LWN.net Logo

LWN.net Weekly Edition for January 27, 2005

Sun makes its move

Sometimes it seems that Sun has been talking about releasing the Solaris code for years. Actually, Sun has been talking about releasing Solaris for years; see this LWN article from 1999 on the subject. On January 25, however, the company actually did something about it. The DTrace code from Solaris is available now, and the full Solaris kernel is set to become available sometime in the second quarter of 2005. There is, of course, a hype-filled press release celebrating the event.

The release appears to be real. A fully buildable system will be made available under Sun's recently OSI-approved Common Development and Distribution License (CDDL). Sun does not appear to be holding back any core components of the kernel. All of the Solaris 10 features they have been trumpeting - ZFS, DTrace, containers, etc. - will be included. It would seem that Sun is releasing a system that people might actually want to run.

The other half of the day's festivities was this announcement that Sun is releasing 1600 software patents for use with CDDL-licensed software:

By giving open source developers free access to Sun(TM) OpenSolaris related patents under the Common Development and Distribution License (CDDL), the company is fostering open innovation and establishing a leadership role in the framework of a patent commons that will be recognized across the globe.

The announcement is rather short on details - things like which patents are being released, and under which terms. Nowhere does Sun say explicitly that only CDDL-licensed software will be licensed to use those patents, but the early indications are that the company does intend to limit things in that way. An attempt by LWN to get a clarification from Sun on this point was not successful.

Sun has repeatedly said that it hopes to build a wider development community around the OpenSolaris release. Once again, however, the details are yet to be filled in. There will apparently be a "community advisory board" with five members, three of whom will be directly chosen by Sun. There is no word on what the patch acceptance process will be. The OpenOffice.org process tends toward being bureaucratic and hard to approach; the OpenSolaris process seems likely to be similar.

Sun has tried to fend off claims that this release is a competitive response to Linux, but that is clearly what is going on. The company appears to be trying to set up a parallel free software ecosystem which, it hopes, will be more attractive than Linux. The components of this strategy are becoming clear.

For example, Sun has repeatedly gone out of its way to push the claim that Solaris is better than Linux - or anything else, for that matter. The various features of Solaris 10 were hyped yet again at the OpenSolaris teleconference; the company described them, with a straight face, as "rocket science." The message is clear: why bother with Linux, when the best is free too?

Then, Sun is stressing its free software credentials. At the teleconference, Sun executives claimed that the company had been doing open source for more than 24 years. Sun is now, they say, the number-one source of free code on the planet. Why bother with those other, johnny-come-lately companies when Sun has been doing this for so long? At the teleconference, the claim was made that HP and Dell have not contributed to Linux - which is clearly untrue.

There is also the indemnification issue, needless to say; indemnification was mentioned many times at the teleconference. The patent press release states:

Radically reducing risks associated with using and developing open source software, Sun is firmly standing behind our products and the worldwide development community. Armed with access to Solaris OS platform intellectual property, OpenSolaris developers and customers alike no longer need patent protection or indemnity from Sun's and other participants in the OpenSolaris community for use of Solaris-based technologies under the CDDL and OpenSolaris community process.

There is an obvious attempt here to position Solaris as a safer sort of free operating system - one with "radically reduced risks." It may be true that OpenSolaris users are less likely to be sued - by Sun itself, at least. The CDDL will also make suits by any other company which uses OpenSolaris unlikely. None of this will help against suits from litigation companies with no software business of their own, however.

Speaking of litigation companies, the SCO Group has not yet given its thoughts on the OpenSolaris announcement. Sun executives claimed at the teleconference that the company's Unix licenses allowed it to release the code with no need to consult further with SCO. We asked SCO if it agreed, but got no response.

The last piece of the puzzle is the CDDL, which serves to effectively isolate the Solaris and Linux kernels from each other. Solaris will live in its own world; any useful code it contains cannot be copied over to Linux, or to any of the BSD variants. You can play with Sun's nice toys, but you have to stay on Sun's turf.

All of this might just work. There are good things in OpenSolaris, and the code will soon be truly free. But it takes more than a code dump to create a development community. Whether Sun can create enough outside interest to inspire a wider group of developers to help out remains to be seen - as will Sun's ability to let go and let that community actually run with the code. Sun will not have gained much if the outside developers end up creating their own OpenSolaris fork.

Comments (22 posted)

PostgreSQL 8.0.0

January 26, 2005

This article was contributed by Joe 'Zonker' Brockmeier.

It's been in the works for quite a while, but PostgreSQL 8.0 is finally out the door. To get the full scoop on 8.0, we spoke to Josh Berkus, one of the members of PostgreSQL's steering committee, to learn about PostgreSQL's new features and plans for future development.

The PostgreSQL press release highlights a number of new features and improvements, including improved memory usage and I/O improvements. We asked Berkus if the PostgreSQL team had any benchmarks to share with regards to these improvements. Berkus said that the project did not have benchmarks yet, and that the team had been tinkering with performance "right up to the release candidate." Berkus did elaborate on the nature of improvements, however.

The basic idea was to make PostgreSQL a little bit smarter about managing its own cache and its own memory usage. A lot of that effort was spearheaded by Jan Wieck, who works for Afilias... their big interest in improving memory usage was really to flatten out spikes. One of the tests at the Open Source Development Labs of online transaction processing where you see that your peak rates of transaction processing is like 4,000 or 4,800 transactions per minute, but then you have these checkpoint spikes while the system is doing memory synchronization and the like, suddenly your throughput rate drops by like 1,000 transactions per minute.... from the perspective of people supporting interactive Web applications, this is particularly bad because the customer suddenly sees a 30-second lag where nothing's happening. A lot of the changes were designed to alleviate that condition.

Berkus noted that the average transaction time for Web applications may not go down a great deal, but that the median transaction time did go down. He also said that several developers working on performance tweaks were pushing for a short development cycle for PostgreSQL 8.1 because they're "not necessarily satisfied that they're done." Berkus also pointed out that they would probably never be done improving performance.

Other performance improvements include changes to maintenance routines to avoid saturating disk I/O. Berkus said that some maintenance routines may take longer, but would have less of an impact on system performance while running.

The Savepoint feature has changed as well, according to Berkus. Savepoints allow parts of a transaction to be rolled back without failing an entire transaction if part of the procedure fails. Berkus said that savepoints were initially "implemented as nested transactions" but that the syntax for Savepoints is now SQL-compliant.

Inevitably, PostgreSQL will be compared to "enterprise" databases like DB2 and Oracle. We asked Berkus how PostgreSQL would compare to products like Oracle and DB2 given the features that were introduced in 8.0. He said that there were "still plenty of high-end features that they have that we don't have yet though each new release of PostgreSQL adds features that make it "adequate or even superior" for new users. One feature that PostgreSQL still needs, said Berkus, is multi-master replication. Right now, there are three separate teams working on two different forms of multi-master replication, which should be ready within "a year or a half, if not sooner."

Berkus said that the PostgreSQL project planned to keep replication facilities, such as Mammoth and Slony, as add-ons rather than part of PostgreSQL. The reason, according to Berkus, is that replication "is not a single problem... it's a set of related problems not all of which should be solved by the same software."

Another feature in 8.0, which may be of little interest to LWN readers, is the native version of PostgreSQL for Windows. Berkus said that the Windows release looked to be very popular, judging by early downloads of the release. We did ask how the performance of PostgreSQL on Windows compared to performance on Linux or other UNIX-type systems. Berkus said that they didn't know, since most of the PostgreSQL testing is done through the Open Source Development Labs, which means that testing is limited to Linux systems. He did say that he expected that performance on Windows would lag behind Linux, since PostgreSQL is primarily developed on Unix and POSIX systems.

What will we see in 8.1? It's too early to tell, but Berkus did mention a few projects that he's aware of that might be in the works. One issue that he mentioned is the idea of per-user quotas for PostgreSQL.

Somebody's revived the issue of per-user quotas. People are interested in it, but the people who are interested don't seem to have the coding talent to implement it... you don't know how much space something is taking up without calling a maintenance procedure, so it's a very hard problem to solve. It's much harder than implementing user quotas on the filesystem.

If the 8.1 release cycle is a short cycle, Berkus says that "a lot will be deferred to 8.2 because of the requirement for catalog changes in initdb." Berkus told LWN that the changes were necessary to allow PostgreSQL to do in-place upgrades rather than requiring users to migrate data from an older PostgreSQL installation to the new installation.

Currently, the way you upgrade a major version [of PostgreSQL] is to in install the binaries to a new location, prepare the new location and then you do a backup of the old database and restore onto the new platform. There are other ways of making this easier, like using replication to move the data, but it still amounts to running two PostgreSQLs at once and moving between those two instances. If you happen to be running a data warehouse with 300 GB of data, it's quite time consuming... it's one of the things we have on our plate that nobody wants to work on.

We asked Berkus why PostgreSQL didn't use a timed release cycle, as opposed to a feature-based release cycle, like the GNOME Project does. Berkus said that "nobody's really raised that as an idea" and said that it would be difficult to do since other projects could release half-implemented features or features that were still a little buggy, but PostgreSQL could not. "For us as an enterprise database system, we can't release anything that could corrupt your data, even a little." Even if PostgreSQL were to move to a timed release cycle, Berkus said it would probably be a yearly release cycle rather than a six-month cycle like GNOME.

Current users of PostgreSQL can count on security and data integrity patches for the prior two releases (7.3 and 7.4) until the 8.1 release of PostgreSQL. Berkus added that patches may be released for 7.2 "if the patch can be released to 7.2 without extra effort." He also said that support for older versions of PostgreSQL, including backporting new features, was a role for commercial providers of PostgreSQL and could provide a value-add for vendors to provide to their customers, without making it a "headache for developers."

While PostgreSQL may not have all the features of DB2 or Oracle, the database is closing the gap between itself and proprietary "enterprise" database systems. With the 8.0 release, PostgreSQL should be able to find many more adopters in small and large organizations that are looking to replace expensive proprietary systems with an open source solution.

Comments (none posted)

A Grumpy Editor's addendum: evince

This article is part of the LWN Grumpy Editor series.
The Grumpy Editor's guide to free PDF viewers tried to assess the current state of the art in free applications which deal with PDF files. Since the publication of that article in December, a new player has shown up. Evince is a GPL-licensed GNOME viewer for a number of document formats, including PDF, PostScript, and DVI files. When evince 0.1.1 was announced, your editor decided that it was time to have a look.

Evince is built as a viewer with the ability to add backends for any file format of interest. For PDF files, the supplied backend is based on the xpdf code. The PostScript backend uses ghostscript, and the DVI backend uses a built-in DVI library. Building evince requires the GNOME 2.9 libraries, but is otherwise painless; it dropped right into place on your editor's Fedora Rawhide system.

This application is looking good - especially for a 0.1.1 release. The rendering of PDF files is fast, and the quality is good. The zoom options are rational, and it is easy to move around within the document. Printing [Evince screenshot] of PDF files works (that's one of the new features in 0.1.1). Evince can display page thumbnails in a side bar; for documents with a table of contents, that, too, can be displayed and used for navigation. Text can be selected with the mouse and pasted into other applications.

Evince offers a search capability which appears to have potential, but which needs a bit of work yet. Hitting "^F" will open a firefox-style "find" bar at the bottom of the screen (search does not appear to be available from the menus). Typing a string will highlight occurrences of that string in the text; see the screenshot for an example. There are "previous" and "next" buttons, but the only thing they do is cause "find previous" or "find next" to be printed; it's nice to know that evince is listening, but that still is probably not quite what the user had in mind. If the string does not appear on the current page, evince will note the next page where the string can be found - but the user must get to that page independently.

There are a few other glitches yet. Selecting text with the mouse can be a little unreliable; sometimes what gets pasted is not exactly the text which was selected. There are no thumbnails for PostScript documents. The buttons for paging through the document are labeled "Up" and "Down," which are not the most obvious terms. There is no way to print only part of a document. There is no man page - or other help of any sort.

All of the above notwithstanding, evince is a tool which is, even at this early point, competitive with the other free PDF viewers. It is entirely useful now. If development continues at the current pace, evince may well become your editor's viewer of choice in the near future.

Comments (13 posted)

Page editor: Jonathan Corbet

Security

Securely renting out your CPU with Linux

One might think that hacking kernels for SuSE would be enough to keep a person busy, but Andrea Arcangeli has more energy than that. So, on the side, he is working on a project called cpushare. Essentially, it is a form of Linux-based worldwide grid network which would enable people to sell their idle CPU cycles to others who are in need of serious crunching power. Most systems sit idle most of the time; they might as well be working for a living instead.

Before Linux users will accept outside code on their systems, they will need to be pretty well convinced that said code can be kept under control. Without some pretty fierce security, a grid network could quickly be turned into a serious zombie network, and that would be embarrassing for everybody involved. The long-term plan is to take advantage of "trusted computing" hardware to sandbox the guest code; that hardware will also be able to help prevent the owner of the system from interfering with (or even observing) the buyer's computations and data. For now, however, some other method of ensuring the security of the host systems will have to be devised.

Andrea's answer is the seccomp patch. It is, in fact, an exceedingly simple solution to the problem. With this patch in place, the kernel allows a process to make a one-way transition into a "secure computing" mode. A hook is placed in the system call gate which checks for this mode; when secure computing is turned on, an attempt to execute almost any system call will result in the immediate termination of the process. The only exceptions are read(), write(), exit(), and the two forms of sigreturn(). So the cpushare client would execute outside work by setting up some sockets to communicate with the master system, turning on the secure mode, and executing the client code. If all goes well, that code will be able to do nothing beyond pure CPU use and communicating through the sockets given to it. And exiting, of course.

The objection that was raised is that this sort of sandboxing can be done from user space with ptrace(). At least, it can if one little patch is applied to ensure that the sandboxed process cannot continue if, somehow, the monitoring process dies first. Andrea acknowledges that the ptrace() solution is workable, but he still prefers the secure computing mode. The reason is simplicity: the seccomp patch is quite small, and it is relatively easy to verify that it does what is needed. The ptrace() code is rather more complex and harder to verify, even before considering the interactions with the user-space monitor.

The public discussion was inconclusive, so it is hard to predict whether this patch will eventually be accepted or not.

Comments (14 posted)

Brief items

PHRACK #63 CALL FOR PAPERS

The call for papers for Phrack #63 has gone out; no specific deadline is given for submissions. The CFP states that issue #63 will be the final issue of Phrack.

Full Story (comments: 2)

New vulnerabilities

AWStats: remote code execution

Package(s):awstats CVE #(s):CAN-2005-0116 CAN-2005-0362 CAN-2005-0363
Created:January 25, 2005 Updated:February 15, 2005
Description: When 'awstats.pl' is run as a CGI script, it fails to validate specific inputs which are used in a Perl open() function call. A remote attacker could supply AWStats malicious input, potentially allowing the execution of arbitrary code with the rights of the web server.
Alerts:
Debian DSA-682-1 2005-02-15
Gentoo 200501-36:03 2005-01-25
Gentoo 200501-36 2005-01-25

Comments (1 posted)

enscript: arbitrary code execution

Package(s):enscript CVE #(s):CAN-2004-1184 CAN-2004-1185 CAN-2004-1186
Created:January 21, 2005 Updated:May 27, 2006
Description: Erik Sjölund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. Unsanitized input can cause the execution of arbitrary commands via EPSF pipe support. Due to missing sanitizing of filenames it is possible that a specially crafted filename can cause arbitrary commands to be executed. Multiple buffer overflows can cause the program to crash.
Alerts:
rPath rPSA-2006-0083-1 2006-05-26
Fedora-Legacy FLSA:152892 2005-12-17
Red Hat RHSA-2005:040-01 2005-02-15
Mandrake MDKSA-2005:033 2005-02-10
Gentoo 200502-03 2005-02-02
Red Hat RHSA-2005:039-01 2005-02-01
Fedora FEDORA-2005-096 2005-01-31
Fedora FEDORA-2005-092 2005-01-28
Fedora FEDORA-2005-091 2005-01-28
Fedora FEDORA-2005-016 2005-01-26
Fedora FEDORA-2005-015 2005-01-26
Ubuntu USN-68-1 2005-01-24
Debian DSA-654-1 2005-01-21

Comments (none posted)

ethereal: multiple vulnerabilites

Package(s):ethereal CVE #(s):CAN-2005-0006 CAN-2005-0007 CAN-2005-0008 CAN-2005-0009 CAN-2005-0010 CAN-2005-0084
Created:January 21, 2005 Updated:February 15, 2005
Description: Ethereal has released 0.10.9 to fix several vulnerabilities.
Alerts:
Red Hat RHSA-2005:037-01 2005-02-15
Red Hat RHSA-2005:011-01 2005-02-02
Fedora FEDORA-2005-069 2005-01-25
Fedora FEDORA-2005-068 2005-01-25
Mandrake MDKSA-2005:013 2005-01-24
Debian DSA-653-1 2005-01-21
Gentoo 200501-27 2005-01-20

Comments (none posted)

evolution: arbitrary code execution

Package(s):evolution CVE #(s):CAN-2005-0102
Created:January 24, 2005 Updated:May 19, 2005
Description: Max Vozeler discovered an integer overflow in camel-lock-helper. A user-supplied length value was not validated, so that a value of -1 caused a buffer allocation of 0 bytes; this buffer was then filled by an arbitrary amount of user-supplied data. A local attacker or a malicious POP3 server could exploit this to execute arbitrary code with root privileges (because camel-lock-helper is installed as setuid root).
Alerts:
Red Hat RHSA-2005:238-01 2005-05-19
Conectiva CLA-2005:925 2005-02-16
Debian DSA-673-1 2005-02-10
Mandrake MDKSA-2005:024 2005-01-27
Gentoo 200501-35 2005-01-24
Ubuntu USN-69-1 2005-01-24

Comments (1 posted)

kdebase: screen saver crash

Package(s):kdebase CVE #(s):CAN-2005-0078
Created:January 26, 2005 Updated:January 26, 2005
Description: From the Debian advisory: "Raphaël Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session."
Alerts:
Debian DSA-660-1 2005-01-26

Comments (none posted)

Konversation: multiple vulnerabilities

Package(s):konversation CVE #(s):CAN-2005-0129 CAN-2005-0130 CAN-2005-0131
Created:January 24, 2005 Updated:January 26, 2005
Description: Multiple vulnerabilities have been discovered in all Konversation versions up to and including 0.15.
Alerts:
Gentoo 200501-34 2005-01-24

Comments (none posted)

libdbi-perl: insecure temporary file

Package(s):libdbi-perl CVE #(s):CAN-2005-0077
Created:January 25, 2005 Updated:March 2, 2006
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.
Alerts:
Fedora-Legacy FLSA:178989 2006-03-01
Gentoo 200501-38:03 2005-01-26
Red Hat RHSA-2005:072-01 2005-02-15
Mandrake MDKSA-2005:030 2005-02-08
Red Hat RHSA-2005:069-01 2005-02-01
Gentoo 200501-38 2005-01-26
Ubuntu USN-70-1 2005-01-25
Debian DSA-658-1 2005-01-25

Comments (none posted)

libpam-radius-auth

Package(s):libpam-radius-auth CVE #(s):CAN-2005-0108
Created:January 26, 2005 Updated:January 26, 2005
Description: The PAM RADIUS authentication module suffers from an integer overflow vulnerability.
Alerts:
Debian DSA-659-1 2005-01-26

Comments (none posted)

mpg123: frame header buffer overflow

Package(s):mpg123 CVE #(s):CAN-2004-0991
Created:January 20, 2005 Updated:January 26, 2005
Description: mpg123 has a vulnerability in which a maliciously created file could cause a buffer overflow in the frame header parsing code, allowing arbitrary code to be executed with the permission of the user.
Alerts:
Mandrake MDKSA-2005:009 2005-01-19

Comments (none posted)

php4: multiple vulnerabilities

Package(s):php4 CVE #(s):
Created:February 20, 2005 Updated:February 21, 2005
Description: A vulnerability was reported in PHP in the cURL functions. A script can bypass the 'open_basedir' directory setting. See this SecurityTracker Alert for more information.
Alerts:
Ubuntu USN-66-2 2005-02-17
Ubuntu USN-66-1 2005-01-20

Comments (2 posted)

realplayer: integer overflow

Package(s):realplayer CVE #(s):
Created:January 24, 2005 Updated:January 26, 2005
Description: A flaw in the .rm RealMovie stream handling routines allows a remote attacker to exploit an integer overflow vulnerability using a special .rm file. This might allow a remote attacker to execute code as the user running RealPlayer.
Alerts:
SuSE SUSE-SA:2005:004 2005-01-24

Comments (none posted)

sword: missing input sanitizing

Package(s):sword CVE #(s):CAN-2005-0015
Created:January 20, 2005 Updated:January 26, 2005
Description: The CGI script diatheke from sword does not properly sanitize its input, allowing arbitrary commands to be executed through a specially crafted URL.
Alerts:
Debian DSA-650-1 2005-01-20

Comments (none posted)

vdr: insecure file access

Package(s):vdr CVE #(s):CAN-2005-0071
Created:January 25, 2005 Updated:January 31, 2005
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit Team has discovered that the vdr daemon which is used for video disk recorders for DVB cards can overwrite arbitrary files.
Alerts:
Gentoo 200501-42 2005-01-30
Debian DSA-656-1 2005-01-25

Comments (none posted)

xtrlock: buffer overflow

Package(s):xtrlock CVE #(s):CAN-2005-0079
Created:January 20, 2005 Updated:January 26, 2005
Description: xtrlock has a buffer overflow that can allow a local attacker to crash the lock program and take over a user's desktop session.
Alerts:
Debian DSA-649-1 2005-01-20

Comments (none posted)

zhcon: privilege escalation

Package(s):zhcon CVE #(s):CAN-2005-0072
Created:January 24, 2005 Updated:January 26, 2005
Description: Erik Sjolund discovered that zhcon accesses a user-controlled configuration file with elevated privileges which could make it possible to read arbitrary files.
Alerts:
Debian DSA-655-1 2005-01-25
Mandrake MDKSA-2005:012 2005-01-24

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):a2ps CVE #(s):CAN-2004-1170 CAN-2004-1377
Created:November 26, 2004 Updated:December 19, 2005
Description: The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:
Fedora-Legacy FLSA:152870 2005-12-17
Mandriva MDKSA-2005:097 2005-06-07
OpenPKG OpenPKG-SA-2005.003 2005-01-17
Gentoo 200501-02 2005-01-04
Debian DSA-612-1 2004-12-20
Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

apache: temporary file vulnerability

Package(s):apache CVE #(s):
Created:January 19, 2005 Updated:January 19, 2005
Description: Javier Fernández-Sanguino Peña noticed that the Apache 1.3 "check_forensic" script created temporary files in an insecure manner.
Alerts:
Ubuntu USN-65-1 2005-01-19

Comments (none posted)

cdrecord: failure to drop privilege

Package(s):cdrecord CVE #(s):CAN-2004-0806
Created:September 8, 2004 Updated:February 21, 2005
Description: The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program.
Alerts:
Fedora-Legacy FLSA:2058 2005-02-20
Gentoo 200409-18 2004-09-14
Fedora FEDORA-2004-298 2004-09-09
Fedora FEDORA-2004-297 2004-09-09
Mandrake MDKSA-2004:091 2004-09-07

Comments (none posted)

chbg: buffer overflow

Package(s):chbg CVE #(s):CAN-2004-1264
Created:January 18, 2005 Updated:February 2, 2005
Description: Danny Lungstrom discovered a vulnerability in chbg, a tool to change background pictures. A maliciously crafted configuration/scenario file could overflow a buffer and lead to the execution of arbitrary code on the victim's machine.
Alerts:
Mandrake MDKSA-2005:027 2005-02-01
Debian DSA-644-1 2005-01-18

Comments (none posted)

cups: multiple vulnerabilities

Package(s):cups CVE #(s):CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270
Created:December 17, 2004 Updated:February 9, 2005
Description: cups has a denial of service vulnerability in the lppasswd utility and a remote code execution vulnerability in the hpgltops filter.
Alerts:
SuSE SUSE-SR:2005:003 2005-02-04
Mandrake MDKSA-2005:008 2005-01-17
Gentoo 200412-25:02 2004-12-28
Red Hat RHSA-2005:013-01 2005-01-12
Gentoo 200412-25 2004-12-28
Fedora FEDORA-2004-559 2004-12-17
Fedora FEDORA-2004-560 2004-12-17

Comments (none posted)

cyrus-sasl: remote buffer overflow

Package(s):cyrus-sasl CVE #(s):CAN-2004-0884
Created:October 7, 2004 Updated:March 16, 2005
Description: cyrus-sasl has a vulnerability involving a buffer overflow in the digestmda5.c file. A remote attacker may be able to compromise the system. Also, a local user may be able to exploit a vulnerability by using the SASL_PATH environment variable.
Alerts:
Mandrake MDKSA-2005:054 2005-03-15
SuSE SUSE-SA:2005:013 2005-03-03
Fedora-Legacy FLSA:2137 2005-02-17
OpenPKG OpenPKG-SA-2005.004 2005-01-28
Conectiva CLA-2004:889 2004-11-11
Debian DSA-568-1 2004-10-16
Debian DSA-563-3 2004-10-14
Debian DSA-563-2 2004-10-12
Debian DSA-563-1 2004-10-12
Trustix TSLSA-2004-0053 2004-10-08
Mandrake MDKSA-2004:106 2004-10-07
Red Hat RHSA-2004:546-02 2004-10-07
Gentoo 200410-05 2004-10-07

Comments (none posted)

dhcp: format string vulnerability

Package(s):dhcp CVE #(s):CAN-2004-1006
Created:November 4, 2004 Updated:July 13, 2005
Description: Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:
Fedora-Legacy FLSA:152835 2005-07-10
Red Hat RHSA-2005:212-01 2005-04-12
Debian DSA-584-1 2004-11-04

Comments (none posted)

exim: buffer overflows

Package(s):exim CVE #(s):CAN-2005-0021 CAN-2005-0022
Created:January 7, 2005 Updated:February 15, 2005
Description: A buffer overflow in the host_aton() function in Exim 4.4x may allow execution of arbitrary commands with elevated privileges by a local user. This has been patched in Exim 4.43.

Additionally, there is a another buffer overflow in Exim's auth_spa_server() which also be fixed in Exim 4.43.

Alerts:
Red Hat RHSA-2005:025-01 2005-02-15
Gentoo 200501-23 2005-01-12
Debian DSA-637-1 2005-01-13
Debian DSA-635-1 2005-01-12
Ubuntu USN-56-1 2005-01-07
Fedora FEDORA-2005-001 2005-01-06
Fedora FEDORA-2005-001 2005-01-06

Comments (1 posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):foomatic CVE #(s):CAN-2004-0801
Created:September 20, 2004 Updated:May 31, 2006
Description: There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:
SuSE SUSE-SA:2006:026 2006-05-30
Fedora-Legacy FLSA:2076 2004-11-05
Conectiva CLA-2004:880 2004-10-27
Fedora FEDORA-2004-303 2004-09-21
Gentoo 200409-24 2004-09-20

Comments (none posted)

FreeRADIUS: denial of service

Package(s):freeradius CVE #(s):CAN-2004-0938 CAN-2004-0960 CAN-2004-0961
Created:September 22, 2004 Updated:February 2, 2005
Description: FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code.
Alerts:
Fedora-Legacy FLSA:2187 2005-02-01
Red Hat RHSA-2004:609-01 2004-11-12
Gentoo 200409-29 2004-09-22

Comments (none posted)

gaim: buffer overflow in MSN protocol

Package(s):gaim CVE #(s):CAN-2004-0891
Created:October 25, 2004 Updated:February 11, 2005
Description: A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.
Alerts:
Fedora-Legacy FLSA:2188 2005-02-10
Red Hat RHSA-2004:604-01 2004-10-20
Mandrake MDKSA-2004:117 2004-11-01
Ubuntu USN-8-1 2004-10-27
Gentoo 200410-23 2004-10-24
Slackware SSA:2004-296-01 2004-10-25

Comments (none posted)

gtk2, gdk-pixbuf: buffer overflows

Package(s):gdk-pixbuf gtk2 CVE #(s):CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788
Created:September 15, 2004 Updated:February 25, 2005
Description: The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Alerts:
Fedora-Legacy FLSA:2005 2005-02-23
Conectiva CLA-2004:875 2004-10-18
Slackware SSA:2004-266-02 2004-09-22
Gentoo 200409-28 2004-09-21
Mandrake MDKSA-2004:095-1 2004-09-17
SuSE SUSE-SA:2004:033 2004-09-17
Debian DSA-549-1 2004-09-17
Red Hat RHSA-2004:447-02 2004-09-15
Debian DSA-546-1 2004-09-16
Red Hat RHSA-2004:466-01 2004-09-15
Red Hat RHSA-2004:447-01 2004-09-15
Mandrake MDKSA-2004:095 2004-09-15
Fedora FEDORA-2004-289 2004-09-15
Fedora FEDORA-2004-288 2004-09-15
Fedora FEDORA-2004-287 2004-09-15
Fedora FEDORA-2004-286 2004-09-15

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):gettext CVE #(s):CAN-2004-0966
Created:October 11, 2004 Updated:March 1, 2006
Description: gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:
Mandriva MDKSA-2006:051 2006-02-28
Fedora-Legacy FLSA:136323 2006-01-09
Gentoo 200410-10:02 2004-10-10
OpenPKG OpenPKG-SA-2004.055 2004-12-23
Ubuntu USN-5-1 2004-10-27
Gentoo 200410-10 2004-10-10

Comments (1 posted)

ghostscript: symlink vulnerabilities

Package(s):ghostscript CVE #(s):CAN-2004-0967
Created:October 20, 2004 Updated:September 28, 2005
Description: The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:
Red Hat RHSA-2005:081-01 2005-09-28
Ubuntu USN-3-1 2004-10-27
Gentoo 200410-18 2004-10-20

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):glibc CVE #(s):CAN-2004-1453
Created:August 17, 2004 Updated:May 26, 2005
Description: Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:
Red Hat RHSA-2005:256-01 2005-05-18
Gentoo 200408-16 2004-08-16

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):glibc CVE #(s):CAN-2004-0968
Created:October 21, 2004 Updated:November 14, 2005
Description: The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:
Fedora-Legacy FLSA:152848 2005-11-13
Red Hat RHSA-2005:261-01 2005-04-28
Debian DSA-636-1 2005-01-12
Mandrake MDKSA-2004:159 2004-12-29
Red Hat RHSA-2004:586-01 2004-12-20
Fedora FEDORA-2004-356 2004-11-11
Ubuntu USN-4-1 2004-10-27
Gentoo 200410-19 2004-10-21

Comments (none posted)

gnome-vfs: backend script vulnerabilities

Package(s):gnome-vfs CVE #(s):CAN-2004-0494
Created:August 4, 2004 Updated:February 21, 2005
Description: Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:
Fedora-Legacy FLSA:1944 2005-02-20
Whitebox WBSA-2004:373-01 2004-08-19
Red Hat RHSA-2004:373-01 2004-08-04

Comments (none posted)

groff: insecure temporary directory

Package(s):groff CVE #(s):CAN-2004-0969
Created:November 1, 2004 Updated:February 9, 2006
Description: Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Mandriva MDKSA-2006:038 2006-02-08
Gentoo 200411-15 2004-11-08
Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):gtkhtml CVE #(s):CAN-2003-0133 CAN-2003-0541
Created:April 14, 2003 Updated:April 18, 2005
Description: GtkHTML is the HTML rendering widget used by the Evolution mail reader.

GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.

Alerts:
Debian DSA-710-1 2005-04-18
Mandrake MDKSA-2003:093 2003-09-18
Conectiva CLA-2003:737 2003-09-12
Red Hat RHSA-2003:264-01 2003-09-09
Mandrake MDKSA-2003:046 2003-04-15
Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

imagemagick: .psd image file decode vulnerability

Package(s):imagemagick CVE #(s):CAN-2005-0005
Created:January 18, 2005 Updated:March 23, 2005
Description: According to this iDEFENSE advisory, ImageMagick is vulnerable to a heap overflow when decoding .psd image files. This could be remotely exploited allowing an attacker to execute arbitrary code.
Alerts:
Red Hat RHSA-2005:070-01 2005-03-23
Red Hat RHSA-2005:071-01 2005-02-15
Gentoo 200501-37 2005-01-26
Gentoo 200501-26 2005-01-20
Debian DSA-646-1 2005-01-19
Ubuntu USN-62-1 2005-01-18

Comments (1 posted)

imlib2: buffer overflows

Package(s):imlib2 CVE #(s):CAN-2004-0802 CAN-2004-0817
Created:September 8, 2004 Updated:October 26, 2005
Description: The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:
Debian DSA-548-2 2005-10-26
Conectiva CLA-2004:870 2004-09-28
Debian DSA-552-1 2004-09-22
Debian DSA-548-1 2004-09-16
Red Hat RHSA-2004:465-01 2004-09-15
Gentoo 200409-12 2004-09-08
Fedora FEDORA-2004-301 2004-09-09
Fedora FEDORA-2004-300 2004-09-09
Mandrake MDKSA-2004:089 2004-09-07

Comments (none posted)

iptables: missing initialization

Package(s):iptables CVE #(s):CAN-2004-0986
Created:November 1, 2004 Updated:February 11, 2005
Description: Faheem Mitha noticed that the iptables command, an administration tool for IPv4 packet filtering and NAT, did not always load the required modules on its own as it was supposed to. This could lead to firewall rules not being loaded on system startup. This caused a failure in connection with rules provided by lokkit at least.
Alerts:
Fedora-Legacy FLSA:2252 2005-02-10
Ubuntu USN-81-1 2005-02-11
Mandrake MDKSA-2004:125 2004-11-04
Debian DSA-580-1 2004-11-01

Comments (none posted)

kdelibs: unsanitzied input

Package(s):kdelibs CVE #(s):CAN-2004-1165
Created:January 10, 2005 Updated:July 19, 2005
Description: Thiago Macieira discovered a vulnerability in the kioslave library, which is part of kdelibs, which allows a remote attacker to execute arbitrary FTP commands via an ftp:// URL that contains an URL-encoded newline before the FTP command.
Alerts:
Fedora-Legacy FLSA:152769 2005-07-15
Mandrake MDKSA-2005:045 2005-02-17
Red Hat RHSA-2005:065-01 2005-02-15
Red Hat RHSA-2005:009-01 2005-02-10
Fedora FEDORA-2005-064 2005-01-25
Fedora FEDORA-2005-063 2005-01-25
Gentoo 200501-18 2005-01-11
Debian DSA-631-1 2005-01-10

Comments (none posted)

kerberos5: execution of arbitrary code by authenticated user

Package(s):kerberos5 CVE #(s):CAN-2004-1189
Created:December 21, 2004 Updated:February 15, 2005
Description: There is a buffer overflow in the password history handling code of libkadm5srv which could be exploited by an authenticated user to execute arbitrary code on a Key Distribution Center (KDC) server.
Alerts:
Red Hat RHSA-2005:045-01 2005-02-15
Red Hat RHSA-2005:012-01 2005-01-19
Conectiva CLA-2005:917 2005-01-13
Ubuntu USN-58-1 2005-01-10
Debian DSA-629-1 2005-01-07
Gentoo 200501-05 2005-01-05
Mandrake MDKSA-2004:156 2004-12-22
Fedora FEDORA-2004-564 2004-12-21
Fedora FEDORA-2004-563 2004-12-21
Trustix TSLSA-2004-0069 2004-12-21

Comments (none posted)

kernel: race condition, privilege escalation

Package(s):kernel CVE #(s):CAN-2004-1235 CAN-2004-1337
Created:January 10, 2005 Updated:January 19, 2005
Description: Paul Starzetz discovered a race condition in the ELF library and a.out binary format loaders, which can be locally exploited in several different ways to gain root privileges. (CAN-2004-1235)

Liang Bin found a design flaw in the capability module. After this module was loaded on demand in a running system, all unprivileged user space processes got all kernel capabilities (thus essentially root privileges). (CAN-2004-1337)

Alerts:
Red Hat RHSA-2005:043-01 2005-01-18
Trustix TSLSA-2005-0001 2005-01-13
Fedora FEDORA-2005-013 2005-01-10
Fedora FEDORA-2005-014 2005-01-10
Ubuntu USN-57-1 2005-01-09

Comments (none posted)

kernel: i386 SMP page fault handler privilege escalation

Package(s):kernel CVE #(s):CAN-2005-0001
Created:January 14, 2005 Updated:February 25, 2005
Description: Paul Starzetz found an exploitable hole in the x86 SMP page fault handler which could lead to privilege escalation. See the advisory for details.
Alerts:
Fedora-Legacy FLSA:2336 2005-02-24
SuSE SUSE-SA:2005:010 2005-02-25
SuSE SUSE-SA:2005:005 2005-02-04
Mandrake MDKSA-2005:022 2005-01-25
Red Hat RHSA-2005:017-01 2005-01-21
Red Hat RHSA-2005:016-01 2005-01-21
SuSE SUSE-SA:2005:003 2005-01-21
Ubuntu USN-60-0 2005-01-14
Fedora FEDORA-2005-025 2005-01-13
Fedora FEDORA-2005-026 2005-01-13

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):kernel-utils CVE #(s):CAN-2003-0019
Created:February 7, 2003 Updated:January 21, 2005
Description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.

Alternatively, as a work-around to this vulnerability issue the following command as root:

chmod -s /usr/bin/uml_net

Alerts:
Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):libgd2 CVE #(s):CAN-2004-0990 CAN-2004-0941
Created:October 29, 2004 Updated:June 28, 2006
Description: Several buffer overflows have been discovered in libgd's PNG handling functions.
If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:
Mandriva MDKSA-2006:114 2006-06-27
Red Hat RHSA-2006:0194-01 2006-02-01
Fedora-Legacy FLSA:152838 2005-07-15
Red Hat RHSA-2004:638-01 2004-12-17
Ubuntu USN-33-1 2004-11-29
Debian DSA-602-1 2004-11-29
Debian DSA-601-1 2004-11-29
Mandrake MDKSA-2004:132 2004-11-15
Ubuntu USN-25-1 2004-11-15
Fedora FEDORA-2004-412 2004-11-11
Fedora FEDORA-2004-411 2004-11-11
Ubuntu USN-21-1 2004-11-09
Debian DSA-591-1 2004-11-09
Debian DSA-589-1 2004-11-09
Gentoo 200411-08 2004-11-03
OpenPKG OpenPKG-SA-2004.049 2004-10-30
Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):libpng CVE #(s):CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:August 4, 2004 Updated:February 10, 2005
Description: There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:
Fedora-Legacy FLSA:1943 2005-02-08
Red Hat RHSA-2004:421-01 2004-08-04
Gentoo 200408-22 2004-08-23
Whitebox WBSA-2004:402-01 2004-08-19
Mandrake MDKSA-2004:082 2004-08-12
Slackware SSA:2004-223-01 2004-08-09
Slackware SSA:2004-223-02 2004-08-07
Slackware SSA:2004-222-01b 2004-08-10
Slackware SSA:2004-222-01 2004-08-07
Conectiva CLA-2004:856 2004-08-06
Trustix TSLSA-2004-0040 2004-08-05
Gentoo 200408-03 2004-08-05
Debian DSA-536-1 2004-08-04
Mandrake MDKSA-2004:079 2004-08-04
SuSE SUSE-SA:2004:023 2004-08-04
Red Hat RHSA-2004:402-01 2004-08-04
OpenPKG OpenPKG-SA-2004.035 2004-08-04

Comments (1 posted)

libtiff: buffer overflow

Package(s):libtiff CVE #(s):CAN-2004-1308
Created:December 22, 2004 Updated:May 19, 2005
Description: The libtiff image manipulation library contains several exploitable buffer overflows.
Alerts:
Fedora-Legacy FLSA:152815 2005-05-18
Red Hat RHSA-2005:035-01 2005-02-15
Conectiva CLA-2005:920 2005-01-20
Red Hat RHSA-2005:019-01 2005-01-13
SuSE SUSE-SA:2005:001 2005-01-10
Fedora FEDORA-2005-598 2005-01-07
Fedora FEDORA-2005-597 2005-01-07
Ubuntu USN-54-1 2005-01-06
Mandrake MDKSA-2005:002 2005-01-06
Mandrake MDKSA-2005:001 2005-01-06
Gentoo 200501-06 2005-01-05
Debian DSA-626-1 2005-01-06
Debian DSA-617-1 2004-12-24
Fedora FEDORA-2004-577 2004-12-22
Fedora FEDORA-2004-576 2004-12-22
Ubuntu USN-46-1 2004-12-22

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libxpm4: stack and integer overflows

Package(s):libxpm4 CVE #(s):CAN-2004-0687 CAN-2004-0688
Created:September 16, 2004 Updated:February 14, 2005
Description: There are several stack and integer overflow bugs in the libXpm code of XFree86 that may be used for a denial of service.
Alerts:
Conectiva CLA-2005:924 2005-02-14
Red Hat RHSA-2005:004-01 2005-01-12
Red Hat RHSA-2004:537-01 2004-12-02
Ubuntu USN-27-1 2004-11-17
Mandrake MDKSA-2004:124 2004-11-04
Debian DSA-561-1 2004-10-11
Gentoo 200410-09 2004-10-09
Debian DSA-560-1 2004-10-07
Red Hat RHSA-2004:479-01 2004-10-06
Red Hat RHSA-2004:478-01 2004-10-04
Gentoo 200409-34 2004-09-27
SuSE SUSE-SA:2004:034 2004-09-17
Mandrake MDKSA-2004:099 2004-09-15
Mandrake MDKSA-2004:098 2004-09-15

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):lvm10 CVE #(s):CAN-2004-0972
Created:November 1, 2004 Updated:July 25, 2005
Description: Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:
Fedora-Legacy FLSA:152842 2005-07-24
Mandrake MDKSA-2004:144 2004-12-06
Gentoo 200411-22 2004-11-11
Debian DSA-583-1 2004-11-03
Ubuntu USN-15-1 2004-11-01

Comments (none posted)

mailman: cross-site scripting

Package(s):mailman CVE #(s):CAN-2004-1177
Created:January 10, 2005 Updated:March 22, 2005
Description: Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript (or other content embedded into HTML) which triggered a mailman error page. When an unsuspecting user followed this URL, the malicious content was copied unmodified to the error page and executed in the context of this page.
Alerts:
Fedora FEDORA-2005-242 2005-03-22
Fedora FEDORA-2005-241 2005-03-22
Red Hat RHSA-2005:235-01 2005-03-21
Debian DSA-674-1 2005-02-10
Mandrake MDKSA-2005:015 2005-01-24
Gentoo 200501-29 2005-01-22
Ubuntu USN-59-1 2005-01-10

Comments (none posted)

mikmod: buffer overflow

Package(s):mikmod CVE #(s):CAN-2003-0427
Created:June 16, 2003 Updated:June 16, 2005
Description: Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:
Fedora FEDORA-2005-405 2005-06-16
Red Hat RHSA-2005:506-01 2005-06-13
Fedora FEDORA-2005-404 2005-06-09
Gentoo 200307-01 2003-07-02
Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg321: format string vulnerability

Package(s):mpg321 CVE #(s):CAN-2003-0969
Created:January 6, 2004 Updated:March 28, 2005
Description: A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:
Gentoo 200503-34 2005-03-28
Debian DSA-411-1 2004-01-05

Comments (none posted)

mysql: several vulnerabilities

Package(s):mysql CVE #(s):CAN-2004-0835 CAN-2004-0836 CAN-2004-0837
Created:October 11, 2004 Updated:April 6, 2005
Description: Several problems have been discovered in MySQL. Oleksandr Byelkin noticed that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis noticed that multiple threads ALTERing the same (or different) MERGE tables to change the UNION can cause the server to crash or stall. (CAN-2004-0837)
Alerts:
Ubuntu USN-109-1 2005-04-06
Fedora FEDORA-2004-530 2004-12-08
Ubuntu USN-32-1 2004-11-25
Conectiva CLA-2004:892 2004-11-18
Mandrake MDKSA-2004:119 2004-11-01
OpenPKG OpenPKG-SA-2004.045 2004-10-30
Red Hat RHSA-2004:611-01 2004-10-27
Gentoo 200410-22 2004-10-24
Red Hat RHSA-2004:569-01 2004-10-20
Red Hat RHSA-2004:597-01 2004-10-20
Debian DSA-562-1 2004-10-11

Comments (none posted)

mysql-dfsg: insecure temporary files

Package(s):mysql-dfsg CVE #(s):CAN-2005-0004
Created:January 18, 2005 Updated:March 25, 2005
Description: Javier Fernández-Sanguino Peña noticed that the "mysqlaccess" program created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:
Fedora-Legacy FLSA:2129 2005-03-24
Mandrake MDKSA-2005:036 2005-02-10
Gentoo 200501-33 2005-01-23
Debian DSA-647-1 2005-01-19
Ubuntu USN-63-1 2005-01-18

Comments (none posted)

nasm: Buffer overflow vulnerability

Package(s):nasm CVE #(s):CAN-2004-1287
Created:December 20, 2004 Updated:May 4, 2005
Description: Jonathan Rockway discovered that NASM-0.98.38 has an unprotected vsprintf() to an array in preproc.c. This code vulnerability may lead to a buffer overflow and potential execution of arbitrary code.
Alerts:
Red Hat RHSA-2005:381-01 2005-05-04
Fedora FEDORA-2005-322 2005-04-18
Mandrake MDKSA-2005:004 2005-01-06
Debian DSA-623-1 2004-01-04
Ubuntu USN-45-1 2004-12-22
Gentoo 200412-20 2004-12-20

Comments (4 posted)

netkit-telnet: invalid free pointer

Package(s):netkit-telnet CVE #(s):CAN-2004-0911
Created:October 4, 2004 Updated:March 28, 2005
Description: Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service (inetd will disable the service if telnetd is crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user).
Alerts:
Ubuntu USN-101-1 2005-03-28
Debian DSA-556-2 2004-10-18
Debian DSA-569-1 2004-10-18
Debian DSA-556-1 2004-10-02

Comments (none posted)

nfs-utils: denial of service

Package(s):nfs-utils CVE #(s):CAN-2004-1014
Created:December 1, 2004 Updated:May 15, 2005
Description: The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker.
Alerts:
Fedora-Legacy FLSA:152871 2005-05-12
Red Hat RHSA-2004:583-01 2004-12-20
Gentoo 200412-08 2004-12-14
Trustix TSLSA-2004-0065 2004-01-09
Debian DSA-606-1 2004-12-08
Mandrake MDKSA-2004:146 2004-12-06
Ubuntu USN-36-1 2004-12-01

Comments (none posted)

nfs-utils: arbitrary code execution

Package(s):nfs-utils CVE #(s):CAN-2004-0946
Created:January 11, 2005 Updated:February 27, 2006
Description: Arjan van de Ven discovered a buffer overflow in rquotad on 64bit architectures; an improper integer conversion could lead to a buffer overflow. An attacker with access to an NFS share could send a specially crafted request which could then lead to the execution of arbitrary code.
Alerts:
Fedora-Legacy FLSA:138098 2006-02-25
Red Hat RHSA-2005:014-01 2005-01-12
Mandrake MDKSA-2005:005 2005-01-11

Comments (none posted)

openssl: der_chop script temp file vulnerability

Package(s):openssl CVE #(s):CAN-2004-0975
Created:November 11, 2004 Updated:July 19, 2005
Description: The der_chop script in openssl has a temp file vulnerability that may allow an attacker to overwrite arbitrary files with the permissions that the script is running under.
Alerts:
Fedora-Legacy FLSA:152841 2005-07-15
Mandrake MDKSA-2004:147 2004-12-06
Debian DSA-603-1 2004-12-01
Ubuntu USN-24-1 2004-11-11

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):OpenSSL CVE #(s):CAN-2004-0081 CAN-2003-0851
Created:March 17, 2004 Updated:November 2, 2005
Description: Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:
Red Hat RHSA-2005:830-00 2005-11-02
Red Hat RHSA-2005:829-00 2005-11-02
Fedora FEDORA-2005-1042 2005-10-31
Fedora-Legacy FLSA:1395 2004-05-08
Conectiva CLA-2004:834 2004-03-31
Whitebox WBSA-2004:084-01 2004-03-23
Red Hat RHSA-2004:084-01 2004-03-23
Fedora FEDORA-2004-095 2004-03-19
Whitebox WBSA-2004:120-01 2004-03-22
Trustix TSLSA-2004-0012 2004-03-17
Slackware SSA:2004-077-01 2004-03-17
Red Hat RHSA-2004:121-01 2004-03-17
OpenPKG OpenPKG-SA-2004.007 2004-03-18
Gentoo 200403-03 2004-03-17
Debian DSA-465-1 2004-03-17
Netwosix NW-2004-0005 2004-03-17
Mandrake MDKSA-2004:023 2004-03-17
SuSE SuSE-SA:2004:007 2004-03-17
Red Hat RHSA-2004:120-01 2004-03-17
Red Hat RHSA-2004:119-01 2004-03-17
EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

php: remotely exploitable memory errors

Package(s):php CVE #(s):CAN-2004-0594
Created:July 14, 2004 Updated:February 7, 2005
Description: Stefan Esser has issued an advisory regarding a remotely exploitable hole in PHP (through version 4.3.7). If the memory_limit feature is in use (as it should be, to prevent denial of service attacks), allocation failures can be forced at highly inopportune times, and those failures can be exploited to execute arbitrary code. The exploit is described as "quite easy," and it can be done regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the problem; yesterday's PHP 5.0 release also contains the fix (but the final release candidate did not).
Alerts:
Debian DSA-669-1 2005-02-07
Whitebox WBSA-2004:392-01 2004-08-19
Fedora FEDORA-2004-223 2004-07-23
Fedora FEDORA-2004-222 2004-07-23
OpenPKG OpenPKG-SA-2004.034 2004-07-22
Slackware SSA:2004-202-01 2004-07-20
Debian DSA-531-1 2004-07-20
Red Hat RHSA-2004:392-01 2004-07-19
Red Hat RHSA-2004:395-01 2004-07-19
Conectiva CLA-2004:847 2004-07-16
SuSE SUSE-SA:2004:021 2004-07-16
Mandrake MDKSA-2004:068 2004-07-14
Gentoo 200407-13 2004-07-15
tinysofa TSSA-2004-013 2004-07-14

Comments (none posted)

php: multiple vulnerabilities

Package(s):php CVE #(s):CAN-2004-1018 CAN-2004-1019 CAN-2004-1020 CAN-2004-1063 CAN-2004-1064 CAN-2004-1065
Created:December 16, 2004 Updated:March 24, 2005
Description: PHP has an out of bounds memory write access vulnerability and an integer overflow/underflow problem. See the PHP 4.3.10 Release Announcement for details.
Alerts:
Ubuntu USN-99-2 2005-03-24
Ubuntu USN-99-1 2005-03-18
Fedora-Legacy FLSA:2344 2005-03-07
Red Hat RHSA-2005:032-01 2005-02-15
Red Hat RHSA-2005:031-01 2005-01-19
SuSE SUSE-SA:2005:002 2005-01-17
Conectiva CLA-2005:915 2005-01-13
Fedora FEDORA-2004-567 2004-12-21
Fedora FEDORA-2004-568 2004-12-21
Red Hat RHSA-2004:687-01 2004-12-21
Trustix TSLSA-2004-0066 2004-12-17
Gentoo 200412-14 2004-12-19
Mandrake MDKSA-2004:151 2004-12-17
Ubuntu USN-40-1 2004-12-16
OpenPKG OpenPKG-SA-2004.053 2004-12-16

Comments (1 posted)

playmidi: buffer overflow

Package(s):playmidi CVE #(s):CAN-2005-0020
Created:January 17, 2005 Updated:January 20, 2005
Description: Erik Sjölund discovered that playmidi, a MIDI player, contains a setuid root program with a buffer overflow that can be exploited by a local attacker.
Alerts:
Mandrake MDKSA-2005:010 2005-01-19
Debian DSA-641-1 2005-01-17

Comments (none posted)

ProZilla: Multiple vulnerabilities

Package(s):ProZilla CVE #(s):CAN-2004-1120
Created:November 23, 2004 Updated:February 1, 2005
Description: ProZilla contains several exploitable buffer overflows in the code handling the network protocols. A remote attacker could setup a malicious server and entice a user to retrieve files from that server using ProZilla. This could lead to the execution of arbitrary code with the rights of the user running ProZilla.
Alerts:
Debian DSA-663-1 2005-02-01
Gentoo 200411-31 2004-11-23

Comments (none posted)

qt3: BMP image parser heap overflow

Package(s):qt3/qt3-non-mt/qt3-32bit/qt3-static CVE #(s):CAN-2004-0691 CAN-2004-0692 CAN-2004-0693
Created:August 19, 2004 Updated:May 15, 2005
Description: A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution.
Alerts:
Fedora-Legacy FLSA:152763 2005-05-12
Conectiva CLA-2004:866 2004-09-22
Whitebox WBSA-2004:414-01 2004-09-20
Debian DSA-542-1 2004-08-30
Fedora FEDORA-2004-271 2004-08-23
Fedora FEDORA-2004-270 2004-08-23
Gentoo 200408-20 2004-08-22
Red Hat RHSA-2004:414-01 2004-08-20
Mandrake MDKSA-2004:085 2004-08-18
SuSE SUSE-SA:2004:027 2004-08-19

Comments (none posted)

queue: buffer overflows

Package(s):queue CVE #(s):CAN-2004-0555
Created:January 18, 2005 Updated:January 19, 2005
Description: "jaguar" of the Debian Security Audit Project has discovered several buffer overflows in queue, a transparent load balancing system.
Alerts:
Debian DSA-643-1 2005-01-18

Comments (none posted)

rp-pppoe, pppoe: missing privilege dropping

Package(s):rp-pppoe, pppoe CVE #(s):CAN-2004-0564
Created:October 4, 2004 Updated:November 15, 2005
Description: Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver from Roaring Penguin. When the program is running setuid root (which is not the case in a default Debian installation), an attacker could overwrite any file on the file system.
Alerts:
Fedora-Legacy FLSA:152794 2005-11-14
Mandrake MDKSA-2004:145 2004-12-06
Debian DSA-557-1 2004-10-04

Comments (none posted)

ruby: infinite loop

Package(s):ruby CVE #(s):CAN-2004-0983
Created:November 8, 2004 Updated:May 15, 2005
Description: The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.
Alerts:
Fedora-Legacy FLSA:152768 2005-05-12
Red Hat RHSA-2004:635-01 2004-12-13
Gentoo 200411-23 2004-11-16
Fedora FEDORA-2004-403 2004-11-11
Fedora FEDORA-2004-402 2004-11-11
Ubuntu USN-20-1 2004-11-08
Mandrake MDKSA-2004:128 2004-11-08
Debian DSA-586-1 2004-11-08

Comments (none posted)

samba: integer overflow vulnerability

Package(s):samba CVE #(s):CAN-2004-1154
Created:December 16, 2004 Updated:July 19, 2005
Description: Samba has an integer overflow vulnerability that may allow an authenticated remote user to execute arbitrary code on the Samba server.
Alerts:
Fedora-Legacy FLSA:152874 2005-07-15
Debian DSA-701-2 2005-04-21
Debian DSA-701-1 2005-03-31
Conectiva CLA-2005:913 2005-01-06
Red Hat RHSA-2005:020-01 2005-01-05
Mandrake MDKSA-2004:158 2004-12-27
SuSE SUSE-SA:2004:045 2004-12-22
Red Hat RHSA-2004:681-01 2004-12-21
Fedora FEDORA-2004-562 2004-12-20
Fedora FEDORA-2004-561 2004-12-20
Gentoo 200412-13 2004-12-17
Ubuntu USN-41-1 2004-12-17
OpenPKG OpenPKG-SA-2004.054 2004-12-17
Red Hat RHSA-2004:670-01 2004-12-16

Comments (none posted)

sharutils: arbitrary code execution

Package(s):sharutils CVE #(s):CAN-2004-1772
Created:October 1, 2004 Updated:April 26, 2005
Description: sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c. An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.
Alerts:
Red Hat RHSA-2005:377-01 2005-04-26
Fedora FEDORA-2005-281 2005-04-01
Fedora FEDORA-2005-280 2005-04-01
Ubuntu USN-102-1 2005-03-29
Fedora-Legacy FLSA:2155 2005-03-24
Gentoo 200410-01 2004-10-01

Comments (none posted)

sox: buffer overflow

Package(s):sox CVE #(s):CAN-2004-0557
Created:July 28, 2004 Updated:February 21, 2005
Description: Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file.
Alerts:
Fedora-Legacy FLSA:1945 2005-02-20
Debian DSA-565-1 2004-10-13
Whitebox WBSA-2004:409-01 2004-08-19
Slackware SSA:2004-223-03 2004-08-07
Conectiva CLA-2004:855 2004-07-30
Gentoo 200407-23 2004-07-30
Mandrake MDKSA-2004:076 2004-07-28
Red Hat RHSA-2004:409-01 2004-07-29
Fedora FEDORA-2004-244 2004-07-28
Fedora FEDORA-2004-235 2004-07-28

Comments (none posted)

SpamAssassin: Denial of Service vulnerability

Package(s):spamassassin CVE #(s):CAN-2004-0796
Created:August 9, 2004 Updated:August 11, 2005
Description: SpamAssassin contains an unspecified Denial of Service vulnerability. By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin service.
Alerts:
Fedora-Legacy FLSA:129284 2005-08-10
Fedora-Legacy FLSA:2268 2005-03-24
Red Hat RHSA-2004:451-01 2004-09-30
Conectiva CLA-2004:867 2004-09-22
OpenPKG OpenPKG-SA-2004.041 2004-09-15
Mandrake MDKSA-2004:084 2004-08-18
Gentoo 200408-06 2004-08-09

Comments (none posted)

Squid: multiple vulnerabilities

Package(s):squid CVE #(s):CAN-2005-0094 CAN-2005-0095
Created:January 17, 2005 Updated:February 2, 2005
Description: Squid contains a vulnerability in the gopherToHTML function and incorrectly checks the 'number of caches' field when parsing WCCP_I_SEE_YOU messages. Furthermore the NTLM code contains two errors. One is a memory leak in the fakeauth_auth helper and the other is NULL pointer dereferencing error.
Alerts:
Gentoo 200502-04:02 2005-02-02
Fedora FEDORA-2005-106 2005-02-01
Fedora FEDORA-2005-105 2005-02-01
Conectiva CLA-2005:923 2005-01-26
Mandrake MDKSA-2005:014 2005-01-24
Ubuntu USN-67-1 2005-01-20
Debian DSA-651-1 2005-01-20
Gentoo 200501-25 2005-01-16

Comments (none posted)

Subversion: Remote heap overflow

Package(s):subversion CVE #(s):CAN-2004-0413
Created:June 11, 2004 Updated:March 7, 2005
Description: Subversion has a remote Denial of Service vulnerability that may allow a server that runs svnserve to execute arbitrary code. See this advisory for more information.
Alerts:
Fedora-Legacy FLSA:1748 2005-03-07
SuSE SuSE-SA:2004:018 2004-06-17
Fedora FEDORA-2004-166 2004-06-11
Fedora FEDORA-2004-165 2004-06-11
OpenPKG OpenPKG-SA-2004.028 2004-06-11
Gentoo 200406-07 2004-06-10

Comments (none posted)

sudo: environment variable sanitizing

Package(s):sudo CVE #(s):CAN-2004-1051
Created:November 17, 2004 Updated:May 15, 2005
Description: Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information.
Alerts:
Fedora-Legacy FLSA:152856 2005-05-12
OpenPKG OpenPKG-SA-2005.002 2005-01-17
Debian DSA-596-2 2004-11-24
Debian DSA-596-1 2004-11-24
Ubuntu USN-28-1 2004-11-17
Mandrake MDKSA-2004:133 2004-11-15

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tiff: buffer overflows

Package(s):tiff CVE #(s):CAN-2004-0803
Created:October 13, 2004 Updated:April 12, 2005
Description: The tiff library contains several buffer overflows which may be exploited by way of maliciously-crafted image files. See this advisory for more information.
Alerts:
Red Hat RHSA-2005:021-01 2005-04-12
Conectiva CLA-2005:914 2005-01-06
Gentoo 200412-17 2004-12-19
Gentoo 200412-02 2004-12-05
Conectiva CLA-2004:888 2004-11-08
Slackware SSA:2004-305-02 2004-11-01
Red Hat RHSA-2004:577-01 2004-10-22
SuSE SUSE-SA:2004:038 2004-10-22
Mandrake MDKSA-2004:111 2004-10-21
Mandrake MDKSA-2004:109 2004-10-19
Debian DSA-567-1 2004-10-15
Fedora FEDORA-2004-334 2004-10-14
OpenPKG OpenPKG-SA-2004.043 2004-10-14
Gentoo 200410-11 2004-10-13

Comments (none posted)

TikiWiki: arbitrary command execution

Package(s):TikiWiki CVE #(s):
Created:January 10, 2005 Updated:January 31, 2005
Description: TikiWiki lacks a check on uploaded images in the Wiki edit page. A malicious user could run arbitrary commands on the server by uploading and calling a PHP script.
Alerts:
Gentoo 200501-41 2005-01-30
Gentoo 200501-12 2005-01-10

Comments (none posted)

unarj: buffer overflow vulnerability

Package(s):unarj CVE #(s):CAN-2004-0947
Created:November 11, 2004 Updated:February 2, 2005
Description: The unarj uncompression utility has a buffer overflow vulnerability from handling long file names in an archive. An attacker can cause unarj to crash or execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:2272 2005-02-01
Debian DSA-652-1 2005-01-21
Red Hat RHSA-2005:007-01 2005-01-12
Gentoo 200411-29 2004-11-19
Fedora FEDORA-2004-414 2004-11-11

Comments (none posted)

vim: modeline problems

Package(s):vim CVE #(s):CAN-2004-1138
Created:December 15, 2004 Updated:February 24, 2005
Description: A new set of modeline-related vulnerabilities has been discovered in versions of vim prior to 6.3-r2. These vulnerabilities could conceivably be exploited by a local user to obtain the privileges of another user.
Alerts:
Fedora-Legacy FLSA:2343 2005-02-23
Mandrake MDKSA-2005:003 2005-01-06
Ubuntu USN-52-1 2004-12-23
Red Hat RHSA-2005:010-01 2005-01-05
OpenPKG OpenPKG-SA-2004.052 2004-12-15
Gentoo 200412-10 2004-12-15

Comments (none posted)

vim: symbolic link attack

Package(s):vim CVE #(s):CAN-2005-0069
Created:January 18, 2005 Updated:February 18, 2005
Description: Javier Fernández-Sanguino Peña noticed that the auxiliary scripts "tcltags" and "vimspell.sh" created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the script (either by calling it directly or by execution through vim).
Alerts:
Red Hat RHSA-2005:122-01 2005-02-18
Red Hat RHSA-2005:036-01 2005-02-15
Mandrake MDKSA-2005:029 2005-02-02
Ubuntu USN-61-1 2005-01-18

Comments (none posted)

wv: buffer overflow

Package(s):wv CVE #(s):CAN-2004-0645
Created:July 14, 2004 Updated:February 10, 2005
Description: wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem.
Alerts:
Fedora-Legacy FLSA:1906 2005-02-08
Conectiva CLA-2004:902 2004-12-01
Debian DSA-579-1 2004-11-01
Debian DSA-550-1 2004-09-20
Conectiva CLA-2004:863 2004-09-10
Mandrake MDKSA-2004:077 2004-07-29
Fedora FEDORA-2004-225 2004-07-23
Fedora FEDORA-2004-224 2004-07-23
Gentoo 200407-11 2004-07-14

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):xchat CVE #(s):CAN-2004-0409
Created:April 19, 2004 Updated:November 15, 2005
Description: XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:
Fedora-Legacy FLSA:123013 2005-11-14
Red Hat RHSA-2004:585-01 2004-10-27
Netwosix NW-2004-0014 2004-05-01
Red Hat RHSA-2004:177-01 2004-04-30
Mandrake MDKSA-2004:036 2004-04-21
Debian DSA-493-1 2004-04-21
Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-lib: arbitrary code execution

Package(s):xine-lib CVE #(s):CAN-2004-1187 CAN-2004-1188 CAN-2004-1300
Created:December 21, 2004 Updated:January 25, 2005
Description: Several buffer overflows have been discovered in xine-lib, the video/audio codec library for Xine frontends (xine-ui, totem-xine, kaffeine, and others). If an attacker tricked a user into loading a malicious RTSP stream or a stream with specially crafted AIFF audio or PNM image data, they could exploit this to execute arbitrary code with the privileges of the user opening the audio/video file. See this advisory for more information.
Alerts:
Mandrake MDKSA-2005:011 2005-01-19
Conectiva CLA-2005:919 2005-01-19
Gentoo 200501-07 2005-01-06
Ubuntu USN-42-1 2004-12-20

Comments (none posted)

xine-lib: buffer overflows

Package(s):xine-lib CVE #(s):CAN-2004-1379
Created:September 22, 2004 Updated:April 10, 2006
Description: xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:
Fedora-Legacy FLSA:152873 2006-04-04
Debian DSA-657-1 2005-01-25
Mandrake MDKSA-2004:105 2004-10-06
Slackware SSA:2004-266-04 2004-09-22
Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):xine-ui CVE #(s):CAN-2004-0372
Created:April 6, 2004 Updated:April 27, 2006
Description: Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:
Gentoo 200404-20 2004-04-27
Slackware SSA:2004-111-01 2004-04-20
Mandrake MDKSA-2004:033 2004-04-19
Debian DSA-477-1 2004-04-06

Comments (none posted)

xorg-x11: integer overflows

Package(s):xorg-x11 CVE #(s):CAN-2004-0914
Created:November 18, 2004 Updated:September 12, 2005
Description: The X.Org libXpm library has several integer overflow vulnerabilities An attacker can modify XPM images to execute malicious code.
Alerts:
Ubuntu USN-83-2 2005-09-12
Fedora-Legacy FLSA:152804 2005-05-12
Ubuntu USN-83-1 2005-02-16
Gentoo 200502-07 2005-02-07
Gentoo 200502-06 2005-02-06
Red Hat RHSA-2004:612-01 2004-12-20
Red Hat RHSA-2004:610-01 2004-12-20
Debian DSA-607-1 2004-12-10
Mandrake MDKSA-2004:137-1 2004-11-29
Mandrake MDKSA-2004:137 2004-11-22
Mandrake MDKSA-2004:138 2004-11-22
Gentoo 200411-28 2004-11-19
Fedora FEDORA-2004-434 2004-11-17
Fedora FEDORA-2004-433 2004-11-17
SuSE SUSE-SA:2004:041 2004-11-17

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2004-1125
Created:December 23, 2004 Updated:April 1, 2005
Description: xpdf has a potential buffer overflow problem caused by insufficient input validation. A specially crafted PDF file can allow an attacker to execute code with privileges of the xpdf user.
Alerts:
Red Hat RHSA-2005:354-01 2005-04-01
Red Hat RHSA-2005:018-01 2005-01-12
Gentoo 200501-17 2005-01-11
Gentoo 200501-13 2005-01-10
Fedora FEDORA-2004-585 2005-01-03
Fedora FEDORA-2004-584 2005-01-03
Debian DSA-621-1 2004-12-31
Mandrake MDKSA-2004:166 2004-12-29
Mandrake MDKSA-2004:165 2004-12-29
Mandrake MDKSA-2004:162 2004-12-29
Mandrake MDKSA-2004:164 2004-12-29
Mandrake MDKSA-2004:163 2004-12-29
Mandrake MDKSA-2004:161 2004-12-29
Debian DSA-619-1 2004-12-30
Gentoo 200412-25 2004-12-28
Gentoo 200412-24 2004-12-28
Fedora FEDORA-2004-575 2004-12-22
Fedora FEDORA-2004-574 2004-12-22
Fedora FEDORA-2004-573 2004-12-22
Fedora FEDORA-2004-572 2004-12-22
Ubuntu USN-50-1 2004-12-23
Ubuntu USN-48-1 2004-12-23

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2005-0064
Created:January 19, 2005 Updated:March 15, 2007
Description: iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:
Fedora FEDORA-2007-1219 2007-03-14
Gentoo 200506-06 2005-06-09
Red Hat RHSA-2005:026-01 2005-03-16
Red Hat RHSA-2005:066-01 2005-02-15
Red Hat RHSA-2005:057-01 2005-02-15
Red Hat RHSA-2005:053-01 2005-02-15
Red Hat RHSA-2005:034-01 2005-02-15
Fedora-Legacy FLSA:2353 2005-02-10
Fedora-Legacy FLSA:2352 2005-02-10
Gentoo 200502-10 2005-02-09
Red Hat RHSA-2005:049-01 2005-02-01
SuSE SUSE-SR:2005:002 2005-01-26
Red Hat RHSA-2005:059-01 2005-01-26
Mandrake MDKSA-2005:020 2005-01-25
Mandrake MDKSA-2005:019 2005-01-25
Mandrake MDKSA-2005:016 2005-01-25
Mandrake MDKSA-2005:021 2005-01-25
Mandrake MDKSA-2005:018 2005-01-25
Mandrake MDKSA-2005:017 2005-01-25
Fedora FEDORA-2005-061 2005-01-25
Fedora FEDORA-2005-062 2005-01-25
Fedora FEDORA-2005-059 2005-01-25
Fedora FEDORA-2005-060 2005-01-25
Conectiva CLA-2005:921 2005-01-25
Fedora FEDORA-2004-049 2005-01-24
Fedora FEDORA-2004-048 2005-01-24
Gentoo 200501-32 2005-01-23
Gentoo 200501-31 2005-01-23
Gentoo 200501-30 2005-01-22
Gentoo 200501-28 2005-01-21
Fedora FEDORA-2005-052 2005-01-20
Fedora FEDORA-2005-051 2005-01-20
Ubuntu USN-64-1 2005-01-19
Debian DSA-645-1 2005-01-19
Debian DSA-648-1 2005-01-19

Comments (1 posted)

xpdf: integer overflows

Package(s):xpdf kpdf cupsys CVE #(s):CAN-2004-0888 CAN-2004-0889
Created:October 21, 2004 Updated:February 18, 2005
Description: Several xpdf integer overflow vulnerabilities can be exploited via a mal-formed PDF document. Similar vulnerabilities can be found in kpdf and in cupsys which share code. Additional information can be found in this KDE security advisory.
Alerts:
Fedora FEDORA-2005-138 2005-02-09
Fedora FEDORA-2005-137 2005-02-09
Fedora FEDORA-2005-133 2005-02-09
Fedora FEDORA-2005-134 2005-02-09
Fedora FEDORA-2005-136 2005-02-09
Fedora FEDORA-2005-135 2005-02-09
Fedora FEDORA-2005-123 2005-02-08
Fedora FEDORA-2005-122 2005-02-08
Debian DSA-599-1 2004-11-25
Gentoo 200411-30 2004-11-23
Conectiva CLA-2004:886 2004-11-08
Gentoo 200410-30:02 2004-10-28
Gentoo 200410-20:02 2004-10-21
Debian DSA-581-1 2004-11-02
Ubuntu USN-14-1 2004-11-01
Ubuntu USN-9-1 2004-10-27
Gentoo 200410-30 2004-10-28
Fedora FEDORA-2004-358 2004-10-28
Fedora FEDORA-2004-357 2004-10-28
Red Hat RHSA-2004:592-01 2004-10-27
Fedora FEDORA-2004-337 2004-10-26
SuSE SUSE-SA:2004:039 2004-10-26
Ubuntu USN-2-1 2004-10-22
Red Hat RHSA-2004:543-01 2004-10-22
Mandrake MDKSA-2004:115 2004-10-21
Mandrake MDKSA-2004:116 2004-10-21
Mandrake MDKSA-2004:114 2004-10-21
Mandrake MDKSA-2004:113 2004-10-21
Gentoo 200410-20 2004-10-21
Fedora FEDORA-2004-348 2004-10-21
Debian DSA-573-1 2004-10-21

Comments (none posted)

zip: arbitrary code execution

Package(s):zip CVE #(s):CAN-2004-1010
Created:November 5, 2004 Updated:February 2, 2005
Description: HexView discovered a buffer overflow in the zip package. The overflow is triggered by creating a ZIP archive of files with very long path names. This vulnerability might result in execution of arbitrary code with the privileges of the user who calls zip. This flaw may lead to privilege escalation on systems which automatically create ZIP archives of user supplied files, like backup systems or web applications.
Alerts:
Fedora-Legacy FLSA:2255 2005-02-01
Debian DSA-624-1 2004-01-05
Red Hat RHSA-2004:634-01 2004-12-16
Mandrake MDKSA-2004:141 2004-11-25
Gentoo 200411-16 2004-11-09
Fedora FEDORA-2004-399 2004-11-08
Fedora FEDORA-2004-400 2004-11-08
Ubuntu USN-18-1 2004-11-05

Comments (1 posted)

zlib: denial of service

Package(s):zlib CVE #(s):CAN-2004-0797
Created:August 25, 2004 Updated:June 10, 2005
Description: Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks.
Alerts:
OpenPKG OpenPKG-SA-2005.007 2005-06-10
Fedora-Legacy FLSA:2043 2005-02-23
Conectiva CLA-2004:878 2004-10-25
Slackware SSA:2004-278-02 2004-10-04
Conectiva CLA-2004:865 2004-09-13
Mandrake MDKSA-2004:090 2004-09-07
SuSE SUSE-SA:2004:029 2004-09-02
Gentoo 200408-26 2004-08-27
OpenPKG OpenPKG-SA-2004.038 2004-08-25

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.11-rc2, released by Linus on January 21. Changes this time around include some networking updates (including a "fix" for a NETIF_F_LLTX race condition which was subsequently withdrawn), an ALSA update (to version 1.0.8), some enhancements to the "circular pipe buffers" code introduced in -rc1, the ioctl() method rework, in-inode extended attributes for ext3, some additions to the completion API, some spinlock changes, and fixes for the latest round of security problems. The long-format changelog has the details.

The flow of patches into Linus's BitKeeper repository has slowed as things begin to stabilize for the 2.6.11 release. Changes merged since -rc2 include some architecture updates, the removal of bcopy(), a fix for writable module parameters in sysfs (it never actually worked before), and various fixes.

The current -mm tree is 2.6.11-rc2-mm1. Recent changes to -mm include some random driver reworking, the POSIX high-resolution timers patch set, ACL support for the NFS client, the isochronous CPU scheduler (see below), and some crypto API work.

The current 2.4 kernel is 2.4.29; no 2.4.30 prepatches have been released.

Comments (none posted)

Kernel development news

Low latency for audio applications

Two weeks ago, this page looked at the realtime security module, an addition requested by Linux users who need to be able to ensure that certain applications are able to respond quickly to external events. Musicians working with Linux, in particular, want a system which can keep up with audio streams - a task which requires sub-millisecond response in many cases. Unpatched Linux kernels have generally not been able to provide latencies that low in any sort of reliable way.

The idea of merging the realtime module appears to have been dropped for now; the opposition was too strong. There are a couple of other approaches which are being worked on, however, to meet the audio developers' needs. In particular, Con Kolivas and Ingo Molnar have been creating patches, and audio hacker Jack O'Quin has been tirelessly testing them out. Two approaches which look like they could solve the problem have emerged from this work.

The approach taken by Con Kolivas is the isochronous scheduler patch. This patch, in its current form, creates two new scheduling classes: SCHED_ISO_RR and SCHED_ISO_FIFO. These classes function much like the realtime scheduling classes in that they provide a higher scheduling priority than any SCHED_NORMAL process enjoys. They differ from the true realtime classes, however, in a couple of ways. No privilege is required to enter one of the isochronous classes, so audio applications need not run as root. The scheduler will also automatically select an isochronous class if an unprivileged application attempts to enter a true realtime class, with the result that many audio applications can use the new classes without modification.

The isochronous classes give high-priority access to the CPU, but only to a point. If isochronous processes use more than an administrator-defined percentage of the processor (70% by default), they get dropped back to the SCHED_NORMAL class for a while. This feature prevents high-priority, unprivileged tasks from taking over the system entirely. This is an important feature - the lack of any such protection was the reason for many of the objections to the realtime security module.

Ingo Molnar's approach, instead, is the creation of a new resource limit (initially called RLIMIT_RT_CPU_RATIO, later changed to RLIMIT_RT_CPU). This limit controls what percentage of the processor's time may be taken by all unprivileged realtime processes. If the limit is in effect, the patch also allows any process to enter the realtime scheduling classes. So the end result is similar to that obtained with Con's patch: unprivileged tasks can get realtime access to the processor, but they are prevented from taking over entirely. The difference is that Ingo's patch is somewhat smaller and simpler, and does not require the introduction of new scheduling classes.

The rlimit-based patch is also interesting in that it allows each process to have a different maximum CPU utilization limit. Imagine a system running a set of audio applications where some have their limit set at 60%, and others at 80%. If 70% of the available processor time is actually being used by realtime tasks, processes with the 60% limit will lose their realtime access, but the 80% processes will not. This scheme, thus, allows a smart supervisor (such as the jack server) to arrange for a (relatively) graceful degradation as contention for the CPU increases.

Jack O'Quin's benchmarking suggests that either patch, in their most recent forms, has the potential to solve the problem (though the realtime preemption work may also be required for a complete solution). He appears to favor Ingo's version, however, and its relative simplicity could well argue for taking that path. It does not seem that any decisions have been made, however; it may be that nothing is merged until the 2.6.12 process starts. It does appear, however, that life is about to get a little easier for Linux audio users, which is a good thing. It can be worthwhile to be noisy about your needs, especially if you are willing to put time into helping in the development of the solution.

Comments (7 posted)

A new core time subsystem

Keeping track of the current time is one of the kernel's many jobs. In the Linux kernel, this task is handled in a very architecture-dependent way. Each architecture has its own sources of high-resolution time, and each performs its own calculations. This system works, but it results in quite a bit of code being duplicated across architectures, and it can be brittle. Patches which change time-related code often do not manage to correctly update all architectures.

John Stultz has been working for some months on a cleaner alternative. The result is a new time subsystem which, he hopes, will improve the situation.

Much of the patch can be seen as a refactoring of the time code. Common calculations are now performed in the timeofday core, rather than in architecture-specific code. The code for implementing the network time protocol (NTP), an interesting exercise in complexity itself, has been separated from the rest of the time code and hidden in its own file. Most of the core time code has been reworked to deal with time in nanoseconds, a format which gives adequate time resolution but which, in a 64-bit variable, is still good for centuries. The timeofday code no longer depends on the jiffies variable, meaning that it can work independently of the timer interrupt, which may be disabled in some situations. The overall result is kernel timing code which is much easier to read and understand.

In the end, however, the timing code must go to the hardware to actually get high-resolution time values. John made a couple of observations here. One is that, while time sources are architecture-dependent, many architectures share the same types of timing hardware. The other was that the code which deals with a time source is really just another device driver. So he isolated the time source information into its own structure:

	struct timesource_t {
		char* name;
		int priority;
		enum {
			TIMESOURCE_FUNCTION,
			TIMESOURCE_CYCLES,
			TIMESOURCE_MMIO_32,
			TIMESOURCE_MMIO_64
		} type;
		cycle_t (*read_fnct)(void);
		void __iomem* mmio_ptr;
		cycle_t mask;
		u32 mult;
		u32 shift;
		void (*update_callback)(void);
	};

Here, name is just a name for the source, and priority is used to choose between multiple available sources. The type field tells how this source can be read. If type is TIMESOURCE_FUNCTION, the read_fnct() will be called to read the source. The two _MMIO_ variants are for hardware which can be read directly from I/O memory; in that case, the time code can just obtain a value from the location indicated by mmio_ptr with no need to call any outside functions. TIMESOURCE_CYCLES indicates that the processor's time stamp counter (TSC) is being used, so get_cycles() is called to get the actual value. In any of the above cases, the value returned by the time source is assumed to be some sort of counter. The mask, mult, and shift values are applied to turn a delta between two such values into a number of nanoseconds for the rest of the timekeeping code.

With this structure in place, architecture-specific code need only fill in a timesource_t structure (possibly implementing a read function in the process) and pass it to register_timesource(). All the rest is then handled in the common code. John has provided a set of time source drivers for a few architectures which demonstrates how they can be written.

The discussion of the patches suggests that, while developers like the general intent, there are some remaining concerns - especially among the architecture maintainers. In some architectures, the gettimeofday() system call can be handled entirely in user space, but the current patches do not yet support that. The current NTP implementation is also seen as being too expensive. Finding a way to cut the cost of NTP while maintaining accuracy could be a bit of a challenge, but John is working at it. Expect to see some more iterations on this one.

Comments (none posted)

Some 2.6.11 API changes

A few small internal API changes have been merged for 2.6.11. For the record, here's what they are.

The completion mechanism allows a thread in the kernel to block until a specific event happens. Three new functions, some of which appear to be aiming for the "longest name in the kernel" prize, have been added:

int wait_for_completion_interruptible(struct completion *c);
unsigned long wait_for_completion_timeout(struct completion *c,
	                                  unsigned long timeout);
unsigned long wait_for_completion_interruptible_timeout(struct completion *c,
                                                        unsigned long timeout);

Each of these functions should be relatively straightforward to understand: they add interruptible and timeout variants to the basic wait_for_completion() function. They were added it make it easier to convert more semaphore users over to the completion API, which is more appropriate for cases where a one-shot operation is being waited for. This change is another small bit of fallout from the realtime preemption work.

The kernel has long had an implementation of bcopy():

    void bcopy(const char *src, char *dest, int size);

Arjan van de Ven and Adrian Bunk recently noticed a couple of things: (1) nothing in the kernel was actually using bcopy(), and (2) the implementation was broken. bcopy() is supposed to be able to handle overlapping source and destination areas, but, for a number of architectures, the kernel implementation would not do the right thing with such areas. So a patch was merged which removes bcopy(). No other in-kernel changes were needed, but out-of-tree modules which use bcopy() will need to be changed.

Chip Salzenberg (and others) noticed that a couple of networking functions - skb_copy_datagram() and sock_alloc_send_pskb() - are no longer exported to modules in the 2.6.11 prepatches. This change breaks the out-of-tree VMWare modules. Fixes for VMWare have already been merged.

On the PCI front, a patch from Pavel Machek which changes the prototype of the suspend() method in struct pci_driver was merged. The new prototype is:

    int (*suspend)(struct pci_dev *dev, pm_message_t state);

By changing the type of the state parameter, the patch allows the removal of some translation code and lets PCI drivers know what is really going on at the higher power management levels. Pavel is looking for help in fixing PCI drivers to use the new interface.

A few spinlock primitives have seen changes. For starters, the macro rwlock_is_locked() has been removed. It was never clear whether the macro referred to read or write locking, so Linus dealt with the confusion by just taking it out altogether. Then a new set of primitives was added:

    int read_can_lock(rwlock_t *rw);
    int write_can_lock(rwlock_t *rw);

These test whether an attempt to obtain a read or write lock at that time would have succeeded. In addition, there is a version for regular spinlocks:

    int spin_can_lock(spinlock_t *lock);

This function returns a nonzero value if an attempt to obtain lock would have succeeded, but does not actually modify the lock.

Finally, the name of the internal lock field in the spinlock structure was renamed to slock. This change was made to force the compiler to complain when rwlock primitives are used on a regular spinlock (and vice versa). This sort of type safety could also have been achieved by using inline functions, rather than macros, but some performance problems with gcc prevented that approach from being used.

Comments (1 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

Filesystems and block I/O

Janitorial

Memory management

Architecture-specific

Security-related

  • Fruhwirth Clemens: Add LRW. (January 24, 2005)

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

An Early Look at Ubuntu Hoary

January 26, 2005

This article was contributed by Ladislav Bodnar

After the highly successful launch of Ubuntu Linux last October, all eyes are now on the next release - version 5.04 and code name "Hoary". What can we look forward to? Quite a bit: GNOME 2.10, OpenOffice.org 2.0 (or, at the very least, a beta version of the new package in one of the unsupported repositories), Unicode encoding throughout all applications, better package management with newly introduced update-manager and upgrade-notifier, as well as a set of new Ubuntu live CDs - not only for the i386 architecture, but also for AMD64, IA64 and PPC. With all these ambitious features, Ubuntu is quickly becoming a force to reckon with in the Linux world.

We decided to take an early look at the current state of development at Ubuntu by downloading and installing the Ubuntu "Hoary" Array-3 CD for AMD64. In the Ubuntu terminology, Array-3 is something that other distributions might call Alpha-3; in other words, a highly experimental release. Nevertheless, the developers asserted that the the package is reasonably free of showstopper bugs. We installed it on a system with the following specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2 (Socket939) mainboard from Micro-Star International, 2 GB of DDR SDRAM, 2 x 120 GB Maxtor hard disks, Plextor PX-712A DVD/CD rewritable drive, NVIDIA GeForce4 Ti 4600 graphics card, and a standard 19 inch LCD monitor from Mozo International.

As far as the system installer is concerned, not much has changed since "Warty", Ubuntu's current stable release. The installer is still text-mode, a slightly modified Debian installer that will ship with the upcoming Debian 3.1. Some of the modules have been moved around; for example the screens that prompt users to configure the time zone and setup a user account now appear just after the base system has been installed and before the user is prompted to reboot. Additional packages are installed after the reboot and this is where we ran into some troubles with dependency issues and were promptly dropped into aptitude, a text-mode package manager. Rather than fiddling around in what we thought was an archaic and unintuitive user interface, we quit aptitude and used the command line to "apt-get install ubuntu-desktop", which did the work of installing a graphical desktop with the latest development release of GNOME.

GNOME is the heart of the Ubuntu desktop, and the only supported graphical environment in this distribution. There has been much enthusiasm for the recent GNOME releases, especially since "spatial mode" in Nautilus was accepted as a feature, rather than a bug. With its clean desktop, excellent internationalization, and less complex (compared to KDE) configuration options, GNOME, now backed by Red Hat, Novell and Ubuntu, has matured into a worthy competitor to KDE which, at one point, seemed to be winning the desktop battle. The first beta of GNOME 2.10 (developer version 2.9.90) was released earlier this week and packages are already available in the main repository of the Ubuntu development branch. There will be one more beta, followed by a quick release candidate, before the final release of GNOME 2.10 expected on March 9th, 2005.

What's new in GNOME 2.10? There aren't any real groundbreaking new features, but rather many small improvements that will make our computing lives a little easier. Some applications have been given additional functionalities; as an example, Yelp, the GNOME help browser now supports HTML help (powered by the Gecko rendering engine), man pages and GNU info. Novell Evolution (currently broken on Hoary) has seen many interesting changes with the addition of the "eplugin", an extensible plugin manager for adding extra functionality to the groupware client. The GNOME System Tools package has also been getting much attention lately and a new module for configuring network interfaces and another one for disk management will be making their appearances in GNOME 2.10, or possibly the following release. Many new applets, panel and applet transparency, improved user interfaces for configuring various aspects of the GNOME desktop, and several newly proposed applications to be officially included in GNOME (e.g. Totem, Sound Juicer, Goobox) - all these seeming small but highly effective innovations will complement the already excellent desktop suite.

We would have loved to test the current beta release of OpenOffice.org 2.0, but despite its presence in the "universe" (i.e. unsupported) directory on the Ubuntu download servers, it turned out to be not installable. Also, there are still no native 64-bit packages for OpenOffice.org, so we were left with version 1.1.3, a 32-bit application making use of the ia32-lib compatibility libraries stored in the /lib32 directory. Had we chosen not to install OpenOffice.org on the system, we would have ended up with a pure 64-bit system, with all applications compiled and optimized for the AMD64 processor.

We have already mentioned the Ubuntu live CDs, which represent another interesting aspect of this distribution. These live CDs are now built by the maintainers of Gnoppix, a project that was originally an attempt to develop a Knoppix-like distribution for GNOME users. The latest beta builds of Gnoppix (version 0.9.3) are shaping up to be truly impressive products; they serve not just as live CDs, but also as full installation CDs, depending on the selection one makes in the main menu. It is not quite clear whether these CDs will become the primary means of installing Ubuntu Linux, but it is certainly an attractive idea - this way, users would only need to commit a hard disk partition to the operating system after they have ascertained that the product meet their needs. Based on discussions on Ubuntu forums, these live CDs reportedly work well on Apple hardware, which makes Gnoppix one of the first Linux live CDs available for the Macintosh (the developers at ROCK Linux have also built a full bootable live CD for the Mac).

Although the current alpha version of Ubuntu Linux comes with its fair share of bugs, the developers seem to be on the right track to produce another memorable release in April this year. If you'd like to join the legions of satisfied Ubuntu users, you might consider placing an order for the new Hoary CDs; they ship free of charge - perhaps contrary to any business sense, but certainly true to the spirit of Ubuntu's ideals of humanity and sharing. And that's what Free Software is about.

Comments (16 posted)

Distribution News

Slackware 10.1 beta 1

Patrick Volkerding has sent out a Slackware changelog notice decreeing the first 10.1 beta. There is also a fairly detailed update on his ongoing health issues; click below for the full story.

Full Story (comments: 8)

Mandrakelinux 10.2 beta

The first beta for Mandrakelinux v10.2 has been released. The Mandrakelinux 10.2 Beta information page is the place to go to find out more.

Comments (none posted)

Debian GNU/Linux

Here's the latest Sarge status report with a look at the remaining bugs and other issues. "After the expected slide in activity and backslide in bug count over the holidays, the release team has gotten an aggressive start on the new year, starting off with the arrival of first a new gcc-3.3 (for some ia64 fixes) and then KDE3.3 in testing, allowing us to clear a hefty chunk of release-critical bugs (including numerous security bugs) from the list for sarge."

The debian-volatile project aims to provide reliables updates for stable systems on fast moving targets such as spam filtering and virus scanning. Here's the latest status report for the debian-volatile project.

Comments (none posted)

Ubuntu Linux

Ubuntu has announced that Array CD 3 is ready. This is the third in a series of milestone CD images, released when they're known to be reasonably free of showstopper CD-build or installer bugs, while representing very current snapshots of Hoary. "Pre-release versions of Hoary are *not* encouraged for anyone needing a stable system or anyone who is not comfortable running into occasional breakage. They *are* recommended for Ubuntu developers and those who want to help in testing, reporting, and fixing bugs."

The latest Ubuntu Community Council meeting was held on January 25, 2005. As usual, Mako has made available both the Summary and the full log. The two big issues discussed at the meeting were: changes to the processes through which people can become new members or new maintainers and the idea of instituting reply-to headers for the Ubuntu users mailing list.

Comments (none posted)

Slackware talk at FOSDEM

There's an announcement at Slackware.com that Stuart Winter, "the Slackware Packaging Expert", will be giving a talk on the Slackware packaging system at FOSDEM 2005.

Comments (none posted)

Fedora and Xen: A Quick Start Guide

Xen is now available from the Fedora development repository. "We're following the -unstable Xen tree at the moment which does occasionally lead to things being broken but also lets us track a lot of the more interesting work going on there. Since setting up to run Xen isn't entirely straight-forward, here's a run-through of what should work for setting up a single Xen guest running the Fedora development tree." You can read the guide by clicking below, or visit the FedoraXenQuickStart guide at its new wiki page.

Full Story (comments: none)

Fedora Core updates

FC3 updates cups-1.1.22-0.rc1.8.4 (fixes CAN-2005-0064), alsa-lib-1.0.6-7.FC3 (new version fixes bugs), kernel-utils (update microcode_ctl to 1.11), pam-0.77-66.2 (bug fixes), grep-2.5.1-31.4 (fixes a small regression in handling multibyte input), hal (new upstream release fixes bugs), im-sdk-12.1-10.FC3 (bug fix update), gphoto2-2.1.5-1.1 (version upgrade to 2.1.5), apr-0.9.4-24.2 (rebuild to fix bundled libtool), hal-0.4.7-1.FC3 (new upstream release), gaim-1.1.2-0.FC3 (fixes a great many bugs), tetex-2.0.2-21.3 (fixes xpdf buffer overflow CAN-2005-0064).

FC2 updates cups-1.1.20-11.10 (fixes CAN-2005-0064), gaim-1.1.2-0.FC2 (fixes a great many bugs), tetex-2.0.2-14FC2.2 (fixes xpdf buffer overflow CAN-2005-0064).

Comments (none posted)

Mandrakelinux MDKA-2005:004

Mandrakelinux has updated php packages with bug fixes.

Full Story (comments: none)

New Distributions

EzPlanet One Linux

EzPlanet One Linux is a Linux distribution tuned for Enterprise solutions. EzPlanet One integrates advanced technologies, flexibility, quality and security. Built with the Enterprise in mind, it features also several tools for the Professionals and Individual users, that make its use more fun. EzPlanet One version 2.0 was released January 2005.

Comments (none posted)

Distribution Newsletters

Debian Weekly News

Here's the Debian Weekly News for January 25, 2005. This week you can read about experimental packages of Exim4 linked against db4.2, a guideline on using the new debian-installer, a Sarge release progress update, a status update for volatile archive, and several other topics.

Full Story (comments: none)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of January 24, 2005 is out. This week's topics include OpenSolaris and Portage support, new kernel profiles for 2005.0, Genesi Open Desktop Workstation with Gentoo pre-installed, Gentoo first to run on Mac Mini, and more.

Full Story (comments: 2)

Ubuntu Traffic #17

The 17th issue of Ubuntu Traffic is out. The author is still working to catch up to 2005; this issue covers the second week of the Mataró conference, with looks at Rosetta, accessibility, security, Python, and more.

Comments (none posted)

DistroWatch Weekly Issue 84

The DistroWatch Weekly for January 24, 2005 is out. "Welcome to this year's 4th issue of DistroWatch Weekly! We comment on why we believe that there is no reason to worry about the future of Slackware Linux, reveal a new RPM package resource for SUSE users, and point out a fresh controversy occupying some of the Debian developers - XFree86 versus X.Org. Also, don't miss the newly released Linux+ Live DVD and a new distribution for Farsi (Persian) speakers - Parsix GNU/Linux. Enjoy!"

Comments (none posted)

Minor distribution updates

Arch Linux 0.7 released

Arch Linux 0.7 has been released. Information on changes is relatively sparse, but this changelog shows improved 2.6 support, udev, X.Org, and more. (Thanks to Xavier de Laboure).

Comments (2 posted)

Gnoppix

Gnoppix has released GNOPPIX Developer version 0.9.3b3 Hoary for PowerPC, AMD64 and Intel i386 Platforms. This version comes with Gnome 2.9.3 and Xorg.

Comments (none posted)

Openwall GNU/Linux

Openwall GNU/Linux has released a patched Linux 2.4.29-ow1 which fixes several recent vulnerabilities. The Openwall (Owl) distribution now uses that kernel and moves to GCC 3.4.3 and glibc 2.3.3+.

Full Story (comments: none)

tinysofa

tinysofa classic server 1.1 Update 3 (Rio) is now generally available. Take a look at the change log for details.

Comments (none posted)

Newsletters and articles of interest

The Month in BSD: December 2004 (O'ReillyNet)

O'ReillyNet summarizes BSD news. "OpenBSD switches to GCC 3, NetBSD releases 2.0, FreeBSD meets its donation mark, and DragonFly BSD starts to implement journaling. Sam Smith reports the BSD news for December 2004."

Comments (none posted)

Distribution reviews

Yoper: A next-generation OS? (LinuxTimes)

LinuxTimes reviews the Yoper Operating System (YOS) "Yoper Operating System (YOS), or Yoper GNU/Linux if you prefer, was an eye-opener even for someone who has used over fifty GNU/Linux distributions. Everything just seemed to work, and it was as simple as that. Could this be the answer to the Microsoft problem?"

Comments (none posted)

My workstation OS: Ubuntu (NewsForge)

Here's a mini review of Ubuntu Linux, on NewsForge. "I've found a Linux distribution that meets my criteria for an ideal system. Ubuntu Linux is fast. It has simple software updating and installation through Debian's Synaptic package manager. All of my removable media works automagically. It detected all of my hardware. And above all, it has a simple, clean, elegant interface that I love."

Comments (none posted)

VidaLinux 1.1 -- Gentoo Done Right (Mad Penguin)

Mad Penguin takes a look at VidaLinux 1.1. "So we've established that VidaLinux is based on Gentoo right? It is. Isn't Gentoo just Gentoo either way you cut it? Well, not really. What sets VidaLinux apart from its parent is actually twofold. The first thing you'll notice is that it uses Red Hat's Anaconda installer. With VidaLinux there is no need to print out a tens of pages of documentation to install your system via the command line interface. Everything is done using the graphical Anaconda interface. This provides a huge benefit to those who might have been intimidated by Gentoo Linux but want to give it a shot."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Matplotlib - Data Plotting in Python

Matplotlib is an easy to use plotting library with the capability of generating a wide variety of data plots.

matplotlib is a python 2D plotting library which produces publication quality figures using in a variety of hardcopy formats and interactive GUI environments across platforms. matplotlib can be used in python scripts, interactively from the python shell (ala matlab or mathematica), in web application servers generating dynamic charts, or embedded in GUI applications.

[Matplotlib] Matplotlib supports a wide variety of plotting commands; the pylab interface can be used for those who already know Matlab, a popular commercial mathematical application.

A comprehensive tutorial is available for educational purposes and the screenshots page has numerous examples of matplotlib in action, including example code for each plot. The FAQ document contains additional usage information. Matplotlib lives up to its claim of being easy to use, just a few lines of code are all that is required to produce professional looking output.

Installation of matplotlib is fairly straightforward, your editor had no problem making it work on an older Red Hat 9 system, the Fedora Core 3 installation is still proving to be somewhat tricky due to dependency issues. Matplotlib requires Numerical Python (now called Numarray), which in turn requires several additional libraries.

Version 0.71 of Matplotlib was announced this week. The changes include:

  • The numerix module has been reorganized to improve namespace issues.
  • Contours now use the default colormap.
  • The colorbar system now works with arbitrary axes.
  • New accents are available in the mathtext command.
  • Numerous bugs have been fixed.
  • Other minor enhancements are included.
See the what's new document for more details on this release.

If you are looking for a fairly straightforward way to generate automated or manually created data plots, Matplotlib is worth investigating. The source code is available for download here.

Comments (6 posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new versions of apt, Muse, Fweelin, Liblo, Qjackctl, Seq24, and Alsa.

Comments (none posted)

Database Software

AMD64 Builds of Firebird 1.5.2 are recalled

The Firebird Database project has announced a recall of Firebird 1.5.2 for the AMD64 platform. "Because some potential corruption problems have shown up with pre-existing databases on the AMD64 Linux installations of Firebird 1.5.2, the kits have been recalled to the pre-release area for further testing."

Comments (none posted)

FlameRobin version 0.2.0 released (GnomeDesktop)

GnomeDesktop.org covers the release of FlameRobin 0.2.0 ALPHA, a Firebird database administration tool. "It now comes with property sheets and editors for most database objects, brand new background backup & restore features and a MacOS X port. Not to mention the new program logo, new home on sf.net."

Comments (none posted)

Mammoth PostgreSQL Replicator 1.4 Released (Updated)

Version 1.4 of Mammoth PostgreSQL Replicator is available. Changes include support for live promotion, non-blocking full dump, and bug fixes.

Full Story (comments: none)

PostgreSQL General Bits

Issue #94 of PostgreSQL General Bits is online after a long sabbatical. "General Bits is a column loosely based on the PostgreSQL mailing list pgsql-general." Take a look to read about PostgreSQL 8.0.0 and other topics.

Comments (none posted)

Filesystem Utilities

EVMS 2.5.1 Released (SourceForge)

Version 2.5.1 of the Enterprise Volume Management System has been announced. "This is the first maintenance release in the EVMS 2.5.x series, and is primarily intended to fix some recent bug-reports, as well as to update to the most recent kernel and Device-Mapper releases."

Comments (none posted)

Interoperability

Samba 3.0.11pre2 Available for Download

Version 3.0.11pre2 of Samba is available. Changes include new net rpc command options, assignable rights for specific SIDs, and bug fixes.

Full Story (comments: none)

Mail Software

Bogofilter 0.93.5 Released

Version 0.93.5 of Bogofilter, a Bayesian spam filter, has been released. "The big change since the stable release (version 0.92.8) is that Berkeley DB support now the Transaction API to allow multiple readers and writers for wordlists. Be sure to read file README.DB and the RELEASE.NOTES file if upgrading from 0.92.8 (or any older version)."

Full Story (comments: none)

Networking Tools

Build a push proxy gateway on Linux (IBM developerWorks)

Manas Ranjan Behera explains how to build a push proxy gateway in an IBM developerWorks article. "Learn how to set up a PPG on your own, configure the settings to your own taste, develop push content, and test it with a mobile handset simulator over a TCP/IP network on a LAN."

Comments (none posted)

Printing

GPL Ghostscript 8.15 Integration In Progress

The CUPS printing project has posted a status update concerning the GPL version of Ghostscript. "We are in the process of integrating ESP Ghostscript with the GPL Ghostscript 8.15 baseline."

Comments (none posted)

Web Site Development

Midgard 1.6.2 released

Version 1.6.2 of the Midgard Open Source Content Management Framework has been announced. "This release doesn't provide any new features, it is bugfix release which makes midgard much more easier to install and much more stable for running production environments."

Full Story (comments: none)

mnoGoSearch 3.2.30 released

Version 3.2.30 of mnoGoSearch, a web site search engine, is out. See the change history for details. Also, new versions of mnoGoSearch-php and mnoGoSearch-php-extension are available.

Comments (none posted)

MoinMoin 1.3.2 Released

Version 1.3.2 of MoinMoin, a Python-based wiki package, is out with a fix for an ACL problem.

Comments (none posted)

Tiki 1.8.5 - Polaris- released (SourceForge)

Version 1.8.5 of Tiki, a CMS/Groupware application, has been announced. "Tiki admins are strongly urged to upgrade to this version due to vulnerabilities in versions prior to 1.8.5 that can lead to unauthorized remote control."

Comments (none posted)

Desktop Applications

Audio Applications

Ardour 0.9beta24 released

The 0.9beta24 release of Ardour, a multi-track audio recording application, is out with this explanation: "Well, originally, 0.99 was due to be the next release, but Ron Parker and his trusty intern Spencer uncovered some significant usability issues with xfades and region layering. Fixing this required substantive codes changes, and I want to make a 0.9beta24 release to help flush out any issues."

Full Story (comments: none)

Snd-ls V0.9.2.0 released

Version 0.9.2.0 of Snd-ls, a distribution of the sound editor Snd, is available. Here is the change log entry: "Updated SND to v7.10 from 20.1.2005. Many important changes".

Full Story (comments: none)

Desktop Environments

GNOME Software Announcements

The following new GNOME software has been announced in the last week:

Comments (none posted)

KDE CVS-Digest for January 21, 2005 (KDE.News)

The January 21, 2005 edition of the KDE CVS-Digest is online with the following content summary: "Ruby Kdebindings now support .kcfg files. KDevelop adds source navigation history. KChart adds print support. KWin adds translucency support. A new HighContrast style added for partially sighted users."

Comments (none posted)

KDE 3.4 Beta 1 Screenshots (KDE.News)

KDE.News mentions the posting of some screenshots for KDE 3.4 Beta 1. "KDE 3.4 Beta 1, christened Krokodile, was released not too long ago. For those of you who have not yet taken the plunge, Eudpytula Minor has announced some Krokodile screenshots for your viewing pleasure."

Comments (none posted)

Games

Cyphesis 0.3.8 Released

Version 0.3.8 of Cyphesis, a server for WorldForge games, has been released. "This version includes the demo game Mason which is currently in development. This release is intended for server administrators wishing to run a Mason server or anyone wishing to work on serverside game development. The major new feature in this release is the ability to run cyphesis completely stand alone without need for a database backend, or any of its library dependencies given a suitably configured binary."

Comments (none posted)

GUI Packages

Qt 3.3.4 Release and Qt 4 Schedule Adjustment (KDE.News)

KDE.News mentions the latest release schedules for Qt 3.3.4 and 4.0. "Trolltech has announced the release of Qt 3.3.4 which is a maintenance release including many bug fixes and optimizations. The final Qt 4.0 release is now anticipated for late second quarter of 2005 with two interim beta versions to be released in March and May."

Comments (none posted)

Learn how to program cool GNOME and Gtk+ apps using PyGTK (GnomeDesktop)

GnomeDesktop.org mentions the latest release of the PyGTK tutorial. "The PyGTK tutorial makes even easier and funnier learning how to program graphical applications using Python and Gtk+ that work seamlessly on GNU/Linux, *BSD or MS-Windows. These updates include new information about features and widgets added to Gtk+ 2.4."

Comments (none posted)

Imaging Applications

GIMP 2.2.3 Released (GnomeDesktop)

Version 2.2.3 of the GIMP has been announced. "With the release of version 2.2.3 of the GNU Image Manipulation Program, the GIMP developers hope to have eliminated most, if not all, of the regression bugs that kept people from upgrading from GIMP 2.0. GIMP 2.2 is now at the point where everyone should be using it. Of course the 2.2 tree will be maintained further, but GIMP developers will now be able to focus on the development branch again."

Comments (none posted)

Instant Messaging

Gaim 1.1.2 is out

Version 1.1.2 of Gaim, an instant messaging client, has been released. "It contains some minor bug fixes, and a working HTTP connection method for MSN. This should help out people behind strict firewalls. We also have SecurID login support for AOL accounts that require it, thanks to an anonymous user for help getting that working."

Comments (none posted)

Mail Clients

Mozilla Thunderbird Gains Phishing Detection (MozillaZine)

As reported in MozillaZine, the latest Thunderbird builds now include some simple heuristics designed to detect (and warn about) phishing scams.

Comments (none posted)

Music Applications

orDrumbox v0.5 rpm version released (SourceForge)

Version 0.5 of orDrumbox, a cross-platform drum machine, is available. "orDrumbox is a Software Drum Machine and Audio Sequencer in Java. Create songs, use Drum Kits and have creative automatic composition features."

Comments (none posted)

Office Applications

Gnumeric 1.4.2 Released (GnomeDesktop)

Version 1.4.2 of the Gnumeric spreadsheet has been announced. Changes include Win32 improvements, rotated text support, and bug fixes. See the release notes for details.

Comments (none posted)

Web Browsers

Mozilla Links Newsletter

The January 24, 2005 edition of the Mozilla Links Newsletter is online with the latest Mozilla browser news and reviews.

Full Story (comments: none)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the January 10, 2005 mozilla.org staff meeting are online, here's the content summary: "Issues discussed include Mozilla 1.8 Alpha 6, Mozilla Thunderbird, Mozilla Firefox, the Roadmap and accessibility."

Comments (none posted)

mozilla.org Staff Meeting Minutes (MozillaZine)

The minutes from the January 18, 2005 mozilla.org staff meeting have been announced. "Issues discussed include update.mozilla.org, feedback on Mozilla 1.8 Alpha 6, Mozilla Firefox 1.1, Mozilla Thunderbird 1.1, CDs, infrastructure, @mozilla.org email changes, press articles and conferences."

Comments (none posted)

Languages and Tools

C

Use reentrant functions for safer signal handling (IBM developerWorks)

Dipak K. Jha discusses reentrant C functions on IBM developerWorks. "If you deal with concurrent access of functions, either by threads or processes, you can face problems caused by non-reentrancy of the functions. In this article, learn through code samples how anomalies can result if reentrancy is not ensured, especially with regard to signals. Five recommended programming practices are included, along with a discussion of a proposed compiler model in which the compiler front end deals with reentrancy."

Comments (none posted)

Caml

Caml Weekly News

The January 18-25, 2005 edition of the Caml Weekly News is out, take a look for a number of new Caml language articles.

Full Story (comments: none)

Java

Software Infrastructure Bottlenecks in J2EE (O'Reilly)

Deepak Goel shows how to analyze J2EE bottlenecks on O'Reilly. "Scalability is one of the most important non-functional requirements of a system. But there could be several bottlenecks within a system, which might prevent it from being scalable. In this article, we try to analyze the case in which the software infrastructure becomes a bottleneck, long before any of the hardware resources (such as CPU, memory, disk space, and network speed) are fully consumed."

Comments (none posted)

Java theory and practice: Generics gotchas (IBM developerWorks)

Brian Goetz discusses Java Generic types on IBM developerWorks. "Generic types, added in JDK 5.0, are a significant enhancement to type safety in the Java language. However, some aspects of generics may seem confusing, or even downright bizarre, to first-time users. In this month's Java theory and practice, Brian Goetz examines the common pitfalls that ensnare first-time users of generics."

Comments (none posted)

Lisp

GCL 2.6.6 released

Version 2.6.6 of GCL (GNU Common Lisp) is out. "This version, the latest in the `stable' series, changes the format of executable files and fixes a batch of bugs."

Full Story (comments: none)

LTK 0.8.7 released

Version 0.8.7 of LTK, the Lisp Toolkit, is available. "This version adds several new methods and arguments to MAKE-INSTANCE."

Full Story (comments: none)

Perl

The Phalanx Project (O'Reilly)

Andy Lester talks about The Phalanx Project on O'Reilly. "The primary goal of Phalanx is to increase the quality of a given module's test suite, mostly by increasing the amount of the module's code that the tests cover. However, there are secondary goals because we're working with the code anyway. The first sub-goal is to find hidden bugs. As we add tests to modules, we hope to uncover broken functionality."

Comments (none posted)

This Week in Perl 6 (O'Reilly)

The January 20, 2005 edition of This Week in Perl 6 is available with a new round of Perl 6 language topics.

Comments (none posted)

PHP

PHP Weekly Summary for December 26, 2004

The PHP Weekly Summary for December 26, 2004 is out. Topics include: Why we don't promote Apache 2, endian detection, allow_url_include, PHP 4.3.11/5.0.4 pending, PHP 5.1 in the manual, ReflectionClass::hasMethod, CVS karma, PZVAL_UNLOCK, CVS closed for Christmas, Oracle Instant Client support, openssl non-blocking negotiation, and a little black magic, and php.ini stuff.

Comments (none posted)

PHP Weekly Summary for January 3, 2005

The PHP Weekly Summary for January 3, 2005 is out. Topics include: Of chickens, eggs, and Apache 2 (again) realpath_cache revisited, Startup order, PHP 4.3.11 and 5.0.4, Shared libraries, Shutdown order and dl, php_hostconnect, extract issues, win32 build issues, Geeks and superheroes, and Internet family.

Comments (none posted)

PHP Weekly Summary for January 10, 2005

The PHP Weekly Summary for January 10, 2005 is out. Topics include: Bit of an odd bug, php_sprintf, constant names, $host_alias check, EXTENSIONS file, FD_CLOEXEC, and A noisy week.

Comments (none posted)

PHP Weekly Summary for January 17, 2005

The PHP Weekly Summary for January 17, 2005 is out. Topics include: html_entity_decode, Type hinting, buildconf vs autoconf, static method invoked by ...?, To BC or not to BC?, PIC/non_PIC, sqlite_key, External internals, mbstring, and Commercial interests.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The January 23, 2005 edition of Dr. Dobb's Python-URL! is online with the latest Python language discussions.

Full Story (comments: none)

python-dev Summary

The December 1-15, 2004 Python-dev Summary is online with a summary of the python-dev mailing list traffic for that timeframe.

Full Story (comments: none)

Python Spread Module 1.5 final released

Version 1.5 of the Python Spread Module, a Python wrapper module for the Spread messaging service toolkit, is out. "The primary visible changes since release 1.4 are Mark McClain's new code to give Mailbox objects a multigroup_multicast() method, and that the Windows build now works with Spread 3.17.3."

Full Story (comments: none)

A Byte of Python version 1.20

Version 1.20 of the online book A Byte of Python is available. "This new version is a rewrite of the book and I've improved the explanations of most of the examples and added some new examples as well."

Comments (none posted)

Pyrex extends and speeds Python apps (IBM developerWorks)

David Mertz examines Pyrex on IBM developerWorks. "The author takes a stab at speeding up his pure-Python version of hashcash using Pyrex, a language for writing Python extension modules that lets you avoid having to use C for the job. He contrasts writing code in Pyrex -- generally for use with larger Python applications -- with speeding up Python applications using the Psyco compiler, which he has written about previously on developerWorks."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The January 23, 2005 edition of Dr. Dobb's Tcl-URL! is online with the latest Tcl/Tk news.

Full Story (comments: none)

XML

An early look at sXBL (IBM developerWorks)

Elliotte Rusty Harold introduces sXBL on IBM developerWorks. "SVG's XML Binding Language -- sXBL -- is an XML vocabulary being developed at the W3C as a means of mapping XML elements in arbitrary vocabularies to Scalable Vector Graphics (SVG) pictures that represent those elements. For example, an XML Metadata Interchange (XMI) document can be turned into SVG code that shows the actual Unified Modeling Language (UML) diagram encoded in the XMI document. But sXBL takes the separation of presentation from content one step further: It is a generic language for rendering documents as arbitrarily complex two-dimensional pictures."

Comments (none posted)

IDEs

The anjuta story (GnomeDesktop)

GnomeDesktop presents a history of the Anjuta IDE. "It was back in 1999 when Naba Kumar released the first buggy alpha version of Anjuta, an IDE for GNOME which should pack together all the great command line development tools in linux and make software development easy on GNOME desktop."

Comments (none posted)

Ultimate++ 0.98.3 released (SourceForge)

Version 0.98.3 of Ultimate++ has been announced. "Ultimate++ is the new generation C++ Windows/Linux open-source development platform. By utilizing a couple of new principles Ultimate++ achieves significant reduction of code complexity and this way it saves the developments costs. Ultimate++ based application sources tend to be significantly shorter (~50%) than equivalent applications using any other C++ platforms."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Linux Inc. (Business Week)

Business Week has taken a lengthy look at how Linux is developed. "Linux Inc. has become so mature that it's clear it could continue to thrive even without Torvalds. Already his chief lieutenant, Andrew Morton, shares leadership duties and makes all the public appearances. From 1997 to 2003, when Torvalds worked for chipmaker Transmeta Corp., putting out Linux wasn't even his full-time job -- yet its market share in servers rose from 6.8% to 24%." There's a picture of Linus and a penguin on the cover as well.

Comments (7 posted)

Open Source Database - Will Proprietary Databases Survive? (IT-Director)

Robin Bloor notes that the open source database scene is getting crowded. "Can so many Open Source database products survive? I personally doubt it, but I may be wrong. They may all generate a healthy and sizable submarket that justifies their existence and, with Open Source products, it doesn't really matter how big the user base is, as long as it is big enough to generate the support network necessary to keep the product evolving and relevant. (CA is already reporting that it is making a profit from its "open sourcing" of Ingres - which probably means that Ingres has a brighter future as an Open Source product than it had as a proprietary solution)."

Comments (8 posted)

Trade Shows and Conferences

Third Osnabrueck PIM Meeting (KDE.News)

KDE.News covers the annual meeting of KDE PIM hackers. "With over 40 bugs fixed, some interesting features implementented, the Kolab hackers participating, and the draft for GroupDAV revised with Helge Hess from OpenGroupware.org, this meeting was not only a successful boost of KDE PIM development, but also for PIM client-server interoperability in general." The meeting overview is online with more information.

Comments (none posted)

Guido van Rossum at Amazon DevCon

Guido van Rossum's presentation at the Amazon DevCon event on January 25 is online with part one and part two.

Comments (none posted)

The SCO Problem

The Wells Discovery Ruling - Grants in Part, Denies in Part (Groklaw)

There has been a ruling on SCO's discovery motion against IBM; the text is available on Groklaw. "Accordingly, the court HEREBY ORDERS IBM to provide in a readily accessible format all versions and changes to AIX and Dynix. In essence, the court is ordering production of the information contained within the CMVC and RCS systems without granting SCO complete access at this time."

Comments (5 posted)

SCO's outlook is a bleak house (ZDNet)

ZDNet sums up the state of SCO v. IBM. "More importantly, the relevance of this case to open source software in general has been demonstrated to be small or nil, SCO's intemperate blustering notwithstanding. Forget Darl McBride's sabre rattling about the GPL being against the US constitution: the case is as it seemed when everything kicked off in 2003, a result of SCO's affronted sensibilities at the way IBM ditched Project Monterey."

Also worth a note: Netcraft has put up a brief article poking fun at SCO for taking 10 months to put out an OpenSSL patch.

Comments (2 posted)

The Tables Are Turned - SCO Objects to IBM's Discovery Demands (Groklaw)

As seen on Groklaw, the latest episode in the SCO drama has SCO complaining that IBM's discovery demands are excessive. "And we now have the hilarious opportunity to watch SCO tell the court how burdensome it would be for SCO to have to produce to IBM every product Caldera distributed for the past 6 years. These are the same folks who whined until they got not only every released version of AIX and Dynix going back to the '80s but every *unreleased* one also, in their own discovery demands."

Comments (5 posted)

Companies

Intel lets Linux into Centrino camp (News.com)

News.com covers Intel's move to allow Linux laptop vendors to use the Centrino logo. "Although Linux can run on existing Centrino notebooks, Intel until now wouldn't permit companies to sell Linux laptops using the Centrino logo. The reason for the change: With the release of the 2.6.8 Linux kernel, the open-source operating system's power management abilities now meet Intel's requirements for Centrino notebook battery life, said Karen Regis, manager of mobile programs and promotions at the chipmaker."

Comments (none posted)

Ben Goodger Going to Google (MozillaZine)

MozillaZine covers the move of Ben Goodger from Mozilla to Google. "Ben Goodger announced today on his weblog that he has left the Mozilla Foundation to take a position at Google, but will continue his roll as leader of the Firefox project. He gives no details of his or Google's plans, but we expect things like support for Mozilla in Google's desktop search and a Google toolbar for Firefox can't be far off."

Comments (none posted)

Linux Adoption

Vienna takes the boldest step of all - asking the users (ZDNet)

ZDNet UK looks at Vienna's approach to free desktop deployment. "The decision to switch -- or not -- will be made on the unholy trinity of practicality, lack of hassle and lowest expense; these are base desires, but commendable. They are precisely the mundane reasons on which any grand design will eventually prosper or founder. For this reason, Vienna will be a bellwether, and we should watch the results carefully."

Comments (8 posted)

Linux at Work

Penguin power serves up Aus open scores (Computerworld)

Computerworld looks at the use of Linux in the Australian Open tennis tournament. ""This year, for the first time we have installed an eServer i5 520 running the Internet scoring system and the Web site staging server on Linux," Simpfendorfer said. "At the core of the technology used to deliver the official Australian Open Web site are IBM's iSeries i5 running Linux on a Power chip, IBM Intel-processor based xSeries servers running Linux, and IBM pSeries servers running AIX.""

Comments (1 posted)

Legal

Decision about software patents postponed (Heise)

Heise Online catches up with the current state of the software patent fight in Europe. "In the meantime, the EU Council has also officially confirmed that the concerns that Poland still has about the directive for software patents will not be on the agenda of the meeting of agricultural ministers in the Council of Agriculture and Fisheries, nor does the directive appear on the list of the items to be resolved without discussion ("A items"). In other words, the official adoption of the paper has once again been postponed unless there is some last-minute attempt within the Council this Monday to have the measure voted on." It could still come back next week, apparently.

Comments (none posted)

Interviews

FireFox Rising (Red Hat Magazine)

Red Hat Magazine interviews Chris Blizzard. "Chris Blizzard has been with Red Hat since 1998. He also sits on the board of the Mozilla Foundation. We asked him to share some of his insights about Mozilla's remarkable return to prominence."

Comments (none posted)

FreeBSD's SMPng (O'ReillyNet)

Here's an O'ReillyNet interview with Scott Long, one of FreeBSD's core developers. "Over the past five years, the FreeBSD developer team has worked very hard to improve performance on multiprocessor systems. Their goal was to remove the big kernel lock used in the 4.x branch, and replace it with fine-grained SMP support. This project, often referred to as SMPng ("SMP next generation"), was a very big effort and took four releases (from 5.0 to 5.3) to reach stable status. Federico Biancuzzi interviewed FreeBSD Core member Scott Long about the SMPng technology, the current implementation status, future goals, and plans."

Comments (6 posted)

Interview: Timothy Miller (KernelTrap.org)

Jeremy Andrews interviews Timothy Miller, of the Open Graphics Project, on KernelTrap.org. "Timothy Miller is a long time developer of graphics chips and drivers. He has observed that there is a growing trend by graphics hardware vendors to provide less and less information to free and open source operating system developers. Without this information, it is becoming more and more difficult to purchase new graphics hardware that is stable and reliable on Linux and other free and open source operating systems. In response, Timothy worked with his employer, Tech Source, to form the Open Graphics Project."

Comments (8 posted)

Resources

Networking in NSA Security-Enhanced Linux

James Morris has written an article on protecting a network server with SELinux. "In this article we take a look at how SELinux can help increase the security of networked systems, as well as the design and implementation of its network-specific security controls. We then walk through an example of using SELinux policy to lock down a simple network application."

Comments (2 posted)

Rolling with Ruby on Rails (O'ReillyNet)

O'ReillyNet shows how to build a simple web application using Rails. "Maybe you've heard about Ruby on Rails, the super productive new way to develop web applications, and you'd like to give it a try, but you don't know anything about Ruby or Rails. This article steps through the development of a web application using Rails. It won't teach you how to program in Ruby, but if you already know another object-oriented programming language, you should have no problem following along (and at the end you can find links on learning Ruby)."

Comments (3 posted)

USB Wi-Fi adapter support in Linux (NewsForge)

Keith Winston sets up USB Wi-Fi adapter support in Linux, on NewsForge. "I needed to connect my new desktop PC wirelessly from my second floor office to my first floor network. As I started researching the options for wireless USB adapters, I realized I might have some work ahead of me. Wireless USB in Linux is still in the early stages of development. But a little searching and some trial and error led to a successful connection."

Comments (8 posted)

Design by Wiki (O'Reilly)

Jason R. Briggs shows how to use a wiki site for collaborative design of documentation. "Eventually I decided HTML was the obvious way to go and began writing specifications with carefully designed (standards compliant!) style sheets; with hrefs linking them together rather than oddball references in a Word doc. When a colleague installed MediaWiki for various other documentation requirements, it was a head-slapping, Homer Simpson-style Doh! moment."

Comments (none posted)

Reviews

OpenOffice.org database application: A first look review (NewsForge)

NewsForge takes a look at a new database application for OpenOffice.org. "This story will discuss the OpenOffice.org Base and how it can be used in your business. I'll touch on the similarities (plus differences) with the OpenOffice.org database program and Access. I'll continue with a little commentary on migration issues. We'll finish up by building a basic contact database, a form, a query, and a report using the wizards. If you are already an OpenOffice.org believer, you can just skip down to the "build a quick database application" section to see how it works."

Comments (6 posted)

In-depth review of Inkscape (GnomeDesktop)

GnomeDesktop points to a long and detailed review of the current release of Inkscape on Stopped Clock. "I thought that if I have to do the icons in SVG ever again, I may as well revisit the river. Since I just upgraded to Ubuntu Hoary (Gnome 2.10 is slick!), I gave Inkscape a try again. Since I'm an old Illustrator junkie, I knew it's going to be tough getting used to especially since I've tried and failed before. I expected being disappointed, I was surprised in many areas though. Looks like a lot of good stuff happened while I wasn't watching :) I'm actually confident that it's usable to create less complex artwork."

Comments (1 posted)

Pyrex extends and speeds Python apps (developerWorks)

developerWorks takes a detailed look at Pyrex, a language specifically designed for the creation of Python extension modules. "In well-chosen cases, a Pyrex module can run 40-50 times faster than a Python version of the same module. But in contrast to writing the module in C, per se, the Pyrex version will hardly be any longer than the Python version, and the code will look much more like Python than like C."

Comments (2 posted)

Innovations in window management (NewsForge)

This NewsForge article searches for extensible window managers. "In the past year, a number of small window managers have appeared that emphasize scriptable extensibility. My favorite is Kahakai, a Waimea derivative with support for Python scripting. Unfortunately, Kahakai is no longer under active development. Many of the former Kahakai developers have contributed to the Aegis project, which is still not mature enough to adequately assess. I have also looked at PyEvilWM, a Python-enhanced derivative of the lightweight keyboard-oriented window manager EvilWM. Fluxbox users may be interested in FluxSpace, a Fluxbox derivative with support for Python scripting."

Comments (14 posted)

Reviewing the Architecture of the World Wide Web (O'Reilly)

Harry Halpin reviews the W3C document Architecture of the World Wide Web on O'Reilly. "The most significant networked application development yet is the World Wide Web, which has made the the personal computer a must-have item, and a web address as crucial as a phone number for a successful business. This is only the beginning; from web services to the Semantic Web, the web is changing fast. Yet no matter how fast things change, some things remain the same; this holds true for the principles of web architecture. Publication of the "Architecture of the World Wide Web" by the W3C hopes to codify these principles."

Comments (none posted)

Miscellaneous

Retail geeks aren't geeky enough (NewsForge)

Jay Lyman describes the dismal Linux support experience he received from mainstream vendors Best Buy, Circuit City, CompUSA, and Dell. "Calls to three local stores in Oregon proved somewhat disappointing, as the dreaded Linux (incorrectly pronounced L-eye-nux) bewilderment continued. The first store, in Portland, routed my call to computer support, which rang indefinitely with no answer. The second call was to the Best Buy in Beaverton, home to the Open Source Development Labs (OSDL). However, during regular store hours on a regular business day, there was no answer, no answering service, no re-route -- nothing but ringing."

Comments (19 posted)

Firefox 1.0 Launch Day

Mozilla Foundation president Mitchell Baker has posted a blog entry about the release of Firefox 1.0. "After a while the anticlimactic feeling faded as we began to get information about the number of downloads and the general reception of Firefox. As best we can figure it, around 1,000,000 people came to download Firefox on the first day alone. That's an astonishing number, far beyond what we had seen before. As Chris Hofmann put it, the building at the Mozilla Foundation might seem quiet, but the wires were burning up at Oregon State!"

Comments (none posted)

PHIELD - Publc Health Integration and Exchange of Lab Data (LinuxMedNews)

LinuxMedNews looks at the PHIELD project. "The PHIELD project implemented a first generation solution by developing an end-to-end model comprised of Open Source software and documentation for filtering and reporting from a local LIS to the National Electronic Disease Surveillance System (NEDSS) implementation in Nebraska utilizing the Public Health Information Network (PHIN) architected by the Centers for Disease Control and Prevention (CDC)."

Comments (none posted)

Debian developer to head Linux Australia (Sydney Morning Herald)

The Sydney Morning Herald covers the election of Jonathan Oxer as President of Linux Australia. "Also voted in during the elections which concluded on January 15 were Pia Smith (vice-president), Anthony Towns (secretary), Mark Tearle (treasurer), Andrew Cowie, Geoffrey Bennett, and Stewart Smith (ordinary committee members)."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

The EFF Endangered Gizmos List

As a way of demonstrating the cost of overly restrictive intellectual property laws, the EFF has put up an Endangered Gizmos List listing the gadgets which could become illegal - and a few which are already extinct.

Comments (1 posted)

Mitchell Baker Returning to Mozilla Full Time (MozillaZine)

MozillaZine reports that Mitchell Baker will return to Mozilla. "Mitch Kapor, Chair of the Mozilla Foundation and President and Chair of the Open Source Applications Foundation, has announced that Mozilla Foundation President Mitchell Baker will return to working on the Mozilla project full time. She will continue to be an employee of OSAF and will retain her seat on OSAF's board."

Comments (none posted)

Commercial announcements

Black Duck Software joins OSDL

Black Duck Software has announced that it has joined the Open Source Development Labs (OSDL). "Black Duck Software helps businesses expand their use of open source software by providing products and services for understanding and safely managing software licensing compliance. The company's protexIPT system brings developers, lawyers, and business decision-makers together and enables enterprises to take advantage of the dramatic cost, quality, and time-to-market benefits that open source provides."

Full Story (comments: 1)

State of Oregon, OSDL, and Others Pledge Support to New Open Technology Center

OSDL CEO Stuart Cohen was joined by Governor Kulongoski of Oregon and others at a press conference to unveil the Open Technology Business Center. "The Open Technology Business Center, created with $1.2 Million from the city of Beaverton, is a first-of-its-kind facility dedicated to supporting the formation, funding and growth of new companies in the Open Technology sector. Programs include an Open Technology executive institute for advisors, educators, consultants and investors. Participating entrepreneurs will have unique access to industry thought leaders and domain experts. Qualified early-stage companies may locate in the center's facility through its "ventures-in-residence" program."

Full Story (comments: none)

HP, IBM, Intel and Sun Microsystems Launch Globus Consortium

Hewlett-Packard, IBM, Intel and Sun Microsystems have announced the formation of the Globus Consortium, a new industry group dedicated to the commercial advancement of the Globus Toolkit.

Comments (3 posted)

LinuxGenius Launches LinuxCBT SUSE Enterprise Edition

LinuxGenius, LLC has announced the release of LinuxCBT SUSE Enterprise Edition. "LinuxCBT SUSE Enterprise is LinuxGenius' ninth comprehensive computer based training course focusing on Linux-based open-source tools and applications. LinuxCBT SUSE Enterprise contains 75 hours of comprehensive, in depth training that focuses entirely on SUSE Enterprise Linux 9 and SUSE Professional 9.2 with Windows 2003, Red Hat Linux, and Cisco PIX Firewall integration."

Comments (none posted)

Linux Magazine Becomes LPI Platinum Sponsor

LPI has announced that Linux Magazine is now a platinum sponsor. "This increase in Linux Magazine's sponsorship commitment offers further recognition of LPI´s position within the Linux and Open Source community. It demonstrates the value of partnerships, and the important role we all have to play in promoting professional standards to further the cause of open source software."

Full Story (comments: none)

OpenIB Alliance Linux Software Stack Accepted by Kernel.org

The OpenIB Alliance has announced the acceptance of its Linux Software Stack by kernel.org. "The OpenIB Alliance, an industry association founded to develop an open software stack for InfiniBand architecture on Linux, today announced the software stack was accepted by the Linux kernel community into the kernel.org repository. This will enable a single InfiniBand open source software environment for Linux customers who require a robust, resilient and manageable infrastructure for data center, grid and high performance computing."

An OpenIB Developers Workshop on February 6-9 2005 has also been announced. The event will take place in Sonoma, CA.

Comments (none posted)

Sun's Open Solaris releases

Sun has put out two press releases on its "Open Solaris" plans. This one states that Solaris 10 will be made available under Sun's CDDL license; it should be available in the second quarter of 2005. Sun has also released 1600 patents to CDDL licensees. It is not clear from the PR whether the patents will be available for use outside of the Solaris code base. More information and downloads will be available at opensolaris.org.

Comments (11 posted)

VA Linux's Mini Kernel Dump now supports x86-64 architectures

VA Linux Systems Japan K.K. has announced x86-64 for its Mini Kernel Dump utility.

Full Story (comments: none)

Zend Technologies Announces Strategic Investments by Intel and SAP Ventures

Zend Technologies, Inc. has announced it has received strategic investments from both Intel Capital and SAP Ventures, a division of SAP AG. Zend will work with both companies to continue the momentum of open source and PHP solutions for business-critical web applications in enterprise environments. Terms of the investments were not disclosed.

Comments (none posted)

New Books

"Google Hacks, Second Edition" Released by O'Reilly

O'Reilly has published the book Google Hacks, Second Edition by Tara Calishain and Rael Dornfest.

Full Story (comments: none)

"QuickTime for Java: A Developer's Notebook" Released by O'Reilly

O'Reilly has published the book QuickTime for Java: A Developer's Notebook by Chris Adamson.

Full Story (comments: 1)

"Google Hacking for Penetration Testers" Released by Syngress

Syngress has published the book Google Hacking for Penetration Testers by Johnny Long.

Full Story (comments: none)

Resources

November/December 2004 LPI Newsletter

The Linux Professional Institute's November/December 2004 Newsletter is online with the latest LPI news.

Full Story (comments: none)

A Sociological Study of the Samba Community

The Samba site mentions a sociological study that looks at the Samba development community. "Nico Earnshaw has completed a thesis on the Samba community as part of his Bachelor of Arts Informatics degree at the University of Sydney. The work is a very fine study of the practices of members of the community, with particular attention paid to Samba Team developers (their motivations, goals, practices, etc.). The general question explored seems to be, how does being a part of the Samba community define a developer?"

The paper is available here (pdf).

Comments (none posted)

Contests and Awards

KDE SVG Wallpaper Contest Winners (KDE.News)

KDE.News has announced the winners of the KDE SVG Wallpaper contest. "It was not an easy task as there was so much incredible artwork. The judges sorted through all 86 entries and choose the top four and the winners are..."

Comments (none posted)

OpenOffice.org 2.0 Splashscreen Vote

A vote is being held for the OpenOffice.org version 2.0 Splashscreen. "Please help us choose a new splash screen for the upcoming OpenOffice.org 2.0 release. This image will be seen by tens of millions of users around the world every time they start OpenOffice.org. Voting is now open for community members."

Full Story (comments: none)

Upcoming Events

OSCON call for proposals (use Perl)

Use Perl has a call for proposals for the 2005 OSCON. "Bjørn Hansen writes "OSCON is headed back to friendly, economical Portland, Oregon during the week of August 1-5, 2005. If you've ever wanted to join the OSCON speaker firmament, now's your chance to submit a proposal (or two) by February 13, 2005.""

Comments (none posted)

OSBC announces line-up for Linux conference

OSBC, LLC has announced the second annual Open Source Business Conference(TM) (OSBC), the premier event for open source software and business, will be held April 5 and 6 at the Westin St. Francis in San Francisco with featured keynote speakers from IBM, OSDL, SpikeSource, Sun Microsystems, VA Software, and authors Geoffrey Moore and Lawrence Lessig.

Full Story (comments: none)

NSA Director Wolf to Keynote Security-Enhanced Linux Symposium

­Daniel G. Wolf will be the keynote speaker for the First Security-Enhanced Linux Symposium, the event will be held on March 2-4, 2005 in Silver Spring, Md.

Full Story (comments: none)

Al Brisard Joins Panel on Future of VoIP and Open Source

Al Brisard of PingTel has joined the Southern California Linux Expo panel discussion on the future of VoIP and Open Source. The expo will be held on February 12-13, 2005 at the Los Angeles Convention Center.

Full Story (comments: none)

YAPC North America 2005 Call-for-Papers (use Perl)

A call for papers has gone out for YAPC::NA 2005. "The dates of the conference are Monday - Wednesday 27-29 June 2005. The location will be in downtown Toronto, Ontario, Canada. (Note that a different date block was previously announced, but has been moved to accomodate venue availability.) The close of the call-for-papers is April 18, 2005 at 11:59 pm."

Comments (none posted)

7th German Perl Workshop Schedule and Registration (use Perl)

Use Perl has posted an update for the 7th German Perl Workshop. "JStenzel writes "The schedule of the 7th German Perl Workshop, together with the abstracts, is now online. A registration form is provided on the same page. The Workshop will be held in Dresden from 9th to 11th February 2005. Both German and English talks will be presented in the typical workshop atmosphere which inspired me as often as I took part.""

Comments (none posted)

Press Conferences for LinuxWorld Conference and Expo

IDG World Expo has announced a number of press conferences by various IT companies. "IDG World Expo, the leading producer of world-class tradeshows, conferences and events for technology markets, today announced the press conference schedule at LinuxWorld Conference & Expo(R) Boston on February 14-17, 2005 at the Hynes Convention Center. Many of the world's leading IT companies including HP, IBM, Novell, Red Hat and Veritas, will be announcing new products and upgrades for Linux enterprise users at the event."

Comments (none posted)

Events: January 27 - March 24, 2005

Date Event Location
January 28 - February 4, 2005Asia Source(Visthar training venue)Bangalore, India
January 31 - February 2, 2005OSDL Enterprise Linux Summit(Hyatt Hotel)Burlingame, California
February 2 - 3, 2005Solutions Linux 2004(CNIT, Paris la Défense)Paris, France
February 4 - 6, 2005ShmooCon 2005(Wardman Park Marriott Hotel)Washington, DC
February 7 - 11, 2005GlobusWORLD(Sheraton Boston Hotel)Boston, MA
February 9 - 11, 2005German Perl-Workshop 2005Dresden, Germany
February 9 - 11, 2005Third-Annual Desktop Linux Summit(Del Mar Fairgrounds)San Diego, CA
February 9, 2005OOo RegiCon North America(Del Mar Fairgrounds)San Diego, CA
February 11 - 13, 2005CodeCon 2005San Francisco, CA
February 12 - 13, 2005Southern California Linux Expo 2005(SCALE)(Los Angeles Convention Center)Los Angeles, CA
February 14 - 17, 2005Linux World Conference and Expo(Hynes Convention Center)Boston, MA
February 18, 2005Fedora Users and Developers Conference(FUDcon1)(Massachusetts Institute of Technology)Boston, Massachusetts
February 24 - 25, 2005UKUUG LISA/Winter ConferenceBirmingham, UK
February 25, 2005Dutch Perl WorkshopAmsterdam, the Netherlands
February 26 - 27, 2005Free and Open Source Developers' European Meeting(FOSDEM 2005)Brussels, Belgium
February 28 - March 3, 2005EclipseCon 2005(Hyatt Regency)Burlingame, CA
February 28 - March 1, 2005Asia Debian Mini-Conf 2005Beijing, China
March 1 - 2, 2005JBoss World 2005 User Conference(Omni/CNN Center)Atlanta, GA
March 2 - 4, 2005Security-Enhanced Linux SymposiumSilver Spring, Maryland
March 2 - 3, 2005Asia CodeFest 2005Beijing, China
March 2 - 4, 2005The 5th Asia Open Source Software SymposiumBeijing, China
March 2 - 4, 2005The Free and Open Source Software Workshop(Al Assad National Library)Damascus, Syria
March 12, 2005Gentoo UK 2005(University of Salford)Manchester, UK
March 12, 2005Third Hungarian PHP ConferenceBudapest, Hungary
March 14 - 17, 2005Emerging Technology Conference(ETech)(Westin Horton Plaza)San Diego, CA
March 21 - 24, 2005Bellua Cyber Security Asia 2005(Hotel Borobudur)Jakarta, Indonesia
March 21 - 24, 2005Open Source Modeling and IDEs Workshop(Caribe Royale All Suites Resort & Convention Center)Orlando, FL
March 23 - 25, 2005PyCon DC 2005(GWU Cafritz Conference Center)Washington, DC

Comments (1 posted)

Web sites

Hungarian MozillaZine Translation Launches (MozillaZine)

A Hungarian translation of MozillaZine has been announced. "This brings the total number of localised MozillaZine versions to six."

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Reading LWN on a Palm pilot

From:  David Heath <david.heath-AT-oneworld.net>
To:  lwn-AT-lwn.net
Subject:  Reading LWN on a Palm pilot
Date:  Thu, 20 Jan 2005 14:02:32 +0000

hi,
 
I thought you (and other LWN readers) might find the attached script
useful. I use it in combination with 'plucker' (http://www.plkr.org/ I
have v1.4) to fetch and download LWN onto my palm pilot. It's very much
a hack but it does work reliably (albeit without much finesse).
 
When run it will fetch the LWN home page, determine the URL of the
latest LWN edition (ie. this week's) and start fetching the pages from
that edition in 'printable format'. It relies on the cookie database
from galeon to get past authentication for reading the latest week's
news. It prob will work with other browsers just by changing the path of
the cookie file in the script.
 
Usage:
 
$ get-lwn.sh
...
$ gpilot-install-file /home/heathd/.plucker/lwn_20050120.pdb.pdb
gpilotd-Message: Activating object OAFIID:GNOME_Pilot_Daemon
fileconduit-Message: palmVx completed 641915326
 
Dave
 
PS. I'm just off to the café to read this week's LWN on my PalmV.
 
--
David Heath
Web Application Developer
OneWorld International, 2nd Floor, River House
143-145 Farringdon Road, London, EC1R 3AB, UK
E: david.heath@oneworld.net
W: http://www.oneworld.net/
T: +44 20 7239 1424
F: +44 20 7833 8347
 

#!/bin/sh

# gets this weeks list of pages

export DATESTAMP=`date +%Y%m%d`

export OUTPUTDIR=~/Documents/plucker/lwn

export ABSOUTDIR=$OUTPUTDIR/$DATESTAMP

mkdir -p $ABSOUTDIR

cd $ABSOUTDIR

wget --load-cookies /home/heathd/.galeon/mozilla/galeon/cookies.txt -O /dev/stdout -o /dev/null
http://lwn.net/current/ | grep -A 17 'LWN Weekly Edition' | grep '<a href=.*Articles\/[0-9]*\/"' |
sed -r 's/^.*(\/Articles\/)([0-9]+)\/.*$/wget \-\-load\-cookies
\/home\/heathd\/.galeon\/mozilla\/galeon\/cookies.txt \-O \2.html
http:\/\/lwn.net\1\2\/?format=printable/' > lwn-get-list.sh

sh lwn-get-list.sh

ls -1 *.html | sed -r 's/^(.*)$/<a href="\1" >\1<\/a><br \/>/' > index.html

ls -1 *.html | sed -r "s/^(.*)$/<a href='$DATESTAMP\/\1' >\1<\/a><br \/>/" >
../index.html

rm -f lwn-get-list.sh


plucker-build --doc-name "lwn $DATESTAMP" --doc-file=lwn_$DATESTAMP.pdb
--home-url=///home/heathd/Documents/plucker/lwn/$DATESTAMP/index.html
--maxdepth=2

Comments (1 posted)

Page editor: Jonathan Corbet

Copyright © 2005, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds