.052 2004-12-15
Gentoo 200412-10 2004-12-15

Comments (none posted)

wv: buffer overflow

Package(s):wv CVE #(s):CAN-2004-0645
Created:July 14, 2004 Updated:February 10, 2005
Description: wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem.
Alerts:
Fedora-Legacy FLSA:1906 2005-02-08
Conectiva CLA-2004:902 2004-12-01
Debian DSA-579-1 2004-11-01
Debian DSA-550-1 2004-09-20
Conectiva CLA-2004:863 2004-09-10
Mandrake MDKSA-2004:077 2004-07-29
Fedora FEDORA-2004-225 2004-07-23
Fedora FEDORA-2004-224 2004-07-23
Gentoo 200407-11 2004-07-14

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):xchat CVE #(s):CAN-2004-0409
Created:April 19, 2004 Updated:November 15, 2005
Description: XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:
Fedora-Legacy FLSA:123013 2005-11-14
Red Hat RHSA-2004:585-01 2004-10-27
Netwosix NW-2004-0014 2004-05-01
Red Hat RHSA-2004:177-01 2004-04-30
Mandrake MDKSA-2004:036 2004-04-21
Debian DSA-493-1 2004-04-21
Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-lib: arbitrary code execution

Package(s):xine-lib CVE #(s):CAN-2004-1187 CAN-2004-1188 CAN-2004-1300
Created:December 21, 2004 Updated:January 25, 2005
Description: Several buffer overflows have been discovered in xine-lib, the video/audio codec library for Xine frontends (xine-ui, totem-xine, kaffeine, and others). If an attacker tricked a user into loading a malicious RTSP stream or a stream with specially crafted AIFF audio or PNM image data, they could exploit this to execute arbitrary code with the privileges of the user opening the audio/video file. See this advisory for more information.
Alerts:
Mandrake MDKSA-2005:011 2005-01-19
Conectiva CLA-2005:919 2005-01-19
Gentoo 200501-07 2005-01-06
Ubuntu USN-42-1 2004-12-20

Comments (none posted)

xine-lib: buffer overflows

Package(s):xine-lib CVE #(s):CAN-2004-1379
Created:September 22, 2004 Updated:April 10, 2006
Description: xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:
Fedora-Legacy FLSA:152873 2006-04-04
Debian DSA-657-1 2005-01-25
Mandrake MDKSA-2004:105 2004-10-06
Slackware SSA:2004-266-04 2004-09-22
Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):xine-ui CVE #(s):CAN-2004-0372
Created:April 6, 2004 Updated:April 27, 2006
Description: Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:
Gentoo 200404-20 2004-04-27
Slackware SSA:2004-111-01 2004-04-20
Mandrake MDKSA-2004:033 2004-04-19
Debian DSA-477-1 2004-04-06

Comments (none posted)

xorg-x11: integer overflows

Package(s):xorg-x11 CVE #(s):CAN-2004-0914
Created:November 18, 2004 Updated:September 12, 2005
Description: The X.Org libXpm library has several integer overflow vulnerabilities An attacker can modify XPM images to execute malicious code.
Alerts:
Ubuntu USN-83-2 2005-09-12
Fedora-Legacy FLSA:152804 2005-05-12
Ubuntu USN-83-1 2005-02-16
Gentoo 200502-07 2005-02-07
Gentoo 200502-06 2005-02-06
Red Hat RHSA-2004:612-01 2004-12-20
Red Hat RHSA-2004:610-01 2004-12-20
Debian DSA-607-1 2004-12-10
Mandrake MDKSA-2004:137-1 2004-11-29
Mandrake MDKSA-2004:137 2004-11-22
Mandrake MDKSA-2004:138 2004-11-22
Gentoo 200411-28 2004-11-19
Fedora FEDORA-2004-434 2004-11-17
Fedora FEDORA-2004-433 2004-11-17
SuSE SUSE-SA:2004:041 2004-11-17

Comments (none posted)

xpdf: integer overflows

Package(s):xpdf kpdf cupsys CVE #(s):CAN-2004-0888 CAN-2004-0889
Created:October 21, 2004 Updated:February 18, 2005
Description: Several xpdf integer overflow vulnerabilities can be exploited via a mal-formed PDF document. Similar vulnerabilities can be found in kpdf and in cupsys which share code. Additional information can be found in this KDE security advisory.
Alerts:
Fedora FEDORA-2005-138 2005-02-09
Fedora FEDORA-2005-137 2005-02-09
Fedora FEDORA-2005-133 2005-02-09
Fedora FEDORA-2005-134 2005-02-09
Fedora FEDORA-2005-136 2005-02-09
Fedora FEDORA-2005-135 2005-02-09
Fedora FEDORA-2005-123 2005-02-08
Fedora FEDORA-2005-122 2005-02-08
Debian DSA-599-1 2004-11-25
Gentoo 200411-30 2004-11-23
Conectiva CLA-2004:886 2004-11-08
Gentoo 200410-30:02 2004-10-28
Gentoo 200410-20:02 2004-10-21
Debian DSA-581-1 2004-11-02
Ubuntu USN-14-1 2004-11-01
Ubuntu USN-9-1 2004-10-27
Gentoo 200410-30 2004-10-28
Fedora FEDORA-2004-358 2004-10-28
Fedora FEDORA-2004-357 2004-10-28
Red Hat RHSA-2004:592-01 2004-10-27
Fedora FEDORA-2004-337 2004-10-26
SuSE SUSE-SA:2004:039 2004-10-26
Ubuntu USN-2-1 2004-10-22
Red Hat RHSA-2004:543-01 2004-10-22
Mandrake MDKSA-2004:115 2004-10-21
Mandrake MDKSA-2004:116 2004-10-21
Mandrake MDKSA-2004:114 2004-10-21
Mandrake MDKSA-2004:113 2004-10-21
Gentoo 200410-20 2004-10-21
Fedora FEDORA-2004-348 2004-10-21
Debian DSA-573-1 2004-10-21

Comments (none posted)

xzgv integer overflows

Package(s):xzgv CVE #(s):CAN-2004-0994
Created:December 21, 2004 Updated:January 12, 2005
Description: Luke "infamous41md" discovered multiple vulnerabilities in xzgv, a picture viewer for X11 with a thumbnail-based selector. Remote exploitation of an integer overflow vulnerability could allow the execution of arbitrary code.
Alerts:
Gentoo 200501-09 2005-01-06
Debian DSA-614-1 2004-12-21

Comments (none posted)

zip: arbitrary code execution

Package(s):zip CVE #(s):CAN-2004-1010
Created:November 5, 2004 Updated:February 2, 2005
Description: HexView discovered a buffer overflow in the zip package. The overflow is triggered by creating a ZIP archive of files with very long path names. This vulnerability might result in execution of arbitrary code with the privileges of the user who calls zip. This flaw may lead to privilege escalation on systems which automatically create ZIP archives of user supplied files, like backup systems or web applications.
Alerts:
Fedora-Legacy FLSA:2255 2005-02-01
Debian DSA-624-1 2004-01-05
Red Hat RHSA-2004:634-01 2004-12-16
Mandrake MDKSA-2004:141 2004-11-25
Gentoo 200411-16 2004-11-09
Fedora FEDORA-2004-399 2004-11-08
Fedora FEDORA-2004-400 2004-11-08
Ubuntu USN-18-1 2004-11-05

Comments (1 posted)

zlib: denial of service

Package(s):zlib CVE #(s):CAN-2004-0797
Created:August 25, 2004 Updated:June 10, 2005
Description: Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks.
Alerts:
OpenPKG OpenPKG-SA-2005.007 2005-06-10
Fedora-Legacy FLSA:2043 2005-02-23
Conectiva CLA-2004:878 2004-10-25
Slackware SSA:2004-278-02 2004-10-04
Conectiva CLA-2004:865 2004-09-13
Mandrake MDKSA-2004:090 2004-09-07
SuSE SUSE-SA:2004:029 2004-09-02
Gentoo 200408-26 2004-08-27
OpenPKG OpenPKG-SA-2004.038 2004-08-25

Comments (none posted)

Resources

Secure programmer: Call components safely (IBM developerWorks)

David A. Wheeler's latest article in the "Secure Programmer" series looks at how to call components from an application in a secure way, on IBM developerWorks. "Application programs typically make calls to other components, such as the underlying operating system, database systems, reusable libraries, Internet services (like DNS), Web services, and so on. This article explains how to prevent attackers from exploiting those calls to other components by discussing the use of only secure components, passing only valid data, making sure the data will be correctly interpreted, checking return values and exceptions, and protecting data as it flows between applications and components."

Comments (4 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 kernel is 2.6.10, which was released by Linus on December 24. There are CIFS and DVB updates since -rc3, along with the usual pile of fixes. For those of you just tuning in, 2.6.10 as a whole includes a new kernel events notification mechanism, switchable I/O schedulers (and a new CFQ scheduler as well), in-kernel cryptographic key management, DVD+RW and CDRW packet writing support, ext3 block reservation and online resizing support, big updates for many kernel subsystems, and a handful of security fixes. The long-format changelog (1.5MB) has all the details.

Linus's BitKeeper repository, as of this writing, contains the four-level page table patch (see below), a VIA PadLock crypto engine driver, a new SKB allocation function (see below), ACPI hotplug support, the full InfiniBand patch set (covered here last November), a big direct rendering manager (DRM) rework, a new and simplified file readahead mechanism, a set of user-mode Linux patches, a big set of input patches, a new set of "sparse" annotations, an NFS update, an iptables update, support for the Fujitsu FR-V architecture, in-inode extended attribute support for ext3, some SELinux scalability improvements, and lots of fixes.

The current prepatch from Andrew Morton is 2.6.10-mm1. Recent additions to -mm include some software suspend improvements, a PCMCIA update, a number of NUMA-related cleanups, and a reiser4 update.

The current 2.4 prepatch remains 2.4.29-pre3, dating back to December 22.

Comments (1 posted)

Kernel development news

Quotes of the week

After 2.6.9-ac its clear that the long 2.6.9 process worked very badly. While 2.6.10 is looking much better its long period meant the allegedly "official" base kernel was a complete pile of insecure donkey turd for months. That doesn't hurt most vendor users but it does hurt those trying to do stuff on the base kernels very badly.

-- Alan Cox

Not all 2.6.x kernels will be good; but if we do releases every 1 or 2 weeks, some of them *will* be good. The problem with the -rc releases is that we try to predict in advance which releases in advance will be stable, and we don't seem to be able to do a good job of that. If we do a release every week, my guess is that at least 1 in 3 releases will turn out to be stable enough for most purposes. But we won't know until after 2 or 3 days which releases will be the good ones.

-- Ted Ts'o

Comments (3 posted)

Four-level page tables merged

As expected, one of the first things to be merged into Linus's BitKeeper repository after the 2.6.10 release was the four-level page table patch. Two weeks ago, we noted that Nick Piggin had posted an alternative patch which changed the organization initially created by Andi Kleen. It was not clear, then, which version of the patch would go in. In the end, Nick's changes to the four-level patch were accepted.

Thus, in 2.6.11, the page table structure will include a new level, called "PUD," placed immediately below the top-level PGD directory. The new page table structure looks like this:

[Four-level page tables]

The PGD remains the top-level directory, accessed via the mm_struct structure associated with each process. The PUD only exists on architectures which are using four-level tables; that is only x86-64, as of this writing, but other 64-bit architectures will probably use the fourth level in the future as well. The PMD and PTE function as they did in previous kernels; the PMD is absent if the architecture only supports two-level tables.

ArchitectureBits used
PGDPUDPMDPTE
i38622-31   12-21
i386 (PAE mode)30-31  21-2912-20
x86-6439-46 30-38 21-29 12-20

Each level in the page table hierarchy is indexed with a subset of the bits in the virtual address of interest. Those bits are shown in the table to the right (for a few architectures). In the classic i386 architecture, only the PGD and PTE levels are actually used; the combined twenty bits allow up to 1 million pages (4GB) to be addressed. The i386 PAE mode adds the PMD level, but does not increase the virtual address space (it does expand the amount of physical memory which may be addressed, however). On the x86-64 architecture, four levels are used with a total of 35 bits for the page frame number. Before the patch was merged, the x86-64 architecture could not effectively use the fourth level and was limited to a 512GB virtual address space. Now x86-64 users can have a virtual address space covering 128TB of memory, which really should last them for a little while.

Those who are curious about how x86-64 uses its expanded address space may want to take a look at this explanation from Andi Kleen.

The merging of this patch demonstrates a few things about the current kernel development model. Prior to 2.6, such a fundamental change could never be applied during a "stable" kernel series; anybody needing the four-level feature would have had to wait a couple more years for 2.8. The new way of kernel development, for better or for worse, does bring new features to users far more quickly than the old method did - and without the need for distributor backports. This patch is also a clear product of the peer review process. Andi's initial version worked fine, and could certainly have been merged into the mainline. The uninvited participation of another developer, however, helped to rework the patch into a less intrusive form which brought minimal changes to code outside the VM core. The end result is an improved kernel which can take full advantage of the hardware on which it runs.

Comments (none posted)

alloc_skb_from_cache()

The post-2.6.10 mainline kernel contains a set of patches designed to help with the merging of the Xen virtual architecture. One of them is an enhancement to the networking API which could have uses beyond Xen.

The "socket buffer" (SKB) is the core kernel data structure used to represent packets as they pass through the system. The SKB API has been described for 2.4 in LDD2; this interface has changed little since then. SKB structures are allocated in various ways by the networking layer; the Xen patches add a new way:

    struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cache,
                                         unsigned int size, int gfp_mask);

This function will allocate an SKB of the given size from the slab cache provided. It assumes that the cache will provide a chunk of memory of sufficient size for the buffer - and various bits of overhead imposed by the SKB structure itself.

The new allocation function might speed things slightly for network drivers which allocate large numbers of buffers of the same size - though the existing allocation interfaces are already pretty fast. Xen has an interesting use for this capability, however: fast networking between virtual machines. By using the slab cache, Xen can ensure that every packet is allocated a one-page buffer. When that packet is sent to another virtual machine, the associated page can be unmapped from the source system and mapped into the address space of the destination. It is, in other words, a fairly straightforward zero-copy networking scheme. As a side benefit, the Xen monitor benefits from the knowledge that the pages in question have been used for network packets - since the contents of the packet could be read by third parties while it is in transit, there is no real point in worrying about zeroing out the data afterward.

Comments (2 posted)

Faster page faulting through prezeroing

In early December, this page covered Christoph Lameter's efforts to speed up the page fault mechanism by reducing lock contention. That work speeds things significantly on multiprocessor systems, but is of little help to uniprocessor users. That is not true of Christoph's other page fault work, which can benefit users on all systems.

Christoph notes that, once the locking issues are taken care of, the most expensive part of the page fault handler is the code which zeroes anonymous pages before handing them to the faulting process. He has concluded that, in some situations, performance can be significantly improved by clearing those pages ahead of time and having them ready when the page fault happens. Just zeroing pages ahead of time is not particularly helpful - it is mostly an exercise in moving work around to different places in the system. But, if (1) the zeroing of pages can be made more efficient, and (2) the workload is of the right type, things can be made quite a bit faster.

What is the right kind of workload? For the purposes of this patch set, the best workload is one which allocates whole pages, but then only touches parts of them. If those pages are already cleared, there is no need to load an entire page into the processor cache when it is faulted in. The improved cache behavior, along with the speedup in fault handling itself, can yield big improvements. Some figures posted by Christoph show an almost 4x improvement in the page fault rate in the right conditions. As it turns out, many applications fit this profile, so "the right conditions" should not be all that rare.

There are four parts to the prezeroing patch set. The first patch extends the page allocation mechanism to make it explicitly handle requests for zeroed memory. There is a new __GFP_ZERO allocation flag which tells alloc_pages() (and thus functions like __get_free_page() and kmalloc()) to return zeroed memory. Many places in the kernel which clear their own pages have been fixed to request zeroed memory instead. With only this patch applied, the kernel's code is cleaned up a bit, but no performance improvements result - the __GFP_ZERO flag just causes a call to clear_page() in the page allocator.

The second patch changes the prototype of the clear_page() function to:

    void clear_page(void *page, int order);

With the new interface, clear_page() can zero higher-order pages. This change is an important part of the patch set: pages are most efficiently zeroed if they can be done in larger groups. Often, the setup cost is a big part of the total; the value of prezeroing pages is much reduced if it can only be done one page at a time.

The kscrubd patch is where things start to get interesting. This patch expands the zone structure so that it can keep track of pages which are known to be clear. Requests for zeroed pages are satisfied from this list when possible. A new kernel thread (actually, a set of per-node threads) wakes up occasionally and clears pages for future allocation. This thread does not normally scrub zero-order (single) pages, but can be configured to do so (via /proc) if desired.

The kscrubd patch also implements a linked list of "zero drivers," being functions which can be called upon to zero pages efficiently. There are no such drivers in this patch, so all pages are zeroed with a call to clear_page(), which, as a comment in the code notes, can be hard on the processor's cache. It would be nicer if pages could be zeroed without the cache impacts. The fourth patch shows how this can be done - at least, on Altix systems. It adds a driver for the Altix block transfer engine which can zero memory directly without the processor's involvement - at least, when relatively large chunks of memory are involved. Drivers for other hardware have not yet been posted, but it would not be surprising to see them begin to appear after the prezeroing code has been merged.

And that could happen soon: Linus, having been convinced by Christoph's results, has requested that this set of patches be merged soon. So prezeroing could even find its way into the kernel prior to the 2.6.11 release. (Update: the __GFP_ZERO patch was merged just as LWN was being published).

Comments (6 posted)

Patches and updates

Kernel trees

  • Domen Puncer: 2.6.10-kj. (December 27, 2004)

Core kernel code

Development tools

Device drivers

Filesystems and block I/O

Memory management

Networking

Architecture-specific

Security-related

Page editor: Jonathan Corbet

Distributions

News and Editorials

Mandrakelinux 10.1 on AMD64

January 5, 2005

This article was contributed by Ladislav Bodnar

Continuing with our review series of distributions for AMD64 processors, the next product we tested was the 64-bit edition of Mandrakelinux 10.1. Unlike the previous three distributions (see Debian on AMD64, Fedora Core 3 on AMD64 and Gentoo Linux on AMD64), Mandrakelinux 10.1 for X86-64 is not readily available for download, and even the Silver-level members of Mandrakeclub were only given access to the ISO images some 6 weeks after the official release on November 10th, 2004. That said, we noticed that, just before Christmas, the x86_64 directory on Mandrakelinux mirrors was populated with RPM packages together with a small installation ISO image, so rather than asking Mandrakesoft for a review copy, we opted for a network install instead. As always, the boxed edition of Mandrakelinux 10.1 for X86-64 is available from Mandrakestore ( €119.00).

First, the system specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2 (Socket939) mainboard from Micro-Star International, 2 GB of DDR SDRAM, 2 x 120 GB Maxtor hard disks, Plextor PX-712A DVD/CD rewritable drive, and NVIDIA GeForce4 Ti 4600 graphics card. The monitor was a standard 19 inch LCD from Mozo International.

We downloaded the 4.5 MB install.iso image from a mirror site. Although the ISO was in the /official/10.1/x86_64/ directory, it turned out to be just a generic installation image with no built-in specifications that would indicate its architectural affinity. After detecting and loading the correct network card module and confirming that DHCP should indeed be activated (other options included static IP and ADSL), the installer asked to specify the installation method (FTP, HTTP, NFS or hard disk). It continued with a request to type in a preferred FTP/HTTP server and a correct path to the install directory. Since the installer itself does not include a list of available mirrors, you need to look up the information before starting the installation. After the usual partitioning and package selection screens, the installer was ready to begin downloading and installing the new operating system.

From this point on, the installation proceeded without much human interaction. As with previous three distributions, we chose a complete workstation with GNOME and KDE, as well as a handful of server applications. The local mirror delivered the packages at the maximum available connection speed which meant that the installation completed in less than two hours. After a few more screens helping to configure the boot loader, X server, security settings, adding users and specifying the root password, we were presented with an option to update the system with security and bug fix updates.

And this is were we spotted the first bugs, or more precisely, some amusing geographical anomalies. This time, the installer did supply a list of available update servers, neatly arranged by countries in which the servers were located. However, only a dozen or so countries were on the list, while the remaining update servers, be they in Brazil, Hungary or Japan, were all listed under "United States"! The next geographical mishap happened on the survey page, where we decided to let Mandrakesoft have our hardware data. But when we got to the drop-down list from which to select our country of residence, we noticed that a number of big populous countries, such as China or Japan, were not listed at all, while Antarctica or Pitcairn (a tiny Pacific Ocean island of less than 50 inhabitants) did appear on the list. Since our country of residence wasn't listed, we pretended to be descendants of those famous mutineers on HMS Bounty and registered Pitcairn as our country of residence.

Of course, these are no showstopper bugs, just something for the Mandrakelinux developers to polish before 10.2. However, worse was to come.

The first surprise came after logging into KDE, which greeted us with a desktop background that proudly proclaimed "Mandrakelinux 10.1 Community". Community!? But we had pointed the installation sources at the "Official" directory, so how come we ended up with the Community edition? We rushed to check the "mandrakelinux-release" RPM file, which confirmed that what we installed was indeed the "Community" edition, despite it having been placed in the "Official" directory (the same RPM package in the official/i586 directory correctly indicated the "Official" status of the i586 branch). A quick question on the expert mailing list brought dead silence - a marked difference from our earlier experiences with the Debian mailing lists and Gentoo forums, where questions were answered and problems solved with much more enthusiasm.

After coming to grips with the fact that nobody really knew what edition of Mandrakelinux we had installed, the next logical step was getting product updates. Based on experiences with Fedora, SUSE and other distributions, we expected to find a "Update" icon somewhere in the KDE system tray and we weren't disappointed; there it was - the "Mandrakelinux Updates Applet". A double-click brought up a dialog, which... well, before turning this experience into a long story, let's just say that, after having made the effort to configure the applet and register for an update account, we still weren't able to get any updates - that's because this is a paid service, only available to Silver-level members of Mandrakeclub. It would have been nice if the applet had informed us about this fact beforehand, but it wasn't the case.

Surely, there is another way to get updates - through the good old Update module of the Mandrakelinux Control Center. Unfortunately, this turned out to be another frustrating experience - no matter how many times we tried to configure the update sources, the application kept displaying an error message claiming that it could not find any available mirrors, most likely, it said, because our installed architecture was not supported by Mandrakelinux updates. But upon examining several mirrors, the update directory for x86_64 was available and populated with RPM packages, so why the misleading message?

And this is what we thought was possibly the biggest problem with today's Mandrakelinux - because of the distribution's increasingly commercial nature, we were often unable to determine whether a particular feature was disabled in order to make the user join a premium service, or whether it was deliberately crippled so that the user doesn't easily find a way around the club membership net. Either way, the experience was not pleasant. Of course, there is always a possibility that these were just bugs. But if that were the case, there were already too many of them, even before starting to use the distribution proper.

Eventually we found a way to configure the application to get updates - by resorting to the command line and using the "urpmi.addmedia" command. Unfortunately, by that time we started having serious doubts about the quality of this distribution, where lack of attention to detail and various "joined the club" tricks seemed to be the order of the day. In a way, Mandrakelinux 10.1 started to resemble LindowsOS 4, which installed a bunch of flashing and rotating icons of various other Lindows products into the system tray, all screaming "buy, buy, buy". Not quite as bad, but close enough for discomfort.

In all fairness, once we got through these early troubles, the distribution turned out to be a pleasant product. The hardware autodetection was flawless, the applications we tested behaved as expected, and Mandrakelinux Control Center is a friendly utility for most general configuration tasks. Like in Fedora Core, many 32-bit applications and libraries were installed on the system alongside the 64-bit ones - the 32-bit libraries (referred to as lib*) are in /lib, while the 64-bit libraries (referred to as lib64*) are in /lib64. On the download server, the two branches are stored in two separate directories - main and main32; the main directory lists a total of 3,875 packages, while the main32 directory lists 573 packages, including OpenOffice.org and MPlayer. Interestingly, the popular PLF site hosting third-party Mandrakelinux packages now has an x86_64 directory with over 100 RPM packages, including many multimedia applications and codecs which cannot be legally shipped with Mandrakelinux.

Is Mandrakelinux 10.1 (X86-64) worth €119? As we did not test the commercial edition of the product, we cannot really answer the question, but the FTP edition has given us enough warning signs to put any recommendations on hold. Frankly, it is hard to see how Mandrakelinux will compete with other 64-bit distributions on the market, especially with the likes of Fedora, but also Debian or Gentoo, which are free of cost and available for download immediately after release (or continuously updated). Additionally, all three of them have more up-to-date packages (Mandrakelinux 10.1 ships with GNOME 2.6 and KDE 3.2.3), fewer bugs (especially when compared to Fedora Core 3), and more responsive mailing lists and user forums, actively monitored by the distributions' developers. Mandrakelinux 10.1 X86-64 is not a bad product, but it is marred by lack of polish and some unnecessary commercial tricks.

Comments (14 posted)

Distribution News

Mandrakesoft to liven up the corporate Linux world

Mandrakesoft has announced the availability of both Corporate Server and Corporate Desktop. These two Linux systems have received specific development efforts to make them "enterprise-ready". The two products feature longer development cycles and a 5-year maintenance span.

Full Story (comments: 1)

Debian GNU/Linux 3.0r4 released

The fourth maintenance update for Debian 3.0 ("woody") is out. This update consists almost exclusively of security fixes; click below for the full list of changes.

Full Story (comments: 31)

Debian GNU/Linux

Wichert Akkerman reports that the arch and subversion repositories have been moved to the host. A few notable changes are listed in the announcement.

Another Bug Squashing Party has been announced for January 7 - 9, 2005. "As there are currently a lot RC bugs with low complexity again there is clearly enough to do, even for people that are not experienced in that kind of work. And of course there should be always some people around in the IRC channel that are able to help, sponsor upload, etc."

Comments (none posted)

Gentoo Apache packages refresh

Gentoo has announced that the Gentoo Apache Herd will release a refresh of all packages for the Apache httpd daemon and related modules on Saturday January 8, 2005. Click below for more information.

Full Story (comments: none)

Ubuntu: Recent Community Council Meetings

Summaries and logs of both the December 7 and December 21 Community Council Meetings are available (click below). "The second meeting covered the creation of new country/region teams. People interested in starting or working within an official Ubuntu Country team should contact Matthias Urlichs [and optionally Mako]. You should especially consider doing this if you've been active in doing country or language specific work for Ubuntu and are interested into finding ways to integrate this work in the larger Ubuntu community."

Full Story (comments: none)

PC Magazine Names Astaro Security Linux wins PC Magazine awards

Astaro Corporation has announced that Astaro Security Linux was named PC Magazine's Best Business Security Solution and Editors' Choice in the publication's year-end edition.

Comments (none posted)

Linux Netwosix Bugzilla - Bugtracking System

Vincenzo Ciaglia provides some helpful suggestions for using the Linux Netwosix Bugzilla. Click below for additional information.

Full Story (comments: none)

Mandrakelinux

Three new urpmi sites for Mandrakelinux users are now available: www.urpmi-addmedia.org, www.linuxfordummies.org/addmedia and www.ianmacgregor.net/addmedia.

A problem in udev existed where a user would not be able to use a firewire camera because the required device was never created. This update forces udev to pre-create the device allowing the use of firewire cameras. New packages are available for Mandrakelinux 10.1 and Mandrakelinux 10.1/X86_64.

Comments (none posted)

Fedora Core updates

Fedora Core 2 updates: rpm (fixes an issue with building packages containing dangling symlinks, introduced by a glibc glob() change), pcmcia-cs (fixes bug #135508, silencing a warning message on cardmgr startup).

Fedora Core 3 updates: selinux-policy-targeted (fix for postgres startup scripts), pcmcia-cs (fixes bug #135508, silencing a warning message on cardmgr startup), mysql (work around SELinux restriction and other bug fixes).

Comments (none posted)

Slackware Linux

A few packages have been updated this week in Slackware current. Upgraded packages include cvs, python, perl, libxml, and several others. See the slackware-current change log for complete details.

Comments (none posted)

New Distributions

Hikarunix

Hikarunix is a Live Linux CD dedicated to Go. It's designed for Go players of all levels and it fits on a pocket-sized miniCD so it can go almost anywhere. Installation to a harddrive is also supported.

Comments (1 posted)

Whoppix 2.6 released - Now available for download

WhiteHat Knoppix (WHoppix) is a knoppix 3.6 remaster designed to be a standalone penetration testing toolkit. Heavily modded by muts, WHoppix includes a full set of penetration testing tools and a huge repository of exploits (Framework 2.2, Packetstorm and Securityfocus exploit archives).

Full Story (comments: none)

Distribution Newsletters

Debian Weekly News

The December 28 Debian Weekly News is out; this week's topics include documenting transitional packages, the upcoming stable update, rewriting GFDL-licensed documentation, and more.

Full Story (comments: none)

Debian Weekly News /2005/01/

The Debian Weekly News for January 4, 2005 covers an announcement by Martin Michlmayr that Jörg Jaspert has been appointed as an additional Debian account manager, the stable point release, the new arch and subversion server, Mozilla trademark restrictions, the Debian Eyecatcher Project, the origin of the Debian swirl, and several other topics.

Full Story (comments: 4)

Gentoo Weekly Newsletter

The December 29 edition of the Gentoo Weekly Newsletter celebrates the second anniversary of the GWN. There is also a look at the major Gentoo Linux events of 2004.

Full Story (comments: none)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of January 3, 2005 is out. This edition looks at the last 1000 days on Gentoo forums, the website redesign mailing list, with an update on the Gentoo Documentation Project and more.

Full Story (comments: none)

Ubuntu Traffic #14 -- 2004/11/27

The Ubuntu Traffic #14 covers IRC and mailing list activity through November 27, 2004. Threads covered include Live CDs for PPC (And More!), Downgrading From Hoary, Ubuntu Merchandise, Documentation Team Update, More On Language Packs, Dropping Support For the Mozilla Suite, Encrypted Home Directories, Apt Authentication, Concerns With Sudo, Archive Layout, and Ubuntu Security Notifications.

Comments (none posted)

Ubuntu Traffic #15

The fifteenth issue of Ubuntu Traffic is out. This issue, still catching up with early December, looks at UTF-8 support, cooperation with the Debian Project, and several other topics.

Comments (none posted)

DistroWatch Weekly, Issue 81

The DistroWatch Weekly for January 3, 2005 is out. "Happy New Year! You are reading the first issue of DistroWatch Weekly in 2005, in which we'll go back in history and reveal how DistroWatch started, then provide a few figures about visitors' interest over the past year, and introduce a handful of new distributions. Happy reading!"

Comments (none posted)

Minor distribution updates

cAos

cAos has announced a pre-release of cAos Linux Core 2.0 for the IA-32 platform. "This release identifies the stabilization of the ABI in, and a feature freeze of, the core OS. Members of the community are invited to install and test this new distribution core."

Comments (none posted)

FlashLinux 0.3.3 released (GnomeDesktop)

GnomeDesktop reports the release of Flash Linux 0.3.3. There is a list of new features here.

Comments (none posted)

Linux Business Alliance Releases LBA-Linux R2

LBA-Linux R2 has been released. "The new version, LBA-Linux R2, offers many completely new features, including integrated office software and encrypted directories for each user. The R2 release also incorporates all security updates released since the first LBA-Linux distribution was published in May 2004."

Comments (none posted)

Newsletters and articles of interest

Interview: Debian Project Leader Martin Michlmayr (NewsForge)

NewsForge talks with Martin Michlmayr. "In this interview, Martin Michlmayr, the Debian project leader, talks about Sarge, the next release of Debian GNU/Linux. One of the most significant improvements in Sarge over Woody, the last stable Debian release, is in the new user-friendly installer. Others include the addition of Apache 2.0.52, GNOME 2.8, KDE 3.2, and XFree86 4.3. Debian supports 11 hardware architectures. According to Michlmayr the system is very stable, and only some infrastructure issues need to be addressed before the release."

Comments (none posted)

Knowing Knoppix

If you have been giving away Knoppix CDs to your friends you might want to also point them to this site. Knowing Knoppix, The first guide to Knoppix for the complete beginner. "Knoppix is an astoundingly clever product. It runs Linux completely from CD. There is no need to install. It bypasses all the software already installed on your PC or laptop. It automatically detects the hardware in your computer, such as video card, sound card, networking, the lot (subject to suitable hardware). When you've finished using Knoppix, simply restart. Your computer will return to your regular system, and it will behave as if nothing has happened. Knoppix is Free Software and open source under the terms of the GNU General Public Licence (GPL)."

Comments (1 posted)

Building a distro (NewsForge)

Farrell J. McGovern writes about building a custom Linux distribution in this NewsForge article. "Most derivative distros are based upon Red Hat, Debian, or Slackware. Of them, Slackware is the oldest. I started using Slackware in 1993, and therefore I was very familiar with it. Slackware is easy to modify. The package system is simple to work with and build packages for. It has an unencumbered init script structure, and you can install software from source without worrying about breaking dependency databases. Plus, Slackware author Patrick Volkerding does a good job of keeping the even older versions of the software up-to-date with security revisions."

Comments (none posted)

My workstation OS: My own (NewsForge)

Here's another look at creating your own Linux distribution. "There are many advantages to compiling and configuring every piece of your system. First of all, you can enable specific optimizations and configurations for your platform and processor architecture. Secondly, you can unselect default features you don't want and select features you need that are not enabled by default. You can go one step further and search the Net for unofficial patches that add, modify, or correct some features. You can even make your own modifications to the source code of the applications. One joke some of my friends and I have is to hard code our names in place of the original name of an application, thus having a "MyName Web server" instead of an "Apache Web server," for example."

Comments (none posted)

Distribution reviews

SimplyMepis 2004.06 or: Gnome Guy Goes KDE (OS News)

OSNews reviews SimplyMepis 2004.06 with KDE 3.2.3. "This review is kind of split: it is a review of SimplyMepis 2004.06, but it is also a look at a tested and proven implementation of KDE from a Gnome-user perspective. I am fully aware that SimplyMepis 2004.06 has KDE 3.2.3, an already outdated version of the KDE desktop. I still chose this distribution, mainly because I was interested in the small hype around Mepis Linux."

Comments (16 posted)

Xandros Desktop OS 3 Deluxe Edition (NewsForge)

Joe Barr reviews Xandros Desktop OS 3 Deluxe Edition, on NewsForge. "The one word that pops up in my mind most often when I think of my experience with Xandros 3.0 Deluxe is elegance. Power and polish in harmony. It won't be the "just right" distro for some, but for a whole lot of others it just might be the one that leads them from the Land of Oppressive Proprietary Software to the Land of Linux and Freedom."

Comments (none posted)

My workstation OS: Lycoris Desktop/LX (NewsForge)

Nauman Munir Afzal explains why he likes Lycoris Desktop/LX, on NewsForge. "I have been trying out different Linux distros for quite some time now, in search of the perfect one. The biggest problem I found was the user-unfriendliness of Linux, not to mention the unfamiliarity, as I'm migrating from Windows. Lycoris's biggest plus is the user-friendliness and ease that it offers, and its similarity to Windows XP is another big advantage. Using Desktop/LX has been a great experience."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Gambas - a BASIC Development Environment

The Gambas project (Gambas Almost Means BASic), is a BASIC language interpreter and development environment that was written by Benoît Minisini. The project was started in February of 2002, according to the change log. The code has been released under version 2 of the GNU General Public License.

[Gambas] The project aims to resemble, and improve upon, the capabilities of Microsoft's Visual Basic. The Gambas introduction goes into more detail:

I want to clear up any misunderstanding immediately. Gambas does not try to be compatible with Visual Basic, and will never be. I'm convinced that its syntax and internals are far better than the one's of its proprietary cousin ;-) I took from Visual Basic what I found useful : the Basic language, the development environment, and the easiness to quickly make programs with user interfaces.

The Differences From VB document has a lot of information that is useful for VB developers who are interested in using Gambas.

There is a Gambas visual introduction document which provides a nice tour of the project. The features section of the introduction explains the architecture of Gambas in more detail, and the FAQ document answers common questions and has some installation information.

Version 1.0 of Gambas was released this week, quickly followed by version 1.0.1, which has fixes for a few newly discovered bugs.

One piece at a time, open-source developers are building Linux equivalents of the various Windows desktop components, Gambas is well positioned to fill the Visual Basic slot. It should be useful for luring a few Windows users who like the 'cartoon programming' method of software development over to Linux.

Comments (11 posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include a bunch of new packages for Fedora Core 3, a small list of failed builds for Fedora Core 3 with a request for assistance, and more.

Comments (none posted)

Database Software

Firebird 1.5.2 is Released

Version 1.5.2 of the Firebird database is out. See the release notes for change information.

Comments (none posted)

PostgreSQL 8.0.0 Release Candidate 3 announced

Release Candidate 3 of PostgreSQL 8.0.0 is available. "Baring *any* coding changes (documentation != code) over the next week or so, we *hope* that this will the final Release Candidate before Full Release, with that being aimed for the 15th (or earlier)."

Full Story (comments: none)

PostgreSQL Weekly News

The December 28, 2004 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL database information.

Full Story (comments: none)

PostgreSQL Weekly News

The January 4, 2005 edition of the PostgreSQL Weekly News is available with the latest PostgreSQL database resources and events.

Full Story (comments: none)

Libraries

FreeImage 3.5.3 released (SourceForge)

Version 3.5.3 of FreeImage, a library for supporting the PNG, BMP, JPEG, TIFF and other image formats, is available. "Release 3.5.3 is a maintenance release that is worth the try : the library has been updated with the new zlib (1.2.2), libpng (1.2.8) and libtiff (3.7.1) libraries. This means better performance and less bugs !"

Comments (none posted)

liblrdf-0.4.0 release

Version 0.4.0 of liblrdf, lightweight RDF library with special support for LADSPA (audio effect) plugins, is out. Changes include SWIG support and better generic id creation.

Full Story (comments: none)

Mail Software

Bogofilter 0.93.3 released

Version 0.93.3 of Bogofilter, a spam filter, is out. "The 0.93.3 release of bogofilter brings with it two significant changes. First bogoutil now supports multiple options for working with the Berkeley DB database environment. "bogoutil --help" lists the following options:..."

Full Story (comments: none)

Networking Tools

Click 1.4.2 Modular Router is out

Version 1.4.2 of Click, a modular router, is available. "A Click router is an interconnected collection of modules called elements; elements control every aspect of the router’s behavior, from communicating with devices to packet modification to queueing, dropping policies and packet scheduling. Individual elements can have surprisingly powerful behavior, and it’s easy to write new ones in C++. You write a router configuration by gluing elements together with a simple language."

Full Story (comments: none)

Peer to Peer

XBT Client 0.4.0 released (SourceForge)

Version 0.4.0 of the XBT client is out with numerous changes and bug fixes. "This client is an implementation of the BitTorrent peer to peer file sharing protocol in C++. It's designed for low CPU- and RAM usage, an easy-to-use interface and high download speeds. Both Linux (source only) and Windows versions are available."

Comments (none posted)

Printing

Common UNIX Printing System 1.1.23

Version 1.1.23 of CUPS has been announced. "CUPS 1.1.23 is a bug fix release which fixes two security vulnerabilities reported by Daniel J. Bernstein. The new release also contains other minor bug and documentation fixes that are not security related."

Comments (none posted)

Web Site Development

IRM 1.5.0 now available! (SourceForge)

Version 1.5.0 of IRM has been announced. "IRM is a Web-based asset and problem tracking system built for IT departments and helpdesks. It keeps detailed information, both hardware and software, about each computer, as well as a complete history of all work requests ever placed. The IRM development team is proud to announce the release of IRM 1.5.0, the first release of a new line of development for IRM, both in terms of the code produced, the development process, and the frequency of releases."

Comments (none posted)

MidCOM 2.0.0 released

Version 2.0.0 of MidCOM, the Midgard Components Framework, is out. "The Midgard Project has released the final stable version of the Midgard Components Framework 2.0, now based on the filesystem, not on the Database. Significant performance improvements come out of this."

Full Story (comments: none)

mnoGoSearch 3.2.29 is available

Version 3.2.29 of the mnoGoSearch web site search engine has been released. It features bug fixes and performance improvements. See the Change History document for details.

Comments (none posted)

A Move Towards Unified Blogging (GnomeDesktop)

GnomeDesktop mentions the release of Drivel 1.3.0, a LiveJournal blog posting tool. "This marks the first release with support for posting to Blogger and Movable Type journals, giving GNOME users an integrated tool for accessing both of these systems while maintaing the smooth interface, syntax highlighting, and spell-checking that LiveJournal users have enjoyed for months. As this is a development release, testing and bug reports would be very much appreciated."

Comments (none posted)

Desktop Applications

Audio Applications

Ardour 0.9beta22 released

Version 0.9beta22 of Ardour, a multi-track audio recorder, is available. "With over a hundred notable new items, and only a handful of bug fixes between this and 0.99, this is a significant release of Ardour."

Full Story (comments: none)

Ceres V0.41 and Snd-ls V0.9.1.5 are available

New versions of Ceres and Snd-ls are out. Ceres is a sonogram display and sound effects application, Snd-ls is a sound editor.

Full Story (comments: none)

Business Applications

OpenPSA 1.10 released

Stable version 1.10 of OpenPSA has been announced, it features major improvements to all of the component modules. "OpenPSA is a free web-based package for managing consultancies and software companies. It includes project management, hour reporting, help desk, group calendar, document management and customer relationship management."

Full Story (comments: none)

Data Visualization

Grace-5.1.18 released

Version 5.1.18 of Grace, a WYSIWYG 2D plotting tool for the X Window System and M*tif, has been announced. The parser now supports concatenation of quoted strings and numerical expressions, and some bugs have been fixed.

Comments (none posted)

Desktop Environments

Dropline Gnome 2.8.2 Released! (GnomeDesktop)

Dropline Gnome 2.8.2 has been announced. "After a long delay, an RC and a lot of bug squashing we are finally ready to put our names on this first official release of Dropline GNOME as a community project."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced in the last two weeks:

Comments (none posted)

KDE CVS-Digest (KDE.News)

The December 24, 2004 edition of the KDE CVS-Digest is out with the following content summary: "Kexi has a new Reports module. KPDF adds a presentation mode. KJSEmbed adds KScript which allows applications to use Javascript as scripting language. Umbrello adds entity relationship diagrams."

Comments (none posted)

KDE CVS-Digest (KDE.News)

The December 31, 2004 edition of the KDE CVS-Digest is online, here's the content summary: "Krita implements pasting, layers and autogradient. media kioslave now handles cameras. KGeography adds more maps. Special year end retrospective of the KDE development effort."

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced in the last two weeks:

Comments (none posted)

Xfce 4.2 Release Candidate 3 released

Release Candidate 3 of the Xfce lightweight desktop environment is out. "The third Release Candidate, which provides several bugfixes over the second Release Candidate, is a lightweight desktop environment with several features not found in the Xfce 4.0 series, including a brand new session manager, keyboard shortcut and desktop menu graphical editors, multihead support, "kiosk mode" support, a desktop menu plugin for the panel, CUPS and BSD-LPR printing support, and a new icon theme."

Comments (none posted)

Electronics

gEDA News

The latest releases from the gEDA project include new versions of gaf, Gerber Viewer, and some hardware projects that were built with the gEDA tools including The GNU Software Radio.

Comments (none posted)

Open Collector Releases

The latest new electronics applications on Open Collector include FreePCB 0.943, I2C2P 20041227, Electric 8.01, and more.

Comments (none posted)

Financial Applications

SQL-Ledger 2.4.7 released

Version 2.4.7 of SQL-Ledger, a web-based accounting system, has been released. Changes include string formatting for transaction printing, bug fixes, and more.

Comments (none posted)

Fonts and Images

Open Clip Art Library 0.09 released

Version 0.99 of the Open Clip Art Library is available. "This version contains 3104 unique clip art submissions with an emphasis on the past holiday season."

Comments (none posted)

Graphics

Gnofract4D 2.5 released

Version 2.5 of Gnofract4D, a Python-based fractal image generator, is out. This version adds support for hypercomplex numbers.

Comments (none posted)

Interoperability

Wine Traffic

Issues number 254 and number 255 of Wine Traffic are online with the latest Wine project happenings.

Comments (none posted)

Music Applications

BEAST/BSE v0.6.4 announced

Version 0.6.4 of BEAST/BSE, the BEdevilled Audio SysTem and the Bedevilled Sound Engine music composition system, is out. "This new development series of BEAST comes with a lot of the internals redone, many new GUI features and a sound generation back-end separated from all GUI activities."

Full Story (comments: none)

MusE 0.7.1pre2 has been released

Version 0.7.1pre2 of Muse, a MIDI and audio sequencer application, has been released. Changes include the inclusion of the new SimpleDrums 0.2 softsynth, bug fixes, and more.

Comments (none posted)

Sfront 0.88 released

Version 0.88 of Sfront, a translator for converting MP4-SA files into C programs that generate audio, is out. "this release keeps sfront networking in sync with the IETF Internet-Drafts that define RTP MIDI (the RTP payload format for MIDI)."

Full Story (comments: 1)

Web Browsers

Epiphany celebrates its second birthday! (GnomeDesktop)

GnomeDesktop.org celebrates the second birthday of Epiphany. "We have set ambitious goals for the next stable release, Epiphany 1.6, that will coincide with GNOME 2.10. To whet your appetite a little: if all goes according to plan, the Bookmarks menu in 1.6 will be able to dynamically show topic submenus and subdivisions, based on the topics the bookmarks belong to. We are soliciting the help of interested coders, designers, documentation writers, bug triagers and translators from the community to help us get there. The 1.6 roadmap shows the plans and indicates their progress."

Comments (none posted)

Miscellaneous

Annoucing Pooter 3.1

Version 3.1 of Pooter, a Personal Information Manager (PIM) is out. "As well as a continuation of the development of a cross platform version, the 3.1 release has additional versions for Gnu/Linux only. One uses the Simple Look and Feel Program (Slaf) to provide a choice that includes KDE and Gnome, the other uses the Charva windowing toolkit for a version that runs in a terminal emulator or even without XWindows."

Full Story (comments: none)

Languages and Tools

Caml

Caml Weekly News

The December 28, 2004 edition of the Caml Weekly News is online with a new round of Caml language articles.

Full Story (comments: none)

Caml Weekly News

The Caml Weekly News for December 28, 2004 through January 4, 2005 is online with a new summary of Caml language development activity.

Full Story (comments: none)

Java

ONJava 2004 in Review: Popular Articles (O'ReillyNet)

O'Reilly has compiled a collection of popular articles from the ONJava site in 2004.

Comments (none posted)

Towards Bug-Free Code (O'ReillyNet)

Ashwin Jayaprakash discusses code debugging in Java 1.5. "Test-driven development sometimes sounds better than it turns out to be. Early decisions to tightly couple functional parts of your system can make it a lot less amenable to testing than it ought to be. As Ashwin Jayaprakash shows, J2SE 5.0's generics make working with abstract classes and interfaces easier than it used to be, which encourages loose coupling and facilitates testing."

Comments (none posted)

The Hidden Gems of Jakarta Commons, Part 1 (O'ReillyNet)

Timothy M. O'Brien explores Jakarta Commons in an O'Reilly article. "The Jakarta Commons has a wide-ranging collection of handy classes that can save you the trouble of reinventing the wheel yet again. In this new series, Tim O'Brien looks at some of the more overlooked parts of the Commons and what you can do with them."

Comments (none posted)

Jini: Out of the Bottle and Into the Box (O'Reilly)

Daniel H. Steinberg looks at Jini on O'Reilly. "This is not just another article championing a niche technology; it is a tempered rant on why Jini could be seen as central to the future health of Java. We can draw many lessons from the success of web services and from Apple's (soon to be renamed) Rendezvous technology, and we can find many opportunities on the desktop, in the enterprise, and on devices. Everywhere you see a JVM, picture a Jini-enabled device."

Comments (none posted)

Lisp

2004 Lisp Timeline

A 2004 Lisp Timeline has been assembled, take a look to see what progress was made in the Lisp arena over the past year.

Full Story (comments: none)

SBCL 0.8.18 released

Version 0.8.18 of Steel Bank Common Lisp has been released. "This version features improvements to shared objects and FFI, support for Solaris 10, and several bug fixes."

Full Story (comments: none)

CL-PPCRE 1.0.0 released

Version 1.0.0 of CL-PPCRE is available. "This version doesn't add new features, but recognizes that the system is stable enough for general usage. CL-PPCRE is a Perl-compatible, fast, portable regular expression library written in Common Lisp. The library also supports a sexp-based syntax for specifying regular expressions."

Full Story (comments: none)

Perl

This Fortnight in Perl 6 (O'Reilly)

The December 7-20, 2004 edition of This Fortnight in Perl 6 is online with the latest Perl 6 news.

Comments (none posted)

Building a 3D Engine in Perl, Part 2 (O'Reilly)

Geoff Broadwell continues his series on building a 3D engine in Perl with part two. "This time, I'll discuss rotating and animating the view, SDL event and keyboard handling, and compensating for frame rate variations. As a bonus, I'll demonstrate some real-world refactoring, including a conversion from procedural to (weakly) object-oriented code."

Comments (none posted)

PHP

A Note on Security in PHP

The PHP site has a new note on PHP security that PHP users should read. "A recent Web Worm known as NeverEverSanity exposed a mistake in the input validation in the popular phpBB message board application. Their highlighting code didn't account for double-urlencoded input correctly. Without proper input validation of untrusted user data combined with any of the PHP calls that can execute code or write to the filesystem you create a potential security problem."

Comments (none posted)

Python

Kamaelia's Axon 1.0.1 released

Version 1.0.1 of Axon is out with new documentation. "Axon is a collection of pure python modules from the Kamaelia project which allow you to build concurrent systems in a compositional manner using communicating python generators. Components are python generators are augmented by inbox and outbox queues (lists) for communication in a CSP like fashion."

Full Story (comments: none)

Dr. Dobb's Python-URL!

The December 25, 2004 edition of Dr. Dobb's Python-URL! is online.

Full Story (comments: none)

Dr. Dobb's Python-URL!

The December 30, 2004 edition of Dr. Dobb's Python-URL! is out with the week's Python language news.

Full Story (comments: none)

python-dev Summary

The November 11-15, 2004 edition of the python-dev Summary is out with the summary of the python-dev mailing list traffic for that period.

Full Story (comments: none)

Urwid 0.8.6 announced

Version 0.8.6 of Urwid, the curses-based UI library for Python, is out. "This version of Urwid changes the default foreground and background for areas of the screen with no attributes. You may need to AttrWrap(..) some of your widgets for your program to look the same." See below for the full list of changes.

Full Story (comments: none)

Scheme

Better programming through effective list handling (IBM developerWorks)

Jonathan Bartlett works with linked lists under Scheme in an IBM developerWorks article. "Singly linked lists are a powerful abstraction that allow programmers to represent numerous types of data; extending those lists to handle arbitrary data types can offer effective tools for processing data. In this article, we look at these processes and examine the Lisp variation Scheme, an easy-to-use list-oriented language that delivers list-manipulation capabilities without the complexities of C."

Comments (none posted)

XML

Amara XML Toolkit 0.9.1

Version 0.9.1 of the Python-based Amara XML Toolkit is out with bug fixes and other improvements.

Comments (none posted)

Mapping and Markup, Part 2 (O'Reilly)

John E. Simpson continues his series on XML and GIS with part two. "In Part 1 of this "XML Tourist" feature, I discussed some basic ingredients of a Geographic Information System (GIS) and introduced you to an XML-based, web-delivered application for representing GIS data: the Geography Markup Language, or GML. This month, we'll delve deeper into GML itself--starting with a brief further look into what distinguishes a true GIS from other tools for rendering two- or three-dimensional spaces on a computer monitor."

Comments (none posted)

XML Security: Manage identities more effectively with SPML (IBM developerWorks)

Manish Verma explains SPML on IBM developerWorks. "Gain a basic understanding of what Service Provisioning Markup Language (SPML) is and how it works. After an explanation of SPML's role in the management of the identity lifecycle, this article guides you through an actual working SPML scenario, using OpenSPML. Along the way, the author explains the architecture and design of SPML. Ultimately, you learn to appreciate the usefulness of this technology, and are equipped to participate in the implementation of the standard."

Comments (none posted)

Cross Assemblers

gputils 0.13.0 Released

Version 0.13.0 of gputils, a collection of tools for Microchip PIC microcontrollers, has been released. Here are the change notes: "Added many new processors. Added support for extended 18xx mode. Fixed many bugs."

Comments (none posted)

Emulators

Write emulator-friendly Linux code (IBM developerWorks)

Peter Seebach writes code with emulation in mind. "Computers have been emulating other computers for a long time, often to access a legacy application or to use applications written for a popular OS on a system with a more stable, responsive OS. As Linux grows in popularity, developers need to examine their options when planning binaries that will run on non-Linux systems. This article examines what emulators do and looks at hardware and software emulation issues in detail."

Comments (2 posted)

IDEs

KDevelop TechNotes Issue #4 (KDE.News)

KDE.News has announced the availability of Issue #4 of the KDevelop TechNotes. "This issue describes code navigation in the KDevelop IDE. Read on to learn about the most effective ways to navigate your code with keyboard shortcuts, context menus and "Quick Open..." wizards. The article also gives some useful information about toolview management with keyboard and also describes code navigation features available only to C++ developers."

Comments (none posted)

Graphical Scripting with Kommander (KDE.News)

KDE.News mentions a tutorial on the Kommander IDE. ""Graphical Scripting with Kommander" takes us through the creation of a graphical interface for Konstruct, a tool for downloading, configuring and installing KDE from source packages. The article also lists some of the exciting developments coming to Kommander in the near future."

There is also a new A Kommander crash course available online.

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Where Is Real-Time Linux? (TechNewsWorld)

TechNewsWorld compares real time implementations in Linux. "Hard real-time Linux has been around for ages, or it may never appear. It all depends on who you talk to. It also depends on your requirements. A two-second interrupt latency may be acceptable for some applications, and even many Linux implementations can easily handle interrupts within tens of milliseconds."

Comments (37 posted)

Linux lasting longer against Net attacks (News.com)

News.com looks at a report from the Honeynet Project that shows improvements in the ability of stock Linux distributions to resist attacks. "The data, from a dozen networks, showed that the average Linux system lasts three months before being compromised, a significant increase from the 72 hours life span of a Linux system in 2001. Unpatched Windows systems continue to be compromised more quickly, sometimes within minutes, the Honeynet Project report stated."

Comments (2 posted)

Linux and Open Source: The 2005 Generation (eWeek)

Steven J. Vaughan-Nichols predicts good things for free software in 2005 in eWeek. "I even see Microsoft Office, perhaps the most bloated software suite ever, finally losing ground. That's because Sun's open-source OpenOffice.org 2.0 is looking very, very good. Not only does it have excellent Office file format compatibility, it's finally become a fast application. I've used OpenOffice for ages, but I've never warmed up to it. It's always been too darn slow. With this last pre-beta, though... woo! Look out Microsoft Office, OpenOffice means business."

Comments (25 posted)

The SCO Problem

SCO Must Pay DC's Costs and Attys Fees If It Refiles (Groklaw)

Groklaw discovered some details on the SCO/Daimler Chrysler case that were not mentioned in the recent SCO teleconference. "..the Order says that if ever SCO refiles against DaimlerChrysler for breach of contract regarding an alleged failure to timely certify, it has to pay DC's costs and attorneys' fees going back to August 9th, the date of the judge's order denying in part and granting in part DC's Motion for Summary Disposition."

Comments (none posted)

Code sleuths (Boston.com)

Boston.com has posted an article on the dangers of open source code. "Similar scenes are playing out at software firms and other businesses across the country, as engineers frantically search their files for something they hope not to find: open-source components. Their improper use, in the worst case scenario, could subject companies to costly litigation from parties like the SCO Group of Lindon, Utah." It's a low-clue article, but, alas, it may well scare some people.

Comments (2 posted)

Companies

HP unveils plans for digital home invasion (News.com)

News.com reports on HP's Linux-based "home media hub." "In addition to unveiling new hardware, HP is beginning to lay the groundwork for strategic participation in developing DRM technology through its alliance with Philips. Creating digital locks that pass muster with major music labels and Hollywood studios is widely considered a crucial step in the evolution of digital media to ensure artists and publishers get paid, barring more radical experiments such as compulsory licensing or hardware taxes."

Comments (10 posted)

Novell Joins SuSE Linux, Netware in Public Beta (eWeek)

eWeek covers the first beta release of Novell's Open Enterprise Server. "Novell Inc. gave its NetWare and Linux users a Christmas present by releasing the first public beta of Novell Open Enterprise Server over the holiday weekend. OES is Novell's dual operating system, NetWare services platform. It can run on top of either SLES (SuSE Linux Enterprise Server) 9.2 or the NetWare 7.0 kernel or both. "We're not dropping NetWare; we are adding Linux," explained Jack Messman, Novell's chairman and CEO."

Comments (4 posted)

Red Hat pulls out a profit (News.com)

News.com covers the latest financial report from Red Hat. "Linux seller Red Hat reported on Wednesday that its third-quarter net income jumped 155 percent year-over-year to $10.8 million as its software business matured. That income meant the company earned 6 cents per share for the fiscal third quarter ended Nov. 30, matching the average expectations of analysts surveyed by Thomson First Call. Red Hat also announced quarterly revenue of $50.9 million, an increase of 55 percent over the same period last year, but less than the $51.8 million analysts expected."

Comments (1 posted)

Business

Open Source Wall Street

The Decatur Jones Open Source Wall Street newsletter for January 3 is out; it's available in PDF format. "As Linux continues to gain market share, we expect to see Novell (NOVL: Outperform) and Red Hat (RHAT: Outperform) to stand out, Citrix (CTXS: Outperform) to grow steadily, and SCO Group (SCOX: Market perform) and Sun Microsystems (SUNW: Market perform) to stagnate or falter."

Comments (2 posted)

Linux Adoption

Before the storm (O'ReillyNet)

Jono Bacon begins a series of articles on open source advocacy, on O'ReillyNet. "In recent years, Open Source has become a relevant and strangely addictive force in IT. As the Internet age has dominated businesses and consumers with the same well oiled, yet clunky machine, Open Source has crept out of the dimly lit bedrooms occupied by toiling hackers and into the network rooms and 'enterprise centric strategies' of todays businesses. Open Source has not just become more acceptable, it has become more relevant."

Comments (2 posted)

Venezuela opts for Linux (ZDNet)

ZDNet reports that the Venezuelan government will switch to Linux. "Over the next three months the Ministry of Science and Technology will prepare a plan of how all ministries will migrate to open source software, according to a report by online news service Venezuelanalysis.com. It reported that these plans will then be implemented over the following 24 months."

Comments (none posted)

Legal

Sprucing up open source's GPL foundation (ZDNet)

ZDNet has posted a lengthy article speculating on future changes to the GPL. "The patent problems boil down to two issues. First, should the license explicitly require those who distribute GPL software to grant others unhindered use of whatever patented technology is involved in that software? And second, should there be some form of punishment for those who file lawsuits alleging that GPL software infringes their patents?"

Comments (none posted)

Dutch govt ends exclusive MS upgrade talks (Register)

The register covers a policy flip-flop by the Dutch government concerning software upgrades on its 260,000 Microsoft-based computers. "Despite a unanimous vote by the Dutch parliament in 2002 to adopt open standards and open source software, Microsoft recently opened exclusive negotiations with the Dutch government regarding a major software upgrade. After Dutch IT weekly newspaper Automatisering Gids leaked details about the €157m ($210m) deal, Dutch MPs demanded an explanation as to why there hadn't been a mandatory public bid."

Comments (1 posted)

Plugging the Knowledge Gaps on FOSS Licenses (Groklaw)

Groklaw answers some recent attacks on free software licenses. "The bottom line is always the same: If you steal someone's code, there will be consequences. That's true for the GPL (if you distribute the code -- you are free always to use any GPL code in-house without any consequences at all), but it's not unique to it. If you steal Microsoft's code, there are consequences also. You do have to respect other people's intellectual property rights, as lawyers call them. That's true for all licensed code, including the GPL."

Comments (14 posted)

Interviews

Freedom, Innovation, and Convenience: The RMS Interview (O'ReillyNet)

O'ReillyNet has published a lengthy interview with Richard Stallman. "Porting free applications to nonfree operating systems is often useful. This allows users of those operating systems to try out using a few free programs and see that they can be good to use, that free software won't bite them. This can help people overcome worries about trying a free operating system such as GNU/Linux. Many users really do follow this path."

Comments (49 posted)

Interview with Richard Thieme (Linux Journal)

Linux Journal interviews Richard Thieme. "In the field of information security, there are many useful occupations: firewall engineer, policy analyst, auditor and security architect all are popular choices. But what about information technology philosopher? There's plenty of value in describing the intersections between technology and the human experience, but I know of only one person who makes a living doing so--Richard Thieme."

Comments (none posted)

Interview with PlaySMS project owner Anton Raharja (NewsForge)

NewsForge looks at the PlaySMS Mobile Portal System project. "The PlaySMS Mobile Portal System project aims to have a major role in the mobile applications area. Anton Raharja, the Indonesian project owner of PlaySMS MPS, has linked up with open source developers in the Philippines, the "mobile messaging/SMS capital of the world." Over 10% of the total SMS messages processed in the world, averaging 200 million messages on any given day, come from the island nation. Many mobile applications are already in use in the Philippines before other countries start experimenting with them."

Comments (none posted)

Understanding NetBSD 2.0's new technology (NewsForge)

NewsForge talks with the NetBSD hackers about new features in the 2.0 release. "Scheduler activations are a mechanism invented by Thomas Anderson in a 1992 paper, which provides an interface between an operating system kernel and an application for maintaining a desired level of concurrency. In this system, the application informs the kernel how much concurrency it has, e.g. how many simultaneously computing threads it will use, and the kernel maintains a certain number of 'activations,' or scheduleable entities, on which the library layers application computation."

Comments (1 posted)

Resources

An Invitation to SETL (Linux Journal)

Linux Journal looks at SETL, a programming language modeled on set theory. "The aim of this article is not to offer a thorough discussion of SETL internals or a comparisons with other languages. Rather it intends to show the strong points of SETL by using elementary examples to convince you of how useful it can be in the right setting. For example, SETL appears to be one of the most suitable environments in which to make Set Theory calculations on a PC. As most problems may be formulated using the sets formalism, SETL is a good choice for all those times when compactness and elegance are more relevant than speed or memory consumption."

Comments (3 posted)

Clever Tricks with MythTV (O'ReillyNet)

Here's an O'ReillyNet article on building a video recorder with MythTV. "The general advice is not to buy a TV card with its own remote. Apparently, this almost guarantees that you'll have difficulty making it work. The best way is to use an IRda keyboard and a programmable remote control that operates on a variety of frequencies. You train the remote from the keyboard, which will be useful also for web browsing or other activities you might consider later."

Comments (14 posted)

Cooking with Linux, Part 2 (O'ReillyNet)

O'Reilly has published part two of the Cooking with Linux series. "In the second part of this two-part series, Carla Schroder, author of Linux Cookbook, offers two more recipes, including tips on running different window managers simultaneously with Xnest and hosting multiple domains with Apache."

Comments (none posted)

Ten Tips for Building Your First High-Performance Cluster (O'ReillyNet)

O'ReillyNet offers some advice to anybody considering building a Linux cluster. "Using the same hardware for each machine in the cluster will simplify installing and configuring your clusters, since you'll be able to use identical system images on each machine. It will simplify maintaining your cluster since, all of the systems have the same basic configuration. You'll need to stock fewer spare parts and will be able to swap systems in and out of your cluster as needed. But the really big savings will come when you program your cluster; you won't have to code for differences in performance among machines."

Comments (1 posted)

Migrating from x86 to PowerPC (developerWorks)

developerWorks introduces a new series on embedded Linux systems on the PowerPC architecture. "In the process, I'll also provide sample implementations showing some general techniques of interest in networked embedded appliances. The end result will be that you'll turn a bare-bones networked storage appliance into something that could be the core of a simple autonomous vehicle controller, with basic actuator controls, sensors, and rudimentary machine vision capabilities. Because most people probably don't need to build robot submarines (as much as most of us would like to), this article also explains how to design and implement web-based administration interfaces and other topics of wider applicability."

Comments (none posted)

Reviews

FIC unveils Linux-based portable media player (LinuxDevices)

LinuxDevices takes a look at a Linux-based portable media player from Taiwanese motherboard maker FIC. "The Vassili includes a built-in 20GB hard drive and large, 3.6-inch color LCD display. It also includes TV- and audio-out ports, a built-in speaker, a USB 2.0 device interface, a USB host interface, and a 10/100 Ethernet LAN port. An included docking station supports s-video."

Comments (4 posted)

Securing your workstation with Firestarter (NewsForge)

Here's a NewsForge review of Firestarter. "Firestarter is a GPL-licensed graphical firewall configuration program for iptables, the powerful firewall included in Linux kernels 2.4 and 2.6. Firestarter supports network address translation for sharing an Internet connection among multiple computers, and port forwarding for redirecting traffic to an internal workstation. Firestarter's clean and easy to use graphical user interface takes the time out of setting up a custom firewall."

Comments (6 posted)

Useful Things You Can Do with FVWM (Linux Journal)

Linux Journal examines some features of FVWM. "FVWM is a window manager used with the X Window System, which is the standard GUI for UNIX. This article explains a few useful things you can do with FVWM, including how to take screenshots conveniently, how to easily change a window's title and how to reconfigure easily a running FVWM instance."

Comments (none posted)

Introduction to Inkscape 0.4 (NewsForge)

NewsForge reviews Inkscape 0.4. "Inkscape 0.4 is considerably faster than its predecessors, and it seems to be a bit less memory-intensive. So far, this version has been more stable than the previous version. In all the time I have spent with this Inkscape 0.4, it has crashed only once, and that was while creating a new layer. It is certainly stable enough for regular use in a production environment, but users should save often just in case."

Comments (none posted)

Using the Gyration Media Center Remote with Linux (Technocrat.net)

Bruce Perens tries out the Gyration Media Center Remote with Linux, on Technocrat.net. "The Gyration Media Center Remote is a radio keyboard and mouse with 100-foot range. The mouse uses an accelerometer rather than a mouse wheel, and thus has the unique feature that you can make mouse gestures in the air. The mouse should be perfect for a public speaker who wants to move around during a speech, without giving up control of his laptop. It would also make a nifty remote for a Linux PVR user, since it has VCR controls and channel and volume buttons. But does it work with Linux?"

Comments (none posted)

Miscellaneous

Mozilla's Lightning to strike Outlook? (News.com)

Microsoft Outlook may face some new competition from the Mozilla Lightning project, according to this article on News.com. "The new project, code-named Lightning, aims to integrate Mozilla's calendar application, Sunbird, with its recently released Thunderbird e-mail application. That integration is aimed right at the heart of Microsoft's widely used Outlook software."

Comments (11 posted)

The Linux Year (PCPro)

PCPro takes a look at Linux in 2004 with a few predictions for 2005. " The year of the penguin, some people hailed 2004 at the turn of the year. And in many ways it was. Was it because the march on the server space continued at a relentless pace? Because there were big announcements around desktop installments? Because there was finally some realistic perspective about the threat from SCO, or the threat to Microsoft? However you look at it, the penguin's tux has never looked more pristine or ready for business. So here we'll take a stroll though the last 12 months that sharpened the creases and quickened the pace of the Linux-based platforms."

Comments (none posted)

Looking back at 2004 (ars technica)

The ars technica year-end edition looks back at a year of Linux, and offers various awards. "So much has been said about Ubuntu that it should be apparently that it's something special. By attempting to create a single distribution with a tweaked desktop, Project Utopia, and a multicultural approach, Ubuntu has come close to being the Holy Grail of Linux for many of us." LWN is their "online publication of the year." (Thanks to "TomS").

Comments (7 posted)

2005 outlook: Desktops to see Linux, search war and more spyware (Search Networking)

SearchNetworking.com has a few predictions for 2005. "Two years ago, I said that Linux on the desktop was a nonstarter, but a lot has happened since then. The popular Firefox browser started the ball rolling in 2004. Now, in 2005, several vendors release desktop environments that mimic the Windows interface, establishing Linux as a low-cost alternative to Windows. The trend builds slowly, but the adoption of Linux as the desktop standard by a major U.S. government agency juices the trend. By year's end, Linux approaches 10% market share of new desktop operating system sales. Microsoft isn't exactly under siege, but the lights start burning late in Redmond."

Comments (1 posted)

Asian Linux distro is ahead of schedule (ZDNet UK)

ZDNet UK reports that Asian software vendors are on track to release Asianux 2.0 by next July (originally not scheduled before September). "According to The Korea Herald, HaanSoft has said that by this summer it will have produced a distribution that is comparable to those of SuSE and Red Hat Linux. The newspaper also reported that the date of release was put forward because the Korean government is due to adopt a large high-school population database in the second half of 2005. This could be a "huge opportunity" to introduce open source, according to HaanSoft."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

A New Linux Business Model

Benjamin Rossen calls for a discussion on a new Linux business model. "Advantages to this business model:(1) At present people contributing to the Open Source Movement and Free Software Foundation do their work for the love of it, or for intangibles such as kudos from the community of open source colleagues, but they cannot live from their efforts. This initiative should make if possible for people who write code to live from their work. In principle, it should be possible to divide the source of Bill Gates' billions among the people who are actually doing the creative work. By commoditizing the process, as we shall be doing (and as shall happen regardless of what we do), the billions may become mere hundreds of millions; but that that should be enough for us to live from."

Comments (19 posted)

The PSF has awarded three grants

The Python Software Foundation has announced the award of three grants. Projects include Moving Jython Forward, Implementation of SNMPv3, and Software Engineering with Python for Scientists and Engineers.

Full Story (comments: none)

FSFE Letter to the WHO Director General

The Free Sofware Foundation, Europe has sent an open letter to Mr. Lee Jong-wook, Director General of the World Health Organization concerning software patents. "In fact: lawyers are generally in a better position to obtain software patents than the majority of programmers are. Each program consists of thousands of ideas -- each of them potentially subject to patent claims. Even though the European Patent Convention explicitly excludes software from being patented, so far 30,000 software patents have in fact already been granted in recent years."

Full Story (comments: none)

Commercial announcements

LPI announces IT Certification program for the Developing World

The Linux Professional Institute is collaborating with the United Nations Development Program (UNDP) and LinuxIT to provide Linux education and certification programs in the developing world. "The UNDP, together with LinuxIT, are supporting the creation of high-quality Linux courseware to be distributed freely under an open source license. Complementing this initiative, LPI is working with the UNDP to provide world-standard Linux skills certification at reduced cost in developing countries in South Asia."

Full Story (comments: none)

NTT invests $3m in Linux company (ZDNet)

ZDNet covers the investment of $3 Million by NTT DoCoMo in MontaVista Software. "Japanese mobile provider NTT DoCoMo has invested a $3m equity stake in Linux developer MontaVista Software. In a press statement, DoCoMo said it hoped the investment would allow it to improve its Linux products."

Comments (none posted)

Sub300.com Pledges to Red Cross to Help Rebuild From Tsunami Damage

Sub300.com has announced that for the next ninety days half of all proceeds from the Linux Challenge Bundle (a two CD set with Linspire 4.5, OpenOffice.org and Firefox) will go to the Red Cross with the money earmarked for aid and relief of the victims of the tsunami.

Comments (none posted)

Video of the November 24 SCO/DaimlerChrysler hearing

SCOfacts.org has posted audio and video from the November 24 hearing in the SCO v. DaimlerChrysler case - the one where SCO was denied a stay in the case. It's available on the DaimlerChrysler update page. Al Petrofsky, proprieter of scofacts.org, tells us: "If nothing else, it's of interest to people who would like to see what a SCO lawyer losing an argument looks like."

Comments (4 posted)

New Books

"Home Hacking Projects for Geeks" Released by O'Reilly

O'Reilly has published the book Home Hacking Projects for Geeks by Eric Faulkner and Tony Northrup.

Full Story (comments: none)

"Learning GNU Emacs, Third Edition" Released by O'Reilly

O'Reilly has published the book Learning GNU Emacs, Third Edition by Debra Cameron, James Elliott, Marc Loy, Eric Raymond, and Bill Rosenblatt.

Full Story (comments: none)

Prentice Hall publishes "Java Application Development on Linux"

Prentice Hall PTR has published the book Java Application Development on Linux by Carl Albing and Michael Schwarz.

Full Story (comments: none)

"Hacking a Terror Network: The Silent Threat of Covert Channels" Released by Syngress

Syngress Publishing has published the book Hacking a Terror Network: The Silent Threat of Covert Channels by Matthew Devost.

Full Story (comments: none)

Resources

Linux Client Migration Cookbook (IBM)

IBM has published a new Linux Client Migration Cookbook (in PDF format). "The goal of this IBM Redbook is to provide a technical planning reference for IT organizations large or small that are now considering a migration to Linux-based personal computers. For Linux, there is a tremendous amount of “how to” information available online that addresses specific and very technical operating system configuration issues, platform-specific installation methods, user interface customizations, etc. This book includes some technical “how to” as well, but the overall focus of the content in this book is to walk the reader through some of the important considerations and planning issues you could encounter during a migration project. Within the context of a pre-existing Microsoft Windows-based environment, we attempt to present a more holistic, end-to-end view of the technical challenges and methods necessary to complete a successful migration to Linux-based clients." Thanks to Steve Head.

Comments (none posted)

The LDP Weekly News

The December 29, 2004 edition of the Linux Documentation Project Weekly News is available, take a look for the latest documentation updates.

Full Story (comments: none)

The LDP Weekly News

The January 5, 2005 edition of the Linux Documentation Project Weekly News is out with the latest new documentation.

Full Story (comments: none)

Linux Gazette #110

The January 2005 edition of the Linux Gazette is out. Articles in this edition include; Free as in Freedom: Part One: GNU/Linux, by Adam Engel, ParallelKnoppix, by hameed, A Knight's Tour on OCaml (when a Python fails to digest it), by Kapil Hari Paranjape, Preparing For My Interviews Part 2: MySQL and Python, by Mark Nielsen, Flickr and Perl, by Jimmy O'Regan, Bash Shell and Beyond, by William Park, and more.

Comments (4 posted)

Contests and Awards

Voting Opened for the 2004 LinuxQuestions.org Members Choice Awards

Voting is open for the 2004 LinuxQuestions.org Members Choice Awards. "Awards will be given out in 24 categories, including Distribution of the Year, Browser of the Year, Multimedia App of the Year, Office Suite of the Year and Security App of the Year. The polls will close on February 3rd and winners will be able to pick up their awards in Boston at the LinuxQuestions.org LinuxWorld Expo booth."

Full Story (comments: none)

Upcoming Events

The OSDL Enterprise Linux Summit

Open Source Development Labs (OSDL) has announced the companies that will be exhibiting at the OSDL Enterprise Linux Summit. "The Open Source Development Labs, a global consortium dedicated to accelerating the adoption of Linux in the enterprise, today announced the addition of AMD, CA and Red Hat, Inc., among others, to the lineup of exhibits at OSDL's Enterprise Linux Summit. Aduva, Barracuda Networks, Black Duck Software, DigitalGuru Computer Bookshops, Eclipse Foundation, Gelato, Levanta, Open Country, OverNite Software and RLX Technologies are also exhibiting. OSDL's Enterprise Linux Summit will take place January 31 - February 2, 2005 in Burlingame, CA."

Comments (none posted)

Registrations open for linux.conf.au 2005

Registrations for Linux.conf.au (Canberra, April 18 to 23) are now open. The list of speakers has also been posted; it looks like another great event.

Full Story (comments: none)

linux.conf.au Audio Miniconf CFP

A Linux Audio Miniconf will be held at the 2005 linux.conf.au in Canberra, Australia during April, 2005. Papers should be submitted by February 20.

Full Story (comments: none)

LCA 2005 OpenOffice.org Miniconf - Call For Participation

A call for participation has gone out for the first OpenOffice.org Miniconf, the event will be part of the LCA 2005 conference in Canberra, Australia on April 19-20, 2005. "Presentations will be given over the two days and will take on two major themes for the conference – User and Community, and Development. Any topic is allowed based around OpenOffice.org, the cross-platform office productivity suite."

Full Story (comments: none)

CFP: samba eXPerience 2005

A call for papers has gone out for the fourth international SAMBA conference. The event will be held in Göttingen, Germany on May 2-4, 2005, papers should be in by March 14.

Full Story (comments: none)

UK Python Conference 2005 CFP

The final call for papers has gone out for the 2005 UK Python Conference. The event will take place in Oxford, England on April 20-23, 2005. Papers are due by January 6.

Comments (none posted)

PyCon 2005: Third Annual Python Developers Conference

PyCon 2005, the third annual Python developers' conference, will be held at George Washington University's Cafritz Conference Center in Washington DC on March 23-25, 2005. The keynote speaker will be Jim Hugunin, author of IronPython. IronPython is a new implementation of the Python programming language for the Microsoft .NET and open-source Mono platforms.

Full Story (comments: 1)

ICMC 2005 Update

An information update is available for the 2005 International Computer Music conference. The event will take place on September 5-9, 2005 in Barcelona, Spain.

Full Story (comments: none)

YAPC::EU::2005 Call for Papers (use Perl)

Use Perl has a Call for Papers for the YAPC::EU::2005 conference. The event will take place in Braga, Portugal from 31 August to 2 September, 2005.

Comments (none posted)

Events: January 6 - March 3, 2005

Date Event Location
January 14, 2005PHP West Web Services conference(HR MacMillan Space Centre)Vancouver, BC, Canada
January 28 - February 4, 2005Asia Source(Visthar training venue)Bangalore, India
January 31 - February 2, 2005OSDL Enterprise Linux Summit(Hyatt Hotel)Burlingame, California
February 2 - 3, 2005Solutions Linux 2004(CNIT, Paris la Défense)Paris, France
February 7 - 11, 2005GlobusWORLD(Sheraton Boston Hotel)Boston, MA
February 9 - 11, 2005German Perl-Workshop 2005Dresden, Germany
February 9 - 11, 2005Third-Annual Desktop Linux Summit(Del Mar Fairgrounds)San Diego, CA
February 9, 2005OOo RegiCon North America(Del Mar Fairgrounds)San Diego, CA
February 11 - 13, 2005CodeCon 2005San Francisco, CA
February 12 - 13, 2005Southern California Linux Expo 2005(SCALE)(Los Angeles Convention Center)Los Angeles, CA
February 14 - 17, 2005Linux World Conference and Expo(Hynes Convention Center)Boston, MA
February 24 - 25, 2005UKUUG LISA/Winter ConferenceBirmingham, UK
February 25, 2005Dutch Perl WorkshopAmsterdam, the Netherlands
February 26 - 27, 2005Free and Open Source Developers' European Meeting(FOSDEM 2005)Brussels, Belgium
February 28 - March 3, 2005EclipseCon 2005(Hyatt Regency)Burlingame, CA
March 1 - 2, 2005JBoss World 2005 User Conference(Omni/CNN Center)Atlanta, GA
March 2 - 4, 2005Security-Enhanced Linux SymposiumSilver Spring, Maryland

Comments (none posted)

Web sites

New Sound and MIDI Software For Linux musings

Dave Philips has updated his Linux audio musings column for November/December 2004. Read about the latest new Linux audio software releases, upcoming conferences, and more.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Blessing and cursing

From:  Leon Brooks <leon-olc-AT-cyberknights.com.au>
To:  Robert Weisman <weisman-AT-globe.com>, Herald Tribune Letters <letters-AT-iht.com>
Subject:  Blessing and cursing
Date:  Wed, 29 Dec 2004 08:39:34 +0800
Cc:  Linux Weekly News <letters-AT-lwn.net>

Good morning (well, it's morning here), Mr Weisman;
 
WRT http://www.iht.com/articles/2004/12/28/business/code.html -
> The improper use of open-source components, in the worst-case
> scenario, could subject companies to costly litigation from
> parties like SCO Group of Lindon, Utah.
 
I very much hope so. The more of these idiots that get spectacularly shot down
like TSG is, the fewer fellow idiots are going to try barratry as a career
path.
 
However, doing business today in any form exposes you to an ever-increasing
risk of suit. Open Source has nothing to do with the problem. Your article is
trying to draw a connection which does not exist.
 
> SCO says it owns intellectual property in the Linux open-source
> operating system
 
No they don't. Not in court, at least.
 
"Intellectual Property" comes in four basic forms: Patents, Copyrights,
Trademarks and Trade Secrets.
 
None of these are at issue in TSG vs IBM.
 
The case revolves around a contract dispute, and even the bulk of the material
involved in the contract dispute turns out to have been already Opened one
way or another.
 
> Jothy Rosenberg, chief executive and chief technical officer of
> Service Integrity,
 
Quoting an officer of a company with an immediate vested interest in the kind
of uncertainty generated by your article is hardly clever, to say nothing of
what it does to the authority of the quote.
 
> who this month ordered a 24-hour scanning of his company's Sift 3.5
> software during a "code freeze" before its introduction.
 
> "In this day and age, anybody building a commercial piece of software
> has got to do this. It's like buying insurance on your building."
 
It also has nothing substantial to do with Open Source.
 
If anything, Open Source makes Rosenberg's job much easier. Can you imagine
the fun and games involved in getting hold of a copy of (say) MS-Office's
source code so you can scan your software against it for copyright clashes?
 
> anyone who acquires and modifies open-source code must make their
> modified versions freely available to the public. Depending on how
> many files of code are covered and what is in them, such a
> requirement can sometimes be a major impediment for a proprietary
> software company.
 
Robert, this issue has long been dead and buried. It's hardly credible that
anyone writing with authority in any IT field can now claim to be ignorant of
this.
 
If you don't like the GPL, simply eschew the head-start gained by basing your
own code on it. Don't use it. Write your own code! Nobody's putting a gun to
your temple and forcing you to use anyone else's code, now, are they?
 
And again: can you imagine the trauma and hullabaloo which would ensue if you
based an application on the source code for Adobe Illustrator?
 
In every way, Open Source software gives you the advantages, the safety and
the choices and yet you're presenting it here as if it's a bad thing.
 
If Open Source software is the big risk-and-expense that you claim, then why
are these companies so eager to use it in the first place?
 
> Among the scariest aspects of the problem is that many business
> executives do not know whether open-source code is in their
> software, or they mistakenly presume that they have none. Either
> way, they could be setting themselves up for a lawsuit.
 
Two things to note here are that (1) if their control of their own product is
so pathetic, they really do deserve to go to the wall; and (2) if they steal
someone else's code, Open or closed, then they really do deserve to go to the
wall. Please let it happen soon, let natural attrition work its way so they
can be off our collective backs!
 
> Software developers working on "value-added" applications routinely
> borrow pieces of open-source code as building blocks for such
> functions as encryption, security or platform interfacing.
 
Let's have a look at those. SSL and TLS are widely used security protocols
provided by the OpenSSL library. OpenSSL uses a BSD-ish licence. All you need
to do to comply with this is include three short sentences in your product's
documentation:
 
    This product includes software developed by the OpenSSL Project for
    use in the OpenSSL Toolkit (http://www.openssl.org/). This product
    includes cryptographic software written by
    Eric Young <eay@cryptsoft.com>. This product includes software
    written by Tim Hudson <tjh@cryptsoft.com>.
 
Having done this, you can modify and derive OpenSSL to your heart's content.
It's not like an entire encryption layer is going to magically appear
unnoticed in your product, so if this bites you on the butt, you get bitten
for gross stupidity, not for using Open Source. Once again, contrast the
consequences with what would happen if you sliced a TLS layer out of
MS-Windows 2000 and used that instead.
 
Now a typical GPL example: Samba. The first question to ask is since this is a
complete CIFS implementation, independently functional, why would you want to
modify it? If you don't modify it, you don't need to release any source.
 
For the case where it is indeed tempting to borrow and expand a Samba
component, say you wanted to modify the "smbtorture" diagnostic tool to do
something hinky with the CIFS protocol so you can use it for your own private
authentication scheme, there are two major cases:
 
 1. What you want to do is trivial, in which case either just release
    the modified code or write it from scratch yourself (as you would
    do if Samba didn't exist); or
 
 2. What you want to do is not trivial, in which case the modifications
    will be extensive: so write your own code, it won't be that much
    extra work.
 
Proprietary software companies like BabelMedia use Samba every day. It hasn't
caused them any licence problems, they haven't put any of their own software
at risk, and they haven't gone out of their way at all to achieve this.
 
City administrations are notoriously sensitive to licence issues, and yet a
major driver of the City of Bergen's move to (GPLed) Linux has been the cost
savings in using (GPLed) Samba for file-serving.
 
Even if you don't use any Samba code, you'll still be ahead of the game by
using their excellent documentation, which in many places more accurately
reflects what's happening on the wire than Microsoft's own documentation.
 
> SCO has since sued DaimlerChrysler, AutoZone and Novell
 
The DC suit has since been dismissed and the other suits made dependent on the
outcome of the IBM suit, which as I mentioned above is looking very gloomy
for TSG. All of this is a matter of public record, as accessible to IT
journalists as to anyone else.
 
When the rubble finally stops bouncing, TSG are going to be an eloquent object
lesson for anyone else selfish enough to try blackmail as a business model.
 
> Businesses fear that SCO's flurry of lawsuits may be a sign of
> trouble to come.
 
Only businesses that are silly enough to believe ill-researched (I hope, since
the alternatives are not as pleasant) articles like that one.
 
Think of it as evolution in action. By scaring these companies away from Open
Source, you are leaving their competitors a clear field in which to take
advantage of it. Eventually, the companies gullible enough to believe that
article will be crushed by the absence of that competitive advantage. In the
long term, you're doing in your own target audience!
 
> Scott Nathan, a lawyer,
 
...with a vested interest in the outcome, like all of your references so
far...
 
> said. "If SCO is successful, there are going to be copycats."
 
There's the sand in your vaseline. For TSG to be successful in any meaningful
way, they'd have to first prove ownership of some significant piece of Linux,
then prove that they suffered damage by its inclusion, then identify the
person responsible for its inclusion and sue _them_ for the damages, rather
than some random corporation among the thousands using Linux.
 
And by the time they got that far, any offending code would be ripped and
replaced fast enough to create a sonic boom. There would be no ongoing
damages.
 
So far, they're not up to Step One.
 
Every time TSG tried to increase their ownership claims, they wound up in a
poorer position, and with more of the evidence involved now a part of the
public record. Amongst other things, a lot of the mystery surrounding the
original BSD court case has been cleared up, and evidence clearly pointing
out that Novell still own the copyrights etc on that disputed code has been
turned up. Read all about it from the original court documents here:
 
    http://www.groklaw.net/
 
    http://scofacts.org/
 
> "[...] you might be seen as a deep pocket" by litigious SCO copycats,
> said Thomas Carey, an attorney
 
Vested interest again? Goodness me, do you have _any_ independent opinions?
When have you _ever_ seen a lawyer give a non-fear-based non-worst-case
answer to a journalist?
 
> "If we violated something and get sued, their investments would
> vaporize like that," Rosenberg, the chief of Service Integrity, said.
 
I should hope so. Venture capital _should_ vanish in the face of gross
negligence.
 
Even so, and speaking of gross negligence, there are several remedies to
pursue with an Open Source inclusion, and your article hasn't even hinted
that any of them might exist.
 
Unlike the Microsofts and Adobes of the world, very few Open Source providers
are highly litigious. This means that if _someone_else_ discovers Open Source
code buried in your software, the usual remedy is to simply replace it.
 
The exact case you're waving about portentously has actually happened many
times already, but you again don't even hint that this might be so. Was this
gross carelessness again, or is there an agenda tucked away in there?
 
LinkSys were discovered to be running a modified version of Linux on some of
their routers. The remedy so far employed has been the publication of the
sources to the modified software, but not to the "secret sauce" network
interface driver. Open Source RTL8xxx drivers were subsequently written by
others.
 
The LinkSys WRT54G and related routers have since seen an increasing amount of
use as a cheap and readily available embedded platform, and LinkSys are
selling more of them as a result of having released their modifications as
they originally should have.
 
They've also skipped the royalties other embedded systems would have required,
and the expense and lead time of writing it all themselves from scratch.
 
In another example, Minitar were found to be using modified Linux in their
routers without releasing source, and the solution in this case was to
convince the network card manufacturer to Open their drivers, so the entire
codebase for the router could be released.
 
Again, Minitar are selling more gear through having Opened their code than
they would be if they hadn't, so again the solution has been beneficial all
round.
 
These two examples are reasonably representative. If you had the best
interests of your readers at heart, you would have encouraged them to find
out more and ride the Open Source bandwagon for all it's worth instead of
spreading TSG's fear-and-doubt propaganda.
 
Unlike traditional business where each participant fights for the biggest
share of a fixed-size pie, Open Source is all about making the whole pie
bigger.
 
Please get it right next time, if there is a next time.
 
Cheers; Leon
 
--
http://cyberknights.com.au/ Modern tools; traditional dedication
http://plug.linux.org.au/ Vice President, Perth Linux User Group
http://osia.net.au/ Member, Open Source Industry Australia
http://slpwa.asn.au/ Member, Linux Professionals WA
http://linux.org.au/ Member, Linux Australia

Comments (8 posted)

My open letter to Wlodzimierz Marcinski

From:  Mikko Rauhala <mjrauhal-AT-cs.helsinki.fi>
To:  lwn-AT-lwn.net
Subject:  My open letter to Wlodzimierz Marcinski
Date:  Thu, 23 Dec 2004 17:37:56 +0200

 
Preface: This is an open letter from Mikko Rauhala of the Department
of Computer Science of the University of Helsinki to Undersecretary
Wlodzimierz Marcinski of Poland. Reproduction and publication are
permitted and encouraged as long as the text is unmodified. The
author would be glad to be notified of such publications via
E-mail to mjrauhal@cs.helsinki.fi, but this is not required.
 
 
        Dear Undersecretary Wlodzimierz Marcinski,
 
I was positively elated to hear about you standing up to the pressures
of certain other parties in the EU Council of Ministers and getting
the Software Patent Directive in its current form off of the Agenda
of the Council of Agriculture and Fisheries. The citizens of EU owe you
a debt of gratitude for this upstanding act of defending democracy,
innovation and competition within the Union.
 
I am sure you are more informed than myself about the backhanded
dealings within the Council to completely disregard the Parliament's
view on software idea patents in their so-called compromise text.
You can also probably well imagine the dealings that have led to
some parties' insistence on wider patentability. Nevertheless, in the
hope that it might prove somehow useful, I would like to offer my
admittedly limited insight on how things seem to have progressed here
in Finland, if even just to affirm what you might already reasonably
suspect.
 
In the autumn of 2003 there was a hearing on the Parliament's version
of the directive text here in Helsinki. Among others, the Department
of Computer Science of the University of Helsinki was invited. I had
already been working there for a couple of years, and the department
head appointed me as our official representative at the hearing. Also,
as it happens, Electronic Frontier Finland¹, which concentrates on
defending civil and consumer rights in the digital age, did not
receive a timely invitation to the hearing. Luckily, I happened to be
on the board of EFFI at the time, and was recognized as representing
them also.
 
With the notable exception of Finland's Parliament member Jyrki Kasvi,
who had come to the hearing uninvited, there were no other opponents
of software idea patents present, and neither were there any other
representatives of the scientific community. In fact, mostly the
participants seemed to be composed of three interest groups: big
business (as represented by Nokia), lawyers and the National Board of
Patents and Registration of Finland. In other words, these were people
who were standing to gain personally from wide patentability of
software ideas: Nokia could better strong-arm smaller competitors into
submission, patent lawyers would become indispensable for everyone
wishing to write and market software, and the patent office wouldn't
have to worry about losing work or funding any time soon.
 
Even though software idea patent proponents tend to talk about
such high ideals as promoting the progress of science and useful
arts, it comes as no big surprise that the actual opinion of the
part of the scientific community I was representing didn't carry
much weight in the proceedings, and that the civil rights issues²
were likewise dismissed altogether. It was also widely argued that the
EU Parliament's directive text was too unclear on what was patentable.
Curiously, the correct remedy seemed always to be to clearly allow
wide patentability of software ideas. On the whole, I would summarize
the hearing as the aforementioned parties asking for our government
to please make others give them more money (albeit not in such a
straightforward manner). The government apparently thought this
to be a reasonable suggestion.
 
Thus it came to pass that Finland supported walking over the EU
Parliament and sacrificing the interests of both private individuals
and small and medium-sized enterprises in favor of lawyers and
aspiring monopolists. Sadly, not many have had the courage to oppose
this practice of perverting supposedly democratic processes into
something better described as plutocracy.
 
I know that this particular fight is not over yet, and that there are
many other issues where the interests of the rich and the powerful are
likely to take precedence also in the minds of many a politician.
However, Poland's example gives me some hope in a democratic Europe
once more. Hopefully it will also inspire others, especially the EU
newcomers, to take a similar stand as equal members of the Union
and not be intimidated into compliance by entrenched political powers.
 
 
        Yours Truly,
        Mikko Rauhala
 
¹ See <URL: http://www.effi.org/index.en.html >. EFFI is also a
  founding member of European Digital Rights (EDRi), see
  <URL: http://www.edri.org/ >.
 
² I do consider it a civil rights issue when the rights of
  individuals to write original software and earn a living off of
  their work is threatened by monopolizing programming practices.
  Strangely enough, some do not.
 
 
--
Mikko Rauhala <mjrauhal@cs.helsinki.fi>
University of Helsinki

Comments (none posted)

Page editor: Jonathan Corbet

Copyright © 2005, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds