Sometimes it seems that Sun has been talking about releasing the Solaris
code for years. Actually, Sun
has been talking about releasing
Solaris for years; see
this LWN article from
1999 on the subject. On January 25, however, the company actually
did something about it. The DTrace code from Solaris is available now, and
the full Solaris kernel is set to become available sometime in the second
quarter of 2005. There is, of course,
a
hype-filled press release celebrating the event.
The release appears to be real. A fully buildable system will be made
available under Sun's recently OSI-approved Common Development and
Distribution License (CDDL). Sun does not appear to be holding back
any core components of the kernel. All of the Solaris 10 features
they have been trumpeting - ZFS, DTrace, containers, etc. - will be
included. It would seem that Sun is releasing a system that people might
actually want to run.
The other half of the day's festivities was this
announcement that Sun is releasing 1600 software patents for use with
CDDL-licensed software:
By giving open source developers free access to Sun(TM) OpenSolaris
related patents under the Common Development and Distribution
License (CDDL), the company is fostering open innovation and
establishing a leadership role in the framework of a patent commons
that will be recognized across the globe.
The announcement is rather short on details - things like which patents are
being released, and under which terms. Nowhere does Sun say explicitly
that only CDDL-licensed software will be licensed to use those
patents, but the early indications are that the company does intend to
limit things in that way. An attempt by LWN to get a clarification from
Sun on this point was not successful.
Sun has repeatedly said that it hopes to build a wider development
community around the OpenSolaris release. Once again, however, the details
are yet to be filled in. There will apparently be a "community advisory board"
with five members, three of whom will be directly chosen by Sun. There is
no word on what the patch acceptance process will be. The OpenOffice.org
process tends toward being bureaucratic and hard to approach; the OpenSolaris
process seems likely to be similar.
Sun has tried to fend off claims that this release is a competitive
response to Linux, but that is clearly what is going on. The company
appears to be trying to set up a parallel free software ecosystem which, it
hopes, will be more attractive than Linux. The components of this strategy
are becoming clear.
For example, Sun has repeatedly gone out of its way to push the claim that
Solaris is better than Linux - or anything else, for that matter. The
various features of Solaris 10 were hyped yet again at the OpenSolaris
teleconference; the company described them, with a straight face, as
"rocket science." The message is clear: why bother with Linux, when the
best is free too?
Then, Sun is stressing its free software credentials. At the
teleconference, Sun executives claimed that the company had been doing open
source for more than 24 years. Sun is now, they say, the number-one source
of free code on the planet. Why bother with those other,
johnny-come-lately companies when Sun has been doing this for so long? At
the teleconference, the claim was made that HP and Dell have not
contributed to Linux - which is clearly untrue.
There is also the indemnification issue, needless to say; indemnification
was mentioned many times at the teleconference. The patent press release
states:
Radically reducing risks associated with using and developing open
source software, Sun is firmly standing behind our products and the
worldwide development community. Armed with access to Solaris OS
platform intellectual property, OpenSolaris developers and
customers alike no longer need patent protection or indemnity from
Sun's and other participants in the OpenSolaris community for use
of Solaris-based technologies under the CDDL and OpenSolaris
community process.
There is an obvious attempt here to position Solaris as a safer sort of
free operating system - one with "radically reduced risks." It may be true
that OpenSolaris users are less likely to be sued - by Sun itself, at
least. The CDDL will also make suits by any other company which uses
OpenSolaris unlikely. None of this will help against suits from litigation
companies with no software business of their own, however.
Speaking of litigation companies, the SCO Group has not yet given its
thoughts on the OpenSolaris announcement. Sun executives claimed at the
teleconference that the company's Unix licenses allowed it to release the
code with no need to consult further with SCO. We asked SCO if it agreed,
but got no response.
The last piece of the puzzle is the CDDL, which serves to effectively
isolate the Solaris and Linux kernels from each other. Solaris will live
in its own world; any useful code it contains cannot be copied over to
Linux, or to any of the BSD variants. You can play with Sun's nice toys,
but you have to stay on Sun's turf.
All of this might just work. There are good things in OpenSolaris, and the
code will soon be truly free. But it takes more than a code dump to create
a development community. Whether Sun can create enough outside interest to
inspire a wider group of developers to help out remains to be seen - as
will Sun's ability to let go and let that community actually run with the
code. Sun will not have gained much if the outside developers end up
creating their own OpenSolaris fork.
Comments (22 posted)
It's been in the works for quite a while, but PostgreSQL 8.0 is finally
out the door. To get the full
scoop on 8.0, we spoke to Josh
Berkus, one of the members of PostgreSQL's steering committee, to learn
about PostgreSQL's new features and plans for future development.
The PostgreSQL press release highlights a number of new features and
improvements, including improved memory usage and I/O improvements. We
asked Berkus if the PostgreSQL team had any benchmarks to share with
regards to these improvements. Berkus said that the project did not have
benchmarks yet, and that the team had been tinkering with performance
"right up to the release candidate." Berkus did elaborate on
the nature of improvements, however.
The basic idea was to make PostgreSQL a little bit smarter about managing
its own cache and its own memory usage. A lot of that effort was
spearheaded by Jan Wieck, who works for
Afilias... their big interest in
improving memory usage was really to flatten out spikes. One of the tests
at the Open Source Development Labs of online transaction processing where
you see that your peak rates of transaction processing is like 4,000 or
4,800 transactions per minute, but then you have these checkpoint spikes
while the system is doing memory synchronization and the like, suddenly
your throughput rate drops by like 1,000 transactions per minute.... from
the perspective of people supporting interactive Web applications, this is
particularly bad because the customer suddenly sees a 30-second lag where
nothing's happening. A lot of the changes were designed to alleviate that
condition.
Berkus noted that the average transaction time for Web applications may not
go down a great deal, but that the median transaction time did go down. He
also said that several developers working on performance tweaks were
pushing for a short development cycle for PostgreSQL 8.1 because they're
"not necessarily satisfied that they're done." Berkus also
pointed out that they would probably never be done improving performance.
Other performance improvements include changes to maintenance routines to
avoid saturating disk I/O. Berkus said that some maintenance routines may
take longer, but would have less of an impact on system performance while
running.
The Savepoint feature has changed as well, according to Berkus. Savepoints
allow parts of a transaction to be rolled back without failing an entire
transaction if part of the procedure fails. Berkus said that savepoints
were initially "implemented as nested transactions" but that
the syntax for Savepoints is now SQL-compliant.
Inevitably, PostgreSQL will be compared to "enterprise" databases like DB2
and Oracle. We asked Berkus how PostgreSQL would compare to products like
Oracle and DB2 given the features that were introduced in 8.0. He said that
there were "still plenty of high-end features that they have that we
don't have yet though each new release of PostgreSQL adds features
that make it "adequate or even superior" for new users. One
feature that PostgreSQL still needs, said Berkus, is multi-master
replication. Right now, there are three separate teams working on two
different forms of multi-master replication, which should be ready within
"a year or a half, if not sooner."
Berkus said that the PostgreSQL project planned to keep replication
facilities, such as Mammoth and Slony,
as add-ons rather than part of PostgreSQL. The reason, according to Berkus,
is that replication "is not a single problem... it's a set of related
problems not all of which should be solved by the same software."
Another feature in 8.0, which may be of little interest to LWN readers, is
the native version of PostgreSQL for Windows. Berkus said that the Windows
release looked to be very popular, judging by early downloads of the
release. We did ask how the performance of PostgreSQL on Windows compared
to performance on Linux or other UNIX-type systems. Berkus said that they
didn't know, since most of the PostgreSQL testing is done through the Open
Source Development Labs, which means that testing is limited to Linux
systems. He did say that he expected that performance on Windows would lag
behind Linux, since PostgreSQL is primarily developed on Unix and POSIX
systems.
What will we see in 8.1? It's too early to tell, but Berkus did mention a
few projects that he's aware of that might be in the works. One issue that
he mentioned is the idea of per-user quotas for PostgreSQL.
Somebody's revived the issue of per-user quotas. People are interested in
it, but the people who are interested don't seem to have the coding talent
to implement it... you don't know how much space something is taking up
without calling a maintenance procedure, so it's a very hard problem to
solve. It's much harder than implementing user quotas on the filesystem.
If the 8.1 release cycle is a short cycle, Berkus says that "a lot
will be deferred to 8.2 because of the requirement for catalog changes in
initdb." Berkus told LWN that the changes were necessary to allow
PostgreSQL to do in-place upgrades rather than requiring users to migrate
data from an older PostgreSQL installation to the new installation.
Currently, the way you upgrade a major version [of PostgreSQL] is to in
install the binaries to a new location, prepare the new location and then
you do a backup of the old database and restore onto the new
platform. There are other ways of making this easier, like using
replication to move the data, but it still amounts to running two
PostgreSQLs at once and moving between those two instances. If you happen
to be running a data warehouse with 300 GB of data, it's quite time
consuming... it's one of the things we have on our plate that nobody wants
to work on.
We asked Berkus why PostgreSQL didn't use a timed release cycle, as opposed
to a feature-based release cycle, like the GNOME Project does. Berkus said
that "nobody's really raised that as an idea" and said that it
would be difficult to do since other projects could release
half-implemented features or features that were still a little buggy, but
PostgreSQL could not. "For us as an enterprise database system, we
can't release anything that could corrupt your data, even a little."
Even if PostgreSQL were to move to a timed release cycle, Berkus said it
would probably be a yearly release cycle rather than a six-month cycle like
GNOME.
Current users of PostgreSQL can count on security and data integrity
patches for the prior two releases (7.3 and 7.4) until the 8.1 release of
PostgreSQL. Berkus added that patches may be released for 7.2 "if the
patch can be released to 7.2 without extra effort." He also said
that support for older versions of PostgreSQL, including backporting new
features, was a role for commercial providers of PostgreSQL and could
provide a value-add for vendors to provide to their customers, without
making it a "headache for developers."
While PostgreSQL may not have all the features of DB2 or Oracle, the
database is closing the gap between itself and proprietary "enterprise"
database systems. With the 8.0 release, PostgreSQL should be able to find
many more adopters in small and large organizations that are looking to
replace expensive proprietary systems with an open source solution.
Comments (none posted)
The
Grumpy Editor's guide to free
PDF viewers tried to assess the current state of the art in free
applications which deal with PDF files. Since the publication of that
article in December, a new player has shown up.
Evince is a GPL-licensed
GNOME viewer for a number of document formats, including PDF, PostScript,
and DVI files. When
evince 0.1.1 was
announced, your editor decided that it was time to have a look.
Evince is built as a viewer with the ability to add backends for any file
format of interest. For PDF files, the supplied backend is based on the
xpdf code. The PostScript backend uses ghostscript, and the DVI backend
uses a built-in DVI library. Building evince requires the GNOME 2.9
libraries, but is otherwise painless; it dropped right into place on your
editor's Fedora Rawhide system.
This application is looking good - especially for a 0.1.1 release. The
rendering of PDF files is fast, and the quality is good. The zoom options
are rational, and it is easy to move around within the document. Printing
of PDF files works (that's one of the new features in 0.1.1). Evince can
display page thumbnails in a side bar; for documents with a table of
contents, that, too, can be displayed and used for navigation. Text can be
selected with the mouse and pasted into other applications.
Evince offers a search capability which appears to have potential, but
which needs a bit of work yet. Hitting "^F" will open a
firefox-style "find" bar at the bottom of the screen (search does not
appear to be available from the menus). Typing a string will highlight
occurrences of that string in the text; see the screenshot for an example.
There are "previous" and "next" buttons, but the only thing they do is
cause "find previous" or "find next" to be printed; it's nice to know that
evince is listening, but that still is probably not quite what the user had in
mind. If the string does not appear on the current page, evince will note
the next page where the string can be found - but the user must get
to that page independently.
There are a few other glitches yet. Selecting text with the mouse can be a
little unreliable; sometimes what gets pasted is not exactly the text which
was selected. There are no thumbnails for PostScript documents. The
buttons for paging through the document are labeled "Up" and "Down," which
are not the most obvious terms. There is no way to print only part of a
document. There is no man page - or other help of any sort.
All of the above notwithstanding, evince is a tool which is, even at this
early point, competitive with the other free PDF viewers. It is entirely
useful now. If development continues at the current pace, evince may well
become your editor's viewer of choice in the near future.
Comments (13 posted)
Page editor: Jonathan Corbet
Security
One might think that hacking kernels for SuSE would be enough to keep a
person busy, but Andrea Arcangeli has more energy than that. So, on the
side, he is working on a project called
cpushare. Essentially, it is
a form of Linux-based worldwide grid network which would enable people to
sell their idle CPU cycles to others who are in need of serious crunching
power. Most systems sit idle most of the time; they might as well be
working for a living instead.
Before Linux users will accept outside code on their systems, they will
need to be pretty well convinced that said code can be kept under control.
Without some pretty fierce security, a grid network could quickly be turned
into a serious zombie network, and that would be embarrassing for everybody
involved. The long-term plan is to take advantage of "trusted computing"
hardware to sandbox the guest code; that hardware will also be able to help
prevent the owner of the system from interfering with (or even observing)
the buyer's computations and data. For now, however, some other method of
ensuring the security of the host systems will have to be devised.
Andrea's answer is the seccomp patch. It
is, in fact, an exceedingly simple solution to the problem. With this
patch in place, the kernel allows a process to make a one-way transition
into a "secure computing" mode. A hook is placed in the system call gate
which checks for this mode; when secure computing is turned on, an attempt
to execute almost any system call will result in the immediate termination
of the process. The only exceptions are read(), write(),
exit(), and the two forms of sigreturn(). So the
cpushare client would execute outside work by setting up some sockets to
communicate with the master system, turning on the secure mode, and
executing the client code. If all goes well, that code will be able to do
nothing beyond pure CPU use and communicating through the sockets given to
it. And exiting, of course.
The objection that was raised is that this sort of sandboxing can be done
from user space with ptrace(). At least, it can if one little patch is applied to ensure that the
sandboxed process cannot continue if, somehow, the monitoring process dies
first. Andrea acknowledges that the
ptrace() solution is workable, but he still prefers the secure
computing mode. The reason is simplicity: the seccomp patch is quite
small, and it is relatively easy to verify that it does what is needed.
The ptrace() code is rather more complex and harder to verify,
even before considering the interactions with the user-space monitor.
The public discussion was inconclusive, so it is hard to predict whether
this patch will eventually be accepted or not.
Comments (14 posted)
Brief items
The call for papers for Phrack #63 has gone out; no specific deadline is given for submissions. The CFP states that issue #63 will be the final issue of Phrack.
Full Story (comments: 2)
New vulnerabilities
AWStats: remote code execution
| Package(s): | awstats |
CVE #(s): | CAN-2005-0116
CAN-2005-0362
CAN-2005-0363
|
| Created: | January 25, 2005 |
Updated: | February 15, 2005 |
| Description: |
When 'awstats.pl' is run as a CGI script, it fails to validate specific
inputs which are used in a Perl open() function call. A remote attacker
could supply AWStats malicious input, potentially allowing the execution of
arbitrary code with the rights of the web server. |
| Alerts: |
|
Comments (1 posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
ethereal: multiple vulnerabilites
Comments (none posted)
evolution: arbitrary code execution
| Package(s): | evolution |
CVE #(s): | CAN-2005-0102
|
| Created: | January 24, 2005 |
Updated: | May 19, 2005 |
| Description: |
Max Vozeler discovered an integer overflow in camel-lock-helper. A
user-supplied length value was not validated, so that a value of -1
caused a buffer allocation of 0 bytes; this buffer was then filled by
an arbitrary amount of user-supplied data. A local attacker or a malicious
POP3 server could exploit this to execute arbitrary code with root
privileges (because camel-lock-helper is installed as setuid root). |
| Alerts: |
|
Comments (1 posted)
kdebase: screen saver crash
| Package(s): | kdebase |
CVE #(s): | CAN-2005-0078
|
| Created: | January 26, 2005 |
Updated: | January 26, 2005 |
| Description: |
From the Debian advisory: "Raphaël Enrici discovered that the KDE screensaver can crash under
certain local circumstances. This can be exploited by an attacker
with physical access to the workstation to take over the desktop
session." |
| Alerts: |
|
Comments (none posted)
Konversation: multiple vulnerabilities
| Package(s): | konversation |
CVE #(s): | CAN-2005-0129
CAN-2005-0130
CAN-2005-0131
|
| Created: | January 24, 2005 |
Updated: | January 26, 2005 |
| Description: |
Multiple vulnerabilities have been discovered in all Konversation versions up to
and including 0.15. |
| Alerts: |
|
Comments (none posted)
libdbi-perl: insecure temporary file
| Package(s): | libdbi-perl |
CVE #(s): | CAN-2005-0077
|
| Created: | January 25, 2005 |
Updated: | March 2, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Project
discovered that the DBI library, the Perl5 database interface, creates
a temporary PID file in an insecure manner. This can be exploited by a
malicious user to overwrite arbitrary files owned by the person
executing the parts of the library. |
| Alerts: |
|
Comments (none posted)
libpam-radius-auth
| Package(s): | libpam-radius-auth |
CVE #(s): | CAN-2005-0108
|
| Created: | January 26, 2005 |
Updated: | January 26, 2005 |
| Description: |
The PAM RADIUS authentication module suffers from an integer overflow vulnerability. |
| Alerts: |
|
Comments (none posted)
mpg123: frame header buffer overflow
| Package(s): | mpg123 |
CVE #(s): | CAN-2004-0991
|
| Created: | January 20, 2005 |
Updated: | January 26, 2005 |
| Description: |
mpg123 has a vulnerability in which a maliciously created file could
cause a buffer overflow in the frame header parsing code, allowing
arbitrary code to be executed with the permission of the user. |
| Alerts: |
|
Comments (none posted)
php4: multiple vulnerabilities
| Package(s): | php4 |
CVE #(s): | |
| Created: | February 20, 2005 |
Updated: | February 21, 2005 |
| Description: |
A vulnerability was reported in PHP in the cURL functions. A script can bypass the 'open_basedir' directory setting. See this SecurityTracker Alert for more information. |
| Alerts: |
|
Comments (2 posted)
realplayer: integer overflow
| Package(s): | realplayer |
CVE #(s): | |
| Created: | January 24, 2005 |
Updated: | January 26, 2005 |
| Description: |
A flaw in the .rm RealMovie stream handling routines allows a remote
attacker to exploit
an integer overflow vulnerability using a special .rm file. This might
allow a remote attacker to execute code as the user running RealPlayer. |
| Alerts: |
|
Comments (none posted)
sword: missing input sanitizing
| Package(s): | sword |
CVE #(s): | CAN-2005-0015
|
| Created: | January 20, 2005 |
Updated: | January 26, 2005 |
| Description: |
The CGI script diatheke from sword does not properly sanitize
its input, allowing arbitrary commands to be executed through a
specially crafted URL. |
| Alerts: |
|
Comments (none posted)
vdr: insecure file access
| Package(s): | vdr |
CVE #(s): | CAN-2005-0071
|
| Created: | January 25, 2005 |
Updated: | January 31, 2005 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Team has
discovered that the vdr daemon which is used for video disk recorders
for DVB cards can overwrite arbitrary files. |
| Alerts: |
|
Comments (none posted)
xtrlock: buffer overflow
| Package(s): | xtrlock |
CVE #(s): | CAN-2005-0079
|
| Created: | January 20, 2005 |
Updated: | January 26, 2005 |
| Description: |
xtrlock has a buffer overflow that can allow a local attacker to
crash the lock program and take over a user's desktop session. |
| Alerts: |
|
Comments (none posted)
zhcon: privilege escalation
| Package(s): | zhcon |
CVE #(s): | CAN-2005-0072
|
| Created: | January 24, 2005 |
Updated: | January 26, 2005 |
| Description: |
Erik Sjolund discovered that zhcon accesses a user-controlled configuration
file with elevated privileges which could make it possible to read
arbitrary files. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
a2ps: input validation error
| Package(s): | a2ps |
CVE #(s): | CAN-2004-1170
CAN-2004-1377
|
| Created: | November 26, 2004 |
Updated: | December 19, 2005 |
| Description: |
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus. |
| Alerts: |
|
Comments (none posted)
apache: temporary file vulnerability
| Package(s): | apache |
CVE #(s): | |
| Created: | January 19, 2005 |
Updated: | January 19, 2005 |
| Description: |
Javier Fernández-Sanguino Peña noticed that the Apache 1.3 "check_forensic"
script created temporary files in an insecure manner. |
| Alerts: |
|
Comments (none posted)
cdrecord: failure to drop privilege
| Package(s): | cdrecord |
CVE #(s): | CAN-2004-0806
|
| Created: | September 8, 2004 |
Updated: | February 21, 2005 |
| Description: |
The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program. |
| Alerts: |
|
Comments (none posted)
chbg: buffer overflow
| Package(s): | chbg |
CVE #(s): | CAN-2004-1264
|
| Created: | January 18, 2005 |
Updated: | February 2, 2005 |
| Description: |
Danny Lungstrom discovered a vulnerability in chbg, a tool to change
background pictures. A maliciously crafted configuration/scenario
file could overflow a buffer and lead to the execution of arbitrary
code on the victim's machine. |
| Alerts: |
|
Comments (none posted)
cups: multiple vulnerabilities
| Package(s): | cups |
CVE #(s): | CAN-2004-1267
CAN-2004-1268
CAN-2004-1269
CAN-2004-1270
|
| Created: | December 17, 2004 |
Updated: | February 9, 2005 |
| Description: |
cups has a denial of service vulnerability in the lppasswd utility
and a remote code execution vulnerability in the hpgltops filter. |
| Alerts: |
|
Comments (none posted)
cyrus-sasl: remote buffer overflow
| Package(s): | cyrus-sasl |
CVE #(s): | CAN-2004-0884
|
| Created: | October 7, 2004 |
Updated: | March 16, 2005 |
| Description: |
cyrus-sasl has a vulnerability involving a buffer overflow
in the digestmda5.c file. A remote attacker may be able
to compromise the system. Also, a local user may be able to
exploit a vulnerability by using the SASL_PATH environment
variable. |
| Alerts: |
|
Comments (none posted)
dhcp: format string vulnerability
| Package(s): | dhcp |
CVE #(s): | CAN-2004-1006
|
| Created: | November 4, 2004 |
Updated: | July 13, 2005 |
| Description: |
Dhcp has a format string vulnerability in the log functions of dhcp 2.x
that may be exploited via a malicious DNS server. |
| Alerts: |
|
Comments (none posted)
exim: buffer overflows
Comments (1 posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FreeRADIUS: denial of service
| Package(s): | freeradius |
CVE #(s): | CAN-2004-0938
CAN-2004-0960
CAN-2004-0961
|
| Created: | September 22, 2004 |
Updated: | February 2, 2005 |
| Description: |
FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow in MSN protocol
| Package(s): | gaim |
CVE #(s): | CAN-2004-0891
|
| Created: | October 25, 2004 |
Updated: | February 11, 2005 |
| Description: |
A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows
remote attackers to cause a denial of service (application crash) and
possibly execute arbitrary code via an "unexpected sequence of MSNSLP
messages" that results in an unbounded copy operation that writes to the
wrong buffer. |
| Alerts: |
|
Comments (none posted)
gtk2, gdk-pixbuf: buffer overflows
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CAN-2004-0753
CAN-2004-0782
CAN-2004-0783
CAN-2004-0788
|
| Created: | September 15, 2004 |
Updated: | February 25, 2005 |
| Description: |
The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks. |
| Alerts: |
|
Comments (none posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
ghostscript: symlink vulnerabilities
| Package(s): | ghostscript |
CVE #(s): | CAN-2004-0967
|
| Created: | October 20, 2004 |
Updated: | September 28, 2005 |
| Description: |
The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks. |
| Alerts: |
|
Comments (none posted)
glibc: Information leak with LD_DEBUG
| Package(s): | glibc |
CVE #(s): | CAN-2004-1453
|
| Created: | August 17, 2004 |
Updated: | May 26, 2005 |
| Description: |
Silvio Cesare discovered a potential information leak in glibc. It allows
LD_DEBUG on SUID binaries where it should not be allowed. This has various
security implications, which may be used to gain confidential information.
An attacker can gain the list of symbols a SUID application uses and their
locations and can then use a trojaned library taking precedence over those
symbols to gain information or perform further exploitation. |
| Alerts: |
|
Comments (1 posted)
glibc: tempfile vulnerability in catchsegv script
| Package(s): | glibc |
CVE #(s): | CAN-2004-0968
|
| Created: | October 21, 2004 |
Updated: | November 14, 2005 |
| Description: |
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script. |
| Alerts: |
|
Comments (none posted)
gnome-vfs: backend script vulnerabilities
| Package(s): | gnome-vfs |
CVE #(s): | CAN-2004-0494
|
| Created: | August 4, 2004 |
Updated: | February 21, 2005 |
| Description: |
Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
imagemagick: .psd image file decode vulnerability
| Package(s): | imagemagick |
CVE #(s): | CAN-2005-0005
|
| Created: | January 18, 2005 |
Updated: | March 23, 2005 |
| Description: |
According to this iDEFENSE advisory,
ImageMagick is vulnerable to a heap overflow when decoding .psd image
files. This could be remotely exploited allowing an attacker to execute
arbitrary code. |
| Alerts: |
|
Comments (1 posted)
imlib2: buffer overflows
| Package(s): | imlib2 |
CVE #(s): | CAN-2004-0802
CAN-2004-0817
|
| Created: | September 8, 2004 |
Updated: | October 26, 2005 |
| Description: |
The imlib2 library contains buffer overflows in the BMP handling code. |
| Alerts: |
|
Comments (none posted)
iptables: missing initialization
| Package(s): | iptables |
CVE #(s): | CAN-2004-0986
|
| Created: | November 1, 2004 |
Updated: | February 11, 2005 |
| Description: |
Faheem Mitha noticed that the iptables command, an administration tool for
IPv4 packet filtering and NAT, did not always load the required modules on
its own as it was supposed to. This could lead to firewall rules not being
loaded on system startup. This caused a failure in connection with rules
provided by lokkit at least. |
| Alerts: |
|
Comments (none posted)
kdelibs: unsanitzied input
| Package(s): | kdelibs |
CVE #(s): | CAN-2004-1165
|
| Created: | January 10, 2005 |
Updated: | July 19, 2005 |
| Description: |
Thiago Macieira discovered a vulnerability in the kioslave library,
which is part of kdelibs, which allows a remote attacker to execute
arbitrary FTP commands via an ftp:// URL that contains an URL-encoded
newline before the FTP command. |
| Alerts: |
|
Comments (none posted)
kerberos5: execution of arbitrary code by authenticated user
| Package(s): | kerberos5 |
CVE #(s): | CAN-2004-1189
|
| Created: | December 21, 2004 |
Updated: | February 15, 2005 |
| Description: |
There is a buffer overflow in the password history handling code of
libkadm5srv which could be exploited by an authenticated user to execute
arbitrary code on a Key Distribution Center (KDC) server. |
| Alerts: |
|
Comments (none posted)
kernel: race condition, privilege escalation
| Package(s): | kernel |
CVE #(s): | CAN-2004-1235
CAN-2004-1337
|
| Created: | January 10, 2005 |
Updated: | January 19, 2005 |
| Description: |
Paul Starzetz discovered a race condition in the ELF library and a.out
binary format loaders, which can be locally exploited in several
different ways to gain root privileges. (CAN-2004-1235)
Liang Bin found a design flaw in the capability module. After this
module was loaded on demand in a running system, all unprivileged user
space processes got all kernel capabilities (thus essentially root
privileges). (CAN-2004-1337) |
| Alerts: |
|
Comments (none posted)
kernel: i386 SMP page fault handler privilege escalation
| Package(s): | kernel |
CVE #(s): | CAN-2005-0001
|
| Created: | January 14, 2005 |
Updated: | February 25, 2005 |
| Description: |
Paul Starzetz found an exploitable hole in the x86 SMP page fault handler
which could lead to privilege escalation. See the advisory for details. |
| Alerts: |
|
Comments (none posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libpng: multiple vulnerabilities
Comments (1 posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2004-1308
|
| Created: | December 22, 2004 |
Updated: | May 19, 2005 |
| Description: |
The libtiff image manipulation library contains several exploitable buffer overflows. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libxpm4: stack and integer overflows
| Package(s): | libxpm4 |
CVE #(s): | CAN-2004-0687
CAN-2004-0688
|
| Created: | September 16, 2004 |
Updated: | February 14, 2005 |
| Description: |
There are several stack and integer overflow bugs in
the libXpm code of XFree86 that may be used for a denial of service. |
| Alerts: |
|
Comments (none posted)
lvm10: creates insecure temporary directory
| Package(s): | lvm10 |
CVE #(s): | CAN-2004-0972
|
| Created: | November 1, 2004 |
Updated: | July 25, 2005 |
| Description: |
Trustix Secure Linux discovered a vulnerability in a supplemental script of
the lvm10 package. The program "lvmcreate_initrd" created a temporary
directory in an insecure way, which could allow a symlink attack to create
or overwrite arbitrary files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
mailman: cross-site scripting
| Package(s): | mailman |
CVE #(s): | CAN-2004-1177
|
| Created: | January 10, 2005 |
Updated: | March 22, 2005 |
| Description: |
Florian Weimer discovered a cross-site scripting vulnerability in
mailman's automatically generated error messages. An attacker could
craft an URL containing JavaScript (or other content embedded into
HTML) which triggered a mailman error page. When an unsuspecting user
followed this URL, the malicious content was copied unmodified to the
error page and executed in the context of this page. |
| Alerts: |
|
Comments (none posted)
mikmod: buffer overflow
| Package(s): | mikmod |
CVE #(s): | CAN-2003-0427
|
| Created: | June 16, 2003 |
Updated: | June 16, 2005 |
| Description: |
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod. |
| Alerts: |
|
Comments (none posted)
mpg321: format string vulnerability
| Package(s): | mpg321 |
CVE #(s): | CAN-2003-0969
|
| Created: | January 6, 2004 |
Updated: | March 28, 2005 |
| Description: |
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming). |
| Alerts: |
|
Comments (none posted)
mysql: several vulnerabilities
| Package(s): | mysql |
CVE #(s): | CAN-2004-0835
CAN-2004-0836
CAN-2004-0837
|
| Created: | October 11, 2004 |
Updated: | April 6, 2005 |
| Description: |
Several problems have been discovered in MySQL. Oleksandr Byelkin noticed
that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table
instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer
overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis
noticed that multiple threads ALTERing the same (or different) MERGE tables
to change the UNION can cause the server to crash or stall. (CAN-2004-0837) |
| Alerts: |
|
Comments (none posted)
mysql-dfsg: insecure temporary files
| Package(s): | mysql-dfsg |
CVE #(s): | CAN-2005-0004
|
| Created: | January 18, 2005 |
Updated: | March 25, 2005 |
| Description: |
Javier Fernández-Sanguino Peña noticed that the "mysqlaccess" program
created temporary files in an insecure manner. This could allow a
symbolic link attack to create or overwrite arbitrary files with the
privileges of the user invoking the program. |
| Alerts: |
|
Comments (none posted)
nasm: Buffer overflow vulnerability
| Package(s): | nasm |
CVE #(s): | CAN-2004-1287
|
| Created: | December 20, 2004 |
Updated: | May 4, 2005 |
| Description: |
Jonathan Rockway discovered that NASM-0.98.38 has an unprotected
vsprintf() to an array in preproc.c. This code vulnerability may lead
to a buffer overflow and potential execution of arbitrary code. |
| Alerts: |
|
Comments (4 posted)
netkit-telnet: invalid free pointer
| Package(s): | netkit-telnet |
CVE #(s): | CAN-2004-0911
|
| Created: | October 4, 2004 |
Updated: | March 28, 2005 |
| Description: |
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash, leading
to a straightforward denial of service (inetd will disable the service if
telnetd is crashed repeatedly), or possibly the execution of arbitrary code
with the privileges of the telnetd process (by default, the 'telnetd'
user). |
| Alerts: |
|
Comments (none posted)
nfs-utils: denial of service
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-1014
|
| Created: | December 1, 2004 |
Updated: | May 15, 2005 |
| Description: |
The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker. |
| Alerts: |
|
Comments (none posted)
nfs-utils: arbitrary code execution
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-0946
|
| Created: | January 11, 2005 |
Updated: | February 27, 2006 |
| Description: |
Arjan van de Ven discovered a buffer overflow in rquotad on 64bit
architectures; an improper integer conversion could lead to a buffer
overflow. An attacker with access to an NFS share could send a specially
crafted request which could then lead to the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
openssl: der_chop script temp file vulnerability
| Package(s): | openssl |
CVE #(s): | CAN-2004-0975
|
| Created: | November 11, 2004 |
Updated: | July 19, 2005 |
| Description: |
The der_chop script in openssl has a temp file vulnerability that may allow
an attacker to overwrite arbitrary files with the permissions that
the script is running under. |
| Alerts: |
|
Comments (1 posted)
OpenSSL: denial of service vulnerabilities
Comments (1 posted)
php: remotely exploitable memory errors
| Package(s): | php |
CVE #(s): | CAN-2004-0594
|
| Created: | July 14, 2004 |
Updated: | February 7, 2005 |
| Description: |
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not). |
| Alerts: |
|
Comments (none posted)
php: multiple vulnerabilities
Comments (1 posted)
playmidi: buffer overflow
| Package(s): | playmidi |
CVE #(s): | CAN-2005-0020
|
| Created: | January 17, 2005 |
Updated: | January 20, 2005 |
| Description: |
Erik Sjölund discovered that playmidi, a MIDI player, contains a setuid
root program with a buffer overflow that can be exploited by a local
attacker. |
| Alerts: |
|
Comments (none posted)
ProZilla: Multiple vulnerabilities
| Package(s): | ProZilla |
CVE #(s): | CAN-2004-1120
|
| Created: | November 23, 2004 |
Updated: | February 1, 2005 |
| Description: |
ProZilla contains several exploitable buffer overflows in the code handling
the network protocols. A remote attacker could setup a malicious server
and entice a user to retrieve files from that server using ProZilla. This
could lead to the execution of arbitrary code with the rights of the user
running ProZilla. |
| Alerts: |
|
Comments (none posted)
qt3: BMP image parser heap overflow
| Package(s): | qt3/qt3-non-mt/qt3-32bit/qt3-static |
CVE #(s): | CAN-2004-0691
CAN-2004-0692
CAN-2004-0693
|
| Created: | August 19, 2004 |
Updated: | May 15, 2005 |
| Description: |
A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution. |
| Alerts: |
|
Comments (none posted)
queue: buffer overflows
| Package(s): | queue |
CVE #(s): | CAN-2004-0555
|
| Created: | January 18, 2005 |
Updated: | January 19, 2005 |
| Description: |
"jaguar" of the Debian Security Audit Project has discovered several buffer
overflows in queue, a transparent load balancing system. |
| Alerts: |
|
Comments (none posted)
rp-pppoe, pppoe: missing privilege dropping
| Package(s): | rp-pppoe, pppoe |
CVE #(s): | CAN-2004-0564
|
| Created: | October 4, 2004 |
Updated: | November 15, 2005 |
| Description: |
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system. |
| Alerts: |
|
Comments (none posted)
ruby: infinite loop
| Package(s): | ruby |
CVE #(s): | CAN-2004-0983
|
| Created: | November 8, 2004 |
Updated: | May 15, 2005 |
| Description: |
The upstream developers of Ruby have corrected a problem in the CGI
module for this language. Specially crafted requests could cause an
infinite loop and thus cause the program to eat up cpu cycles. |
| Alerts: |
|
Comments (none posted)
samba: integer overflow vulnerability
| Package(s): | samba |
CVE #(s): | CAN-2004-1154
|
| Created: | December 16, 2004 |
Updated: | July 19, 2005 |
| Description: |
Samba has an integer overflow vulnerability
that may allow an authenticated remote user to
execute arbitrary code on the Samba server. |
| Alerts: |
|
Comments (none posted)
sharutils: arbitrary code execution
| Package(s): | sharutils |
CVE #(s): | CAN-2004-1772
|
| Created: | October 1, 2004 |
Updated: | April 26, 2005 |
| Description: |
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer
overflow in shar.c, where the length of data returned by the wc command is
not checked. Florian Schilhabel discovered another buffer overflow in
unshar.c. An attacker could exploit these vulnerabilities to execute
arbitrary code as the user running one of the sharutils programs. |
| Alerts: |
|
Comments (none posted)
sox: buffer overflow
| Package(s): | sox |
CVE #(s): | CAN-2004-0557
|
| Created: | July 28, 2004 |
Updated: | February 21, 2005 |
| Description: |
Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file. |
| Alerts: |
|
Comments (none posted)
SpamAssassin: Denial of Service vulnerability
| Package(s): | spamassassin |
CVE #(s): | CAN-2004-0796
|
| Created: | August 9, 2004 |
Updated: | August 11, 2005 |
| Description: |
SpamAssassin contains an unspecified Denial of Service vulnerability. By
sending a specially crafted message an attacker could cause a Denial of
Service attack against the SpamAssassin service. |
| Alerts: |
|
Comments (none posted)
Squid: multiple vulnerabilities
| Package(s): | squid |
CVE #(s): | CAN-2005-0094
CAN-2005-0095
|
| Created: | January 17, 2005 |
Updated: | February 2, 2005 |
| Description: |
Squid contains a vulnerability in the gopherToHTML function and incorrectly
checks the 'number of caches' field when parsing WCCP_I_SEE_YOU messages.
Furthermore the NTLM code contains two errors. One is a memory leak in the
fakeauth_auth helper and the other is NULL pointer dereferencing error. |
| Alerts: |
|
Comments (none posted)
Subversion: Remote heap overflow
| Package(s): | subversion |
CVE #(s): | CAN-2004-0413
|
| Created: | June 11, 2004 |
Updated: | March 7, 2005 |
| Description: |
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
sudo: environment variable sanitizing
| Package(s): | sudo |
CVE #(s): | CAN-2004-1051
|
| Created: | November 17, 2004 |
Updated: | May 15, 2005 |
| Description: |
Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tiff: buffer overflows
| Package(s): | tiff |
CVE #(s): | CAN-2004-0803
|
| Created: | October 13, 2004 |
Updated: | April 12, 2005 |
| Description: |
The tiff library contains several buffer overflows which may be exploited
by way of maliciously-crafted image files. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
TikiWiki: arbitrary command execution
| Package(s): | TikiWiki |
CVE #(s): | |
| Created: | January 10, 2005 |
Updated: | January 31, 2005 |
| Description: |
TikiWiki lacks a check on uploaded images in the Wiki edit page. A
malicious user could run arbitrary commands on the server by uploading and
calling a PHP script. |
| Alerts: |
|
Comments (none posted)
unarj: buffer overflow vulnerability
| Package(s): | unarj |
CVE #(s): | CAN-2004-0947
|
| Created: | November 11, 2004 |
Updated: | February 2, 2005 |
| Description: |
The unarj uncompression utility has a buffer overflow vulnerability
from handling long file names in an archive. An attacker can
cause unarj to crash or execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
vim: modeline problems
| Package(s): | vim |
CVE #(s): | CAN-2004-1138
|
| Created: | December 15, 2004 |
Updated: | February 24, 2005 |
| Description: |
A new set of modeline-related vulnerabilities has been discovered in versions of vim prior to 6.3-r2. These vulnerabilities could conceivably be exploited by a local user to obtain the privileges of another user. |
| Alerts: |
|
Comments (none posted)
vim: symbolic link attack
| Package(s): | vim |
CVE #(s): | CAN-2005-0069
|
| Created: | January 18, 2005 |
Updated: | February 18, 2005 |
| Description: |
Javier Fernández-Sanguino Peña noticed that the auxiliary scripts
"tcltags" and "vimspell.sh" created temporary files in an insecure
manner. This could allow a symbolic link attack to create or overwrite
arbitrary files with the privileges of the user invoking the script
(either by calling it directly or by execution through vim). |
| Alerts: |
|
Comments (none posted)
wv: buffer overflow
| Package(s): | wv |
CVE #(s): | CAN-2004-0645
|
| Created: | July 14, 2004 |
Updated: | February 10, 2005 |
| Description: |
wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem. |
| Alerts: |
|
Comments (none posted)
XChat 2.0.x SOCKS5 Vulnerability
| Package(s): | xchat |
CVE #(s): | CAN-2004-0409
|
| Created: | April 19, 2004 |
Updated: | November 15, 2005 |
| Description: |
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client. |
| Alerts: |
|
Comments (none posted)
xine-lib: arbitrary code execution
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1187
CAN-2004-1188
CAN-2004-1300
|
| Created: | December 21, 2004 |
Updated: | January 25, 2005 |
| Description: |
Several buffer overflows have been discovered in xine-lib, the video/audio
codec library for Xine frontends (xine-ui, totem-xine, kaffeine, and
others). If an attacker tricked a user into loading a malicious RTSP stream
or a stream with specially crafted AIFF audio or PNM image data, they could
exploit this to execute arbitrary code with the privileges of the user
opening the audio/video file. See this advisory
for more information. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xorg-x11: integer overflows
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2004-0914
|
| Created: | November 18, 2004 |
Updated: | September 12, 2005 |
| Description: |
The X.Org libXpm library has several integer overflow vulnerabilities
An attacker can modify XPM images to execute malicious code. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2004-1125
|
| Created: | December 23, 2004 |
Updated: | April 1, 2005 |
| Description: |
xpdf has a
potential buffer overflow problem caused by insufficient input validation.
A specially crafted PDF file can allow an
attacker to execute code with privileges of the xpdf user. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
xpdf: integer overflows
| Package(s): | xpdf kpdf cupsys |
CVE #(s): | CAN-2004-0888
CAN-2004-0889
|
| Created: | October 21, 2004 |
Updated: | February 18, 2005 |
| Description: |
Several xpdf integer overflow vulnerabilities can be exploited via a
mal-formed PDF document. Similar vulnerabilities can be found in kpdf and
in cupsys which share code. Additional information can be found in this KDE security advisory. |
| Alerts: |
|
Comments (none posted)
zip: arbitrary code execution
| Package(s): | zip |
CVE #(s): | CAN-2004-1010
|
| Created: | November 5, 2004 |
Updated: | February 2, 2005 |
| Description: |
HexView discovered a buffer overflow in the zip package. The overflow is
triggered by creating a ZIP archive of files with very long path
names. This vulnerability might result in execution of arbitrary code with
the privileges of the user who calls zip. This flaw may lead to privilege
escalation on systems which automatically create ZIP archives of user
supplied files, like backup systems or web applications. |
| Alerts: |
|
Comments (1 posted)
zlib: denial of service
| Package(s): | zlib |
CVE #(s): | CAN-2004-0797
|
| Created: | August 25, 2004 |
Updated: | June 10, 2005 |
| Description: |
Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks. |
| Alerts: |
|
Comments (none posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch is 2.6.11-rc2,
released by Linus on January 21.
Changes this time around include some networking updates (including a "fix"
for a
NETIF_F_LLTX race condition which was subsequently
withdrawn), an ALSA update (to version 1.0.8), some enhancements to the
"circular pipe buffers" code introduced in -rc1, the
ioctl()
method rework, in-inode extended attributes for ext3, some additions to the
completion API, some spinlock changes, and fixes for the latest round of
security problems. The
long-format
changelog has the details.
The flow of patches into Linus's BitKeeper repository has slowed as things
begin to stabilize for the 2.6.11 release. Changes merged since -rc2
include some architecture updates, the removal of bcopy(), a fix
for writable module parameters in sysfs (it never actually worked before),
and various fixes.
The current -mm tree is 2.6.11-rc2-mm1.
Recent changes to -mm include some random driver reworking, the POSIX
high-resolution timers patch set, ACL support for the NFS client, the
isochronous CPU scheduler (see below), and some crypto API work.
The current 2.4 kernel is 2.4.29; no 2.4.30 prepatches have been
released.
Comments (none posted)
Kernel development news
Two weeks ago, this page
looked at the realtime security module, an addition requested by Linux
users who need to be able to ensure that certain applications are able to
respond quickly to external events. Musicians working with Linux, in
particular, want a system which can keep up with audio streams - a task
which requires sub-millisecond response in many cases. Unpatched Linux
kernels have generally not been able to provide latencies that low in any
sort of reliable way.
The idea of merging the realtime module appears to have been dropped for
now; the opposition was too strong. There are a couple of other approaches
which are being worked on, however, to meet the audio developers' needs.
In particular, Con Kolivas and Ingo Molnar have been creating patches, and
audio hacker Jack O'Quin has been tirelessly testing them out. Two
approaches which look like they could solve the problem have emerged from
this work.
The approach taken by Con Kolivas is the isochronous scheduler patch. This patch, in
its current form, creates two new scheduling classes: SCHED_ISO_RR
and SCHED_ISO_FIFO. These classes function much like the realtime
scheduling classes in that they provide a higher scheduling priority than
any SCHED_NORMAL process enjoys. They differ from the true
realtime classes, however, in a couple of ways. No privilege is required
to enter one of the isochronous classes, so audio applications need not run
as root. The scheduler will also automatically select an isochronous class
if an unprivileged application attempts to enter a true realtime class,
with the result that many audio applications can use the new classes
without modification.
The isochronous classes give high-priority access to the CPU, but only to a
point. If isochronous processes use more than an administrator-defined
percentage of the processor (70% by default), they get dropped back to the
SCHED_NORMAL class for a while. This feature prevents
high-priority, unprivileged tasks from taking over the system entirely.
This is an important feature - the lack of any such protection was the
reason for many of the objections to the realtime security module.
Ingo Molnar's approach, instead, is the
creation of a new resource limit (initially called
RLIMIT_RT_CPU_RATIO, later changed to RLIMIT_RT_CPU).
This limit controls what percentage of the processor's time may be taken by
all unprivileged realtime processes. If the limit is in effect, the patch
also allows any process to enter the realtime scheduling classes. So the
end result is similar to that obtained with Con's patch: unprivileged tasks
can get realtime access to the processor, but they are prevented from
taking over entirely. The difference is that Ingo's patch is somewhat
smaller and simpler, and does not require the introduction of new
scheduling classes.
The rlimit-based patch is also interesting in that it allows each process
to have a different maximum CPU utilization limit. Imagine a system
running a set of audio applications where some have their limit set at 60%,
and others at 80%. If 70% of the available processor time is actually
being used by realtime tasks, processes with the 60% limit will lose their
realtime access, but the 80% processes will not. This scheme, thus, allows
a smart supervisor (such as the jack server) to arrange for a
(relatively) graceful degradation as contention for the CPU increases.
Jack O'Quin's benchmarking suggests that either patch, in their most recent
forms, has the potential to solve the problem (though the realtime
preemption work may also be required for a complete solution). He appears
to favor Ingo's version, however, and its relative simplicity could well
argue for taking that path. It does not seem that any decisions have been
made, however; it may be that nothing is merged until the 2.6.12 process
starts. It does appear, however, that life is about to get a little easier
for Linux audio users, which is a good thing. It can be worthwhile to be
noisy about your needs, especially if you are willing to put time into
helping in the development of the solution.
Comments (7 posted)
Keeping track of the current time is one of the kernel's many jobs. In the
Linux kernel, this task is handled in a very architecture-dependent way.
Each architecture has its own sources of high-resolution time, and each
performs its own calculations. This system works, but it results in quite
a bit of code being duplicated across architectures, and it can be
brittle. Patches which change time-related code often do not manage to
correctly update all architectures.
John Stultz has been working for some months on a cleaner alternative. The
result is a new time subsystem which, he
hopes, will improve the situation.
Much of the patch can be seen as a refactoring of the time code. Common
calculations are now performed in the timeofday core, rather than in
architecture-specific code. The code for implementing the network time
protocol (NTP), an interesting exercise in complexity itself, has been
separated from the rest of the time code and hidden in its own file. Most
of the core time code has been reworked to deal with time in nanoseconds, a
format which gives adequate time resolution but which, in a 64-bit
variable, is still good for centuries. The timeofday code no longer
depends on the jiffies variable, meaning that it can work
independently of the timer interrupt, which may be disabled in some
situations. The overall result is kernel timing code which is much easier
to read and understand.
In the end, however, the timing code must go to the hardware to actually
get high-resolution time values. John made a couple of observations here.
One is that, while time sources are architecture-dependent, many
architectures share the same types of timing hardware. The other was that
the code which deals with a time source is really just another device
driver. So he isolated the time source information into its own structure:
struct timesource_t {
char* name;
int priority;
enum {
TIMESOURCE_FUNCTION,
TIMESOURCE_CYCLES,
TIMESOURCE_MMIO_32,
TIMESOURCE_MMIO_64
} type;
cycle_t (*read_fnct)(void);
void __iomem* mmio_ptr;
cycle_t mask;
u32 mult;
u32 shift;
void (*update_callback)(void);
};
Here, name is just a name for the source, and priority is
used to choose between multiple available sources. The type field
tells how this source can be read. If type is
TIMESOURCE_FUNCTION, the read_fnct() will be called to
read the source. The two _MMIO_ variants are for hardware which
can be read directly from I/O memory; in that case, the time code can just
obtain a value from the location indicated by mmio_ptr with no
need to call any outside functions. TIMESOURCE_CYCLES indicates
that the processor's time stamp counter (TSC) is being used, so
get_cycles() is called to get the actual value.
In any of the above cases, the value returned by the time source is assumed
to be some sort of counter. The mask, mult, and
shift values are applied to turn a delta between two such values
into a number of nanoseconds for the rest of the timekeeping code.
With this structure in place, architecture-specific code need only fill in
a timesource_t structure (possibly implementing a read function in
the process) and pass it to register_timesource(). All the rest
is then handled in the common code. John has provided a set of time source drivers for a few
architectures which demonstrates how they can be written.
The discussion of the patches suggests that, while developers like the
general intent, there are some remaining concerns - especially among the
architecture maintainers. In some architectures, the
gettimeofday() system call can be handled entirely in user space,
but the current patches do not yet support that. The current NTP
implementation is also seen as being too expensive. Finding a way to cut
the cost of NTP while maintaining accuracy could be a bit of a challenge,
but John is working at it. Expect to see some more iterations on this
one.
Comments (none posted)
A few small internal API changes have been merged for 2.6.11. For the
record, here's what they are.
The completion mechanism allows a thread in
the kernel to block until a specific event happens. Three new functions,
some of which appear to be aiming for the "longest name in the kernel"
prize, have been added:
int wait_for_completion_interruptible(struct completion *c);
unsigned long wait_for_completion_timeout(struct completion *c,
unsigned long timeout);
unsigned long wait_for_completion_interruptible_timeout(struct completion *c,
unsigned long timeout);
Each of these functions should be relatively straightforward to understand:
they add interruptible and timeout variants to the basic
wait_for_completion() function. They were added it make it easier
to convert more semaphore users over to the completion API, which is more
appropriate for cases where a one-shot operation is being waited for. This
change is another small bit of fallout from the realtime preemption work.
The kernel has long had an implementation of bcopy():
void bcopy(const char *src, char *dest, int size);
Arjan van de Ven and Adrian Bunk recently noticed a couple of things:
(1) nothing in the kernel was actually using bcopy(), and
(2) the implementation was broken. bcopy() is supposed to be
able to handle overlapping source and destination areas, but, for a number
of architectures, the kernel implementation would not do the right thing
with such areas. So a patch was merged
which removes bcopy(). No other in-kernel changes were needed,
but out-of-tree modules which use bcopy() will need to be
changed.
Chip Salzenberg (and others) noticed that a couple of networking functions
- skb_copy_datagram() and sock_alloc_send_pskb() - are
no longer exported to modules in the 2.6.11 prepatches. This change breaks
the out-of-tree VMWare modules. Fixes for VMWare have already been merged.
On the PCI front, a patch from Pavel Machek
which changes the prototype of the suspend() method in
struct pci_driver was merged. The new prototype is:
int (*suspend)(struct pci_dev *dev, pm_message_t state);
By changing the type of the state parameter, the patch allows the
removal of some translation code and lets PCI drivers know what is really
going on at the higher power management levels. Pavel is looking for help in fixing PCI drivers to use
the new interface.
A few spinlock primitives have seen changes. For starters, the macro
rwlock_is_locked() has been removed. It was never clear whether
the macro referred to read or write locking, so Linus dealt with the
confusion by just taking it out altogether. Then a new set of primitives
was added:
int read_can_lock(rwlock_t *rw);
int write_can_lock(rwlock_t *rw);
These test whether an attempt to obtain a read or write lock at that time
would have succeeded. In addition, there is a version for regular
spinlocks:
int spin_can_lock(spinlock_t *lock);
This function returns a nonzero value if an attempt to obtain lock
would have succeeded, but does not actually modify the lock.
Finally, the name of the internal lock field in the spinlock
structure was renamed to slock. This change was made to force
the compiler to complain when rwlock primitives are used on a regular
spinlock (and vice versa). This sort of type safety could also have been
achieved by using inline functions, rather than macros, but some
performance problems with gcc prevented that approach from being
used.
Comments (1 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Janitorial
Memory management
Architecture-specific
Security-related
- Fruhwirth Clemens: Add LRW.
(January 24, 2005)
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
After the highly successful launch of
Ubuntu Linux last October, all eyes
are now on the next release - version 5.04 and code name "Hoary". What can
we look forward to? Quite a bit: GNOME 2.10, OpenOffice.org 2.0 (or, at the
very least, a beta version of the new package in one of the unsupported
repositories), Unicode encoding throughout all applications, better package
management with newly introduced update-manager and upgrade-notifier, as
well as a set of new Ubuntu live CDs - not only for the i386 architecture,
but also for AMD64, IA64 and PPC. With all these ambitious features, Ubuntu
is quickly becoming a force to reckon with in the Linux world.
We decided to take an early look at the current state of development at
Ubuntu by downloading and installing the Ubuntu "Hoary" Array-3 CD for
AMD64. In the Ubuntu terminology, Array-3 is something that other
distributions might call Alpha-3; in other words, a highly experimental
release. Nevertheless, the developers asserted that the the package is
reasonably free of showstopper bugs. We installed it on a system with the
following specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2
(Socket939) mainboard from Micro-Star International, 2 GB of DDR SDRAM, 2 x
120 GB Maxtor hard disks, Plextor PX-712A DVD/CD rewritable drive, NVIDIA
GeForce4 Ti 4600 graphics card, and a standard 19 inch LCD monitor from
Mozo International.
As far as the system installer is concerned, not much has changed since
"Warty", Ubuntu's current stable release. The installer is still text-mode,
a slightly modified Debian installer that will ship with the upcoming
Debian 3.1. Some of the modules have been moved around; for example the
screens that prompt users to configure the time zone and setup a user
account now appear just after the base system has been installed and before
the user is prompted to reboot. Additional packages are installed after the
reboot and this is where we ran into some troubles with dependency issues
and were promptly dropped into aptitude, a text-mode package manager.
Rather than fiddling around in what we thought was an archaic and
unintuitive user interface, we quit aptitude and used the command line to
"apt-get install ubuntu-desktop", which did the work of installing a
graphical desktop with the latest development release of GNOME.
GNOME is the heart of the Ubuntu desktop, and the only supported graphical
environment in this distribution. There has been much enthusiasm for the
recent GNOME releases, especially since "spatial mode" in Nautilus was
accepted as a feature, rather than a bug. With its clean desktop, excellent
internationalization, and less complex (compared to KDE) configuration
options, GNOME, now backed by Red Hat, Novell and Ubuntu, has matured into
a worthy competitor to KDE which, at one point, seemed to be winning the
desktop battle. The first beta of GNOME 2.10 (developer version 2.9.90) was
released earlier this week and packages are already available in the main
repository of the Ubuntu development branch. There will be one more beta,
followed by a quick release candidate, before the final release of GNOME
2.10 expected on March 9th, 2005.
What's new in GNOME 2.10? There aren't any real groundbreaking new features,
but rather many small improvements that will make our computing lives a
little easier. Some applications have been given additional
functionalities; as an example, Yelp, the GNOME help browser now supports
HTML help (powered by the Gecko rendering engine), man pages and GNU info.
Novell Evolution (currently broken on Hoary) has seen many interesting
changes with the addition of the "eplugin", an extensible plugin manager
for adding extra functionality to the groupware client. The GNOME System
Tools package has also been getting much attention lately and a new module
for configuring network interfaces and another one for disk management will
be making their appearances in GNOME 2.10, or possibly the following
release. Many new applets, panel and applet transparency, improved user
interfaces for configuring various aspects of the GNOME desktop, and
several newly proposed applications to be officially included in GNOME
(e.g. Totem, Sound Juicer, Goobox) - all these seeming small but highly
effective innovations will complement the already excellent desktop suite.
We would have loved to test the current beta release of OpenOffice.org 2.0,
but despite its presence in the "universe" (i.e. unsupported) directory on
the Ubuntu download servers, it turned out to be not installable. Also,
there are still no native 64-bit packages for OpenOffice.org, so we were
left with version 1.1.3, a 32-bit application making use of the ia32-lib
compatibility libraries stored in the /lib32 directory. Had we chosen not
to install OpenOffice.org on the system, we would have ended up with a pure
64-bit system, with all applications compiled and optimized for the AMD64
processor.
We have already mentioned the Ubuntu live CDs, which represent another
interesting aspect of this distribution. These live CDs are now built by
the maintainers of Gnoppix, a project
that was originally an attempt to develop a Knoppix-like distribution for
GNOME users. The latest beta builds of Gnoppix (version 0.9.3) are shaping
up to be truly impressive products; they serve not just as live CDs, but
also as full installation CDs, depending on the selection one makes in the
main menu. It is not quite clear whether these CDs will become the primary
means of installing Ubuntu Linux, but it is certainly an attractive idea -
this way, users would only need to commit a hard disk partition to the
operating system after they have ascertained that the product meet their
needs. Based on discussions on Ubuntu forums, these live CDs reportedly
work well on Apple hardware, which makes Gnoppix one of the first Linux
live CDs available for the Macintosh (the developers at ROCK Linux have
also built a full bootable live CD for the Mac).
Although the current alpha version of Ubuntu Linux comes with its fair share
of bugs, the developers seem to be on the right track to produce another
memorable release in April this year. If you'd like to join the legions of
satisfied Ubuntu users, you might consider placing an order for the new
Hoary CDs; they ship free of charge - perhaps contrary to any business
sense, but certainly true to the spirit of Ubuntu's ideals of humanity and
sharing. And that's what Free Software is about.
Comments (16 posted)
Distribution News
Patrick Volkerding has sent out a Slackware changelog notice decreeing the
first 10.1 beta. There is also a fairly detailed update on his ongoing
health issues; click below for the full story.
Full Story (comments: 8)
The first beta for
Mandrakelinux v10.2 has been
released. The
Mandrakelinux 10.2 Beta
information page is the place to go to find out more.
Comments (none posted)
Here's the latest
Sarge status report with
a look at the remaining bugs and other issues. "
After the expected
slide in activity and backslide in bug count over the holidays, the release
team has gotten an aggressive start on the new year, starting off with the
arrival of first a new gcc-3.3 (for some ia64 fixes) and then KDE3.3 in
testing, allowing us to clear a hefty chunk of release-critical bugs
(including numerous security bugs) from the list for sarge."
The debian-volatile project aims to provide reliables updates for stable
systems on fast moving targets such as spam filtering and virus
scanning. Here's the latest status report
for the debian-volatile project.
Comments (none posted)
Ubuntu has
announced that Array CD 3 is
ready. This is the third in a series of milestone CD images, released when
they're known to be reasonably free of showstopper CD-build or installer
bugs, while representing very current snapshots of Hoary.
"
Pre-release versions of Hoary are *not* encouraged for anyone needing
a stable system or anyone who is not comfortable running into occasional
breakage. They *are* recommended for Ubuntu developers and those who want to
help in testing, reporting, and fixing bugs."
The latest Ubuntu Community Council meeting was held on January 25, 2005.
As usual, Mako has made available both the
Summary and the full log. The two big issues discussed at the meeting
were: changes to the processes through which people can become new members
or new maintainers and the idea of instituting reply-to headers for the
Ubuntu users mailing list.
Comments (none posted)
There's an announcement at
Slackware.com that Stuart Winter, "the
Slackware Packaging Expert", will be giving a talk on the Slackware
packaging system at
FOSDEM 2005.
Comments (none posted)
Xen is now available from the Fedora development repository. "
We're
following the -unstable Xen tree at the moment which does occasionally lead
to things being broken but also lets us track a lot of the more interesting
work going on there. Since setting up to run Xen isn't entirely
straight-forward, here's a run-through of what should work for setting up a
single Xen guest running the Fedora development tree." You can read
the guide by clicking below, or visit the
FedoraXenQuickStart guide at its new wiki page.
Full Story (comments: none)
FC3 updates
cups-1.1.22-0.rc1.8.4
(fixes CAN-2005-0064),
alsa-lib-1.0.6-7.FC3
(new version fixes bugs),
kernel-utils
(update microcode_ctl to 1.11),
pam-0.77-66.2 (bug fixes),
grep-2.5.1-31.4 (fixes a small regression in
handling multibyte input),
hal (new
upstream release fixes bugs),
im-sdk-12.1-10.FC3 (bug fix update),
gphoto2-2.1.5-1.1 (version upgrade to 2.1.5),
apr-0.9.4-24.2 (rebuild to fix bundled
libtool),
hal-0.4.7-1.FC3 (new upstream
release),
gaim-1.1.2-0.FC3 (fixes a great
many bugs),
tetex-2.0.2-21.3 (fixes xpdf
buffer overflow CAN-2005-0064).
FC2 updates cups-1.1.20-11.10 (fixes
CAN-2005-0064), gaim-1.1.2-0.FC2 (fixes a
great many bugs), tetex-2.0.2-14FC2.2
(fixes xpdf buffer overflow CAN-2005-0064).
Comments (none posted)
Mandrakelinux has updated php packages with bug fixes.
Full Story (comments: none)
New Distributions
EzPlanet One Linux is a Linux
distribution tuned for Enterprise solutions. EzPlanet One integrates
advanced technologies, flexibility, quality and security. Built with the
Enterprise in mind, it features also several tools for the Professionals
and Individual users, that make its use more fun. EzPlanet One version 2.0
was released January 2005.
Comments (none posted)
Distribution Newsletters
Here's the Debian Weekly News for January 25, 2005. This week you can read
about experimental packages of Exim4 linked against db4.2, a guideline on
using the new debian-installer, a Sarge release progress update, a status
update for volatile archive, and several other topics.
Full Story (comments: none)
The Gentoo Weekly Newsletter for the week of January 24, 2005 is out. This
week's topics include OpenSolaris and Portage support, new kernel profiles
for 2005.0, Genesi Open Desktop Workstation with Gentoo pre-installed,
Gentoo first to run on Mac Mini, and more.
Full Story (comments: 2)
The
17th
issue of Ubuntu Traffic is out. The author is still working to
catch up to 2005; this issue covers the second week of the Mataró
conference, with looks at Rosetta, accessibility, security, Python, and
more.
Comments (none posted)
The
DistroWatch
Weekly for January 24, 2005 is out. "
Welcome to this year's 4th
issue of DistroWatch Weekly! We comment on why we believe that there is no
reason to worry about the future of Slackware Linux, reveal a new RPM
package resource for SUSE users, and point out a fresh controversy
occupying some of the Debian developers - XFree86 versus X.Org. Also, don't
miss the newly released Linux+ Live DVD and a new distribution for Farsi
(Persian) speakers - Parsix GNU/Linux. Enjoy!"
Comments (none posted)
Minor distribution updates
Arch Linux 0.7 has been
released. Information on
changes is relatively sparse, but
this changelog shows
improved 2.6 support, udev, X.Org, and more. (Thanks to Xavier de
Laboure).
Comments (2 posted)
Gnoppix has released
GNOPPIX
Developer version 0.9.3b3 Hoary for PowerPC, AMD64 and Intel i386
Platforms. This version comes with Gnome 2.9.3 and Xorg.
Comments (none posted)
Openwall GNU/Linux has released a patched Linux 2.4.29-ow1 which fixes several recent vulnerabilities. The Openwall (Owl) distribution now uses that kernel and moves to GCC 3.4.3 and glibc 2.3.3+.
Full Story (comments: none)
tinysofa classic server 1.1
Update 3 (Rio) is now generally available. Take a look at the
change
log for details.
Comments (none posted)
Newsletters and articles of interest
O'ReillyNet
summarizes
BSD news. "
OpenBSD switches to GCC 3, NetBSD releases 2.0, FreeBSD
meets its donation mark, and DragonFly BSD starts to implement journaling.
Sam Smith reports the BSD news for December 2004."
Comments (none posted)
Distribution reviews
LinuxTimes
reviews the
Yoper Operating System (YOS)
"
Yoper Operating System (YOS), or Yoper GNU/Linux if you prefer, was an eye-opener even for someone who has used over fifty GNU/Linux distributions. Everything just seemed to work, and it was as simple as that. Could this be the answer to the Microsoft problem?"
Comments (none posted)
Here's a
mini
review of Ubuntu Linux, on NewsForge. "
I've found a Linux
distribution that meets my criteria for an ideal system. Ubuntu Linux is
fast. It has simple software updating and installation through Debian's
Synaptic package manager. All of my removable media works automagically. It
detected all of my hardware. And above all, it has a simple, clean, elegant
interface that I love."
Comments (none posted)
Mad Penguin
takes a
look at VidaLinux 1.1. "
So we've established that VidaLinux is
based on Gentoo right? It is. Isn't Gentoo just Gentoo either way you cut
it? Well, not really. What sets VidaLinux apart from its parent is actually
twofold. The first thing you'll notice is that it uses Red Hat's Anaconda
installer. With VidaLinux there is no need to print out a tens of pages of
documentation to install your system via the command line
interface. Everything is done using the graphical Anaconda interface. This
provides a huge benefit to those who might have been intimidated by Gentoo
Linux but want to give it a shot."
Comments (none posted)
Page editor: Rebecca Sobol
Development
Matplotlib
is an easy to use plotting library with the capability of generating
a wide variety of data plots.
matplotlib is a python 2D plotting library which produces publication quality figures using in a variety of hardcopy formats and interactive GUI environments across platforms. matplotlib can be used in python scripts, interactively from the python shell (ala matlab or mathematica), in web application servers generating dynamic charts, or embedded in GUI applications.
Matplotlib supports a wide variety of plotting commands; the
pylab interface can be used for those who already know
Matlab, a popular
commercial mathematical application.
A comprehensive
tutorial is available for educational purposes and the
screenshots page has numerous examples of matplotlib in action,
including example code for each plot.
The FAQ
document contains additional usage information.
Matplotlib lives up to its claim of
being easy to use, just a few lines of code are all that is required
to produce professional looking output.
Installation of matplotlib is fairly straightforward, your
editor had no problem making it work on an older Red Hat 9
system, the Fedora Core 3 installation is still proving to be
somewhat tricky due to dependency issues.
Matplotlib requires
Numerical Python
(now called Numarray),
which in turn requires several additional libraries.
Version 0.71 of Matplotlib was announced this week.
The changes include:
- The numerix module has been reorganized to improve namespace issues.
- Contours now use the default colormap.
- The colorbar system now works with arbitrary axes.
- New accents are available in the mathtext command.
- Numerous bugs have been fixed.
- Other minor enhancements are included.
See the
what's new
document for more details on this release.
If you are looking for a fairly straightforward way to generate
automated or manually created data plots, Matplotlib is worth
investigating.
The source code is available for download
here.
Comments (6 posted)
System Applications
Audio Projects
The
latest changes from the
Planet CCRMA audio utility packaging project include
new versions of apt, Muse, Fweelin, Liblo, Qjackctl,
Seq24, and Alsa.
Comments (none posted)
Database Software
The
Firebird Database
project has announced a recall of Firebird 1.5.2 for the AMD64 platform.
"
Because some potential corruption problems have shown up with pre-existing databases on the AMD64 Linux installations of Firebird 1.5.2, the kits have been recalled to the pre-release area for further testing."
Comments (none posted)
GnomeDesktop.org
covers the release of
FlameRobin 0.2.0 ALPHA, a Firebird database administration tool.
"
It now comes with property sheets and editors for most database objects, brand new background backup & restore features and a MacOS X port. Not to mention the new program logo, new home on sf.net."
Comments (none posted)
Version 1.4 of Mammoth PostgreSQL Replicator is available.
Changes include support for live promotion, non-blocking full dump,
and bug fixes.
Full Story (comments: none)
Issue #94 of
PostgreSQL General Bits is online after a long sabbatical.
"
General Bits is a column loosely based on the PostgreSQL mailing list pgsql-general." Take a look to read about PostgreSQL 8.0.0 and
other topics.
Comments (none posted)
Filesystem Utilities
Version 2.5.1 of the Enterprise Volume Management System
has been announced.
"
This is the first maintenance release in the EVMS 2.5.x
series, and is primarily intended to fix some recent bug-reports, as well as
to update to the most recent kernel and Device-Mapper releases."
Comments (none posted)
Interoperability
Version 3.0.11pre2 of Samba is available.
Changes include new net rpc command options, assignable rights
for specific SIDs, and bug fixes.
Full Story (comments: none)
Mail Software
Version 0.93.5 of Bogofilter, a Bayesian spam filter, has been released.
"
The big change since the stable release (version 0.92.8) is that
Berkeley DB support now the Transaction API to allow multiple readers
and writers for wordlists. Be sure to read file README.DB and the
RELEASE.NOTES file if upgrading from 0.92.8 (or any older version)."
Full Story (comments: none)
Networking Tools
Manas Ranjan Behera
explains how to build a push proxy gateway in an IBM developerWorks
article.
"
Learn how to set up a PPG on your own, configure the settings to your own taste, develop push content, and test it with a mobile handset simulator over a TCP/IP network on a LAN."
Comments (none posted)
Printing
The CUPS printing project has posted
a status update
concerning the GPL version of Ghostscript.
"
We are in the process of integrating ESP Ghostscript with the GPL Ghostscript 8.15 baseline."
Comments (none posted)
Web Site Development
Version 1.6.2 of the Midgard Open Source Content Management Framework
has been announced.
"
This release doesn't provide any new features, it is bugfix release which
makes midgard much more easier to install and much more stable for running
production environments."
Full Story (comments: none)
Version 3.2.30 of
mnoGoSearch,
a web site search engine, is out. See the
change history
for details. Also, new versions of mnoGoSearch-php and
mnoGoSearch-php-extension are available.
Comments (none posted)
Version 1.3.2 of
MoinMoin,
a Python-based wiki package, is out with a fix for an ACL problem.
Comments (none posted)
Version 1.8.5 of Tiki, a CMS/Groupware application,
has been announced.
"
Tiki admins are strongly urged to upgrade to this version due to vulnerabilities in versions prior to 1.8.5 that can lead to unauthorized remote control."
Comments (none posted)
Desktop Applications
Audio Applications
The 0.9beta24 release of Ardour, a multi-track audio recording
application, is out with this explanation:
"
Well, originally, 0.99 was due to be the next release, but Ron Parker
and his trusty intern Spencer uncovered some significant usability
issues with xfades and region layering. Fixing this required
substantive codes changes, and I want to make a 0.9beta24 release to
help flush out any issues."
Full Story (comments: none)
Version 0.9.2.0 of Snd-ls, a distribution of the sound editor Snd,
is available. Here is the change log entry:
"
Updated SND to v7.10 from 20.1.2005. Many important changes".
Full Story (comments: none)
Desktop Environments
The following new GNOME software has been announced in the last week:
Comments (none posted)
The January 21, 2005 edition of the
KDE CVS-Digest
is online with the following content summary:
"
Ruby Kdebindings now support .kcfg files. KDevelop adds source navigation history. KChart adds print support. KWin adds translucency support. A new HighContrast style added for partially sighted users."
Comments (none posted)
KDE.News
mentions
the posting of some
screenshots for KDE 3.4 Beta 1.
"
KDE 3.4 Beta 1, christened Krokodile, was released not too long ago. For
those of you who have not yet taken the plunge, Eudpytula Minor has announced
some Krokodile screenshots for your viewing pleasure."
Comments (none posted)
Games
Version 0.3.8 of Cyphesis, a server for WorldForge games,
has been released.
"
This version includes the demo game Mason which is currently in development. This release is intended for server administrators wishing to run a Mason server or anyone wishing to work on serverside game development.
The major new feature in this release is the ability to run cyphesis completely stand alone without need for a database backend, or any of its library dependencies given a suitably configured binary."
Comments (none posted)
GUI Packages
KDE.News
mentions
the latest release schedules for Qt 3.3.4 and 4.0.
"
Trolltech has announced the release of Qt 3.3.4 which is a maintenance release including many bug fixes and optimizations. The final Qt 4.0 release is now anticipated for late second quarter of 2005 with two interim beta versions to be released in March and May."
Comments (none posted)
GnomeDesktop.org
mentions the latest release of the
PyGTK tutorial.
"
The PyGTK tutorial makes even easier and funnier learning how to program graphical applications using Python and Gtk+ that work seamlessly on GNU/Linux, *BSD or MS-Windows.
These updates include new information about features and widgets added to Gtk+ 2.4."
Comments (none posted)
Imaging Applications
Version 2.2.3 of the GIMP
has been announced.
"
With the release of version 2.2.3 of the GNU Image Manipulation
Program, the GIMP developers hope to have eliminated most, if not
all, of the regression bugs that kept people from upgrading from GIMP 2.0.
GIMP 2.2 is now at the point where everyone should be using it. Of course the
2.2 tree will be maintained further, but GIMP developers will now be able to
focus on the development branch again."
Comments (none posted)
Instant Messaging
Version 1.1.2 of Gaim, an instant messaging client,
has been released.
"
It contains some minor bug fixes, and a working HTTP connection method for MSN. This should help out people behind strict firewalls. We also have SecurID login support for AOL accounts that require it, thanks to an anonymous user for help getting that working."
Comments (none posted)
Mail Clients
As reported in MozillaZine, the latest Thunderbird builds now include some simple heuristics designed to detect (and warn about) phishing scams.
Comments (none posted)
Music Applications
Version 0.5 of orDrumbox, a cross-platform drum machine,
is available.
"
orDrumbox is a Software Drum Machine and Audio Sequencer in Java. Create
songs, use Drum Kits and have creative automatic composition features."
Comments (none posted)
Office Applications
Version 1.4.2 of the Gnumeric spreadsheet
has been announced.
Changes include Win32 improvements, rotated text support, and bug
fixes. See the
release notes for details.
Comments (none posted)
Web Browsers
The January 24, 2005 edition of the Mozilla Links Newsletter
is online with the latest Mozilla browser news and reviews.
Full Story (comments: none)
The minutes from the January 10, 2005 mozilla.org staff meeting
are online, here's the content summary:
"
Issues discussed include Mozilla 1.8 Alpha 6, Mozilla
Thunderbird, Mozilla Firefox, the Roadmap and accessibility."
Comments (none posted)
The minutes from the January 18, 2005 mozilla.org staff meeting
have been announced.
"
Issues discussed include update.mozilla.org, feedback on
Mozilla 1.8 Alpha 6, Mozilla Firefox 1.1, Mozilla Thunderbird 1.1, CDs,
infrastructure, @mozilla.org email changes, press articles and conferences."
Comments (none posted)
Languages and Tools
C
Dipak K. Jha
discusses reentrant C functions on IBM developerWorks.
"
If you deal with concurrent access of functions, either by threads or processes, you can face problems caused by non-reentrancy of the functions. In this article, learn through code samples how anomalies can result if reentrancy is not ensured, especially with regard to signals. Five recommended programming practices are included, along with a discussion of a proposed compiler model in which the compiler front end deals with reentrancy."
Comments (none posted)
Caml
The January 18-25, 2005 edition of the Caml Weekly News
is out, take a look for a number of new Caml language articles.
Full Story (comments: none)
Java
Deepak Goel
shows how to analyze J2EE bottlenecks on O'Reilly.
"
Scalability is one of the most important non-functional requirements of a system. But there could be several bottlenecks within a system, which might prevent it from being scalable. In this article, we try to analyze the case in which the software infrastructure becomes a bottleneck, long before any of the hardware resources (such as CPU, memory, disk space, and network speed) are fully consumed."
Comments (none posted)
Brian Goetz
discusses Java Generic types on IBM developerWorks.
"
Generic types, added in JDK 5.0, are a significant enhancement to type safety in the Java language. However, some aspects of generics may seem confusing, or even downright bizarre, to first-time users. In this month's Java theory and practice, Brian Goetz examines the common pitfalls that ensnare first-time users of generics."
Comments (none posted)
Lisp
Version 2.6.6 of GCL (GNU Common Lisp) is out.
"
This version, the latest in the `stable' series,
changes the format of executable files and fixes a batch of bugs."
Full Story (comments: none)
Version 0.8.7 of LTK, the Lisp Toolkit, is available.
"
This version adds
several new methods and arguments to MAKE-INSTANCE."
Full Story (comments: none)
Perl
Andy Lester
talks about The Phalanx Project on O'Reilly.
"
The primary goal of Phalanx is to increase the quality of a given module's test suite, mostly by increasing the amount of the module's code that the tests cover. However, there are secondary goals because we're working with the code anyway.
The first sub-goal is to find hidden bugs. As we add tests to modules, we hope to uncover broken functionality."
Comments (none posted)
The January 20, 2005 edition of
This Week in Perl 6 is available with a new round of Perl 6
language topics.
Comments (none posted)
PHP
The
PHP Weekly Summary for December 26, 2004 is out. Topics include:
Why we don't promote Apache 2,
endian detection,
allow_url_include,
PHP 4.3.11/5.0.4 pending,
PHP 5.1 in the manual,
ReflectionClass::hasMethod,
CVS karma,
PZVAL_UNLOCK,
CVS closed for Christmas,
Oracle Instant Client support, openssl non-blocking negotiation,
and a little black magic, and php.ini stuff.
Comments (none posted)
The
PHP Weekly Summary for January 3, 2005 is out. Topics include:
Of chickens, eggs, and Apache 2 (again)
realpath_cache revisited,
Startup order,
PHP 4.3.11 and 5.0.4,
Shared libraries,
Shutdown order and dl,
php_hostconnect,
extract issues,
win32 build issues,
Geeks and superheroes, and
Internet family.
Comments (none posted)
The
PHP Weekly Summary for January 10, 2005 is out. Topics include:
Bit of an odd bug,
php_sprintf,
constant names,
$host_alias check,
EXTENSIONS file,
FD_CLOEXEC, and
A noisy week.
Comments (none posted)
The
PHP Weekly Summary for January 17, 2005 is out. Topics include:
html_entity_decode,
Type hinting,
buildconf vs autoconf,
static method invoked by ...?,
To BC or not to BC?,
PIC/non_PIC,
sqlite_key,
External internals,
mbstring, and
Commercial interests.
Comments (none posted)
Python
The January 23, 2005 edition of Dr. Dobb's Python-URL!
is online with the latest Python language discussions.
Full Story (comments: none)
The December 1-15, 2004 Python-dev Summary is online with
a summary of the python-dev mailing list traffic for that timeframe.
Full Story (comments: none)
Version 1.5 of the Python Spread Module, a
Python wrapper module for the Spread messaging service
toolkit, is out.
"
The primary visible changes since release 1.4 are Mark McClain's new
code to give Mailbox objects a multigroup_multicast() method, and that
the Windows build now works with Spread 3.17.3."
Full Story (comments: none)
Version 1.20 of the online book
A Byte of Python is available.
"
This new version is a rewrite of the book and I've improved the explanations of most of the examples and added some new examples as well."
Comments (none posted)
David Mertz
examines Pyrex on IBM developerWorks.
"
The author takes a stab at speeding up his pure-Python version of hashcash using Pyrex, a language for writing Python extension modules that lets you avoid having to use C for the job. He contrasts writing code in Pyrex -- generally for use with larger Python applications -- with speeding up Python applications using the Psyco compiler, which he has written about previously on developerWorks."
Comments (none posted)
Tcl/Tk
The January 23, 2005 edition of Dr. Dobb's Tcl-URL! is online
with the latest Tcl/Tk news.
Full Story (comments: none)
XML
Elliotte Rusty Harold
introduces sXBL on IBM developerWorks.
"
SVG's XML Binding Language -- sXBL -- is an XML vocabulary being developed at the W3C as a means of mapping XML elements in arbitrary vocabularies to Scalable Vector Graphics (SVG) pictures that represent those elements. For example, an XML Metadata Interchange (XMI) document can be turned into SVG code that shows the actual Unified Modeling Language (UML) diagram encoded in the XMI document. But sXBL takes the separation of presentation from content one step further: It is a generic language for rendering documents as arbitrarily complex two-dimensional pictures."
Comments (none posted)
IDEs
GnomeDesktop
presents
a history of the Anjuta IDE.
"
It was back in 1999 when Naba Kumar released the first buggy alpha version
of Anjuta, an IDE for GNOME which should pack together all the great command
line development tools in linux and make software development easy on GNOME
desktop."
Comments (none posted)
Version 0.98.3 of Ultimate++
has been announced.
"
Ultimate++ is the new generation C++ Windows/Linux open-source development platform. By utilizing a couple of new principles Ultimate++ achieves significant reduction of code complexity and this way it saves the developments costs. Ultimate++ based application sources tend to be significantly shorter (~50%) than equivalent applications using any other C++ platforms."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Business Week has taken
a
lengthy look at how Linux is developed. "
Linux Inc. has become
so mature that it's clear it could continue to thrive even without
Torvalds. Already his chief lieutenant, Andrew Morton, shares leadership
duties and makes all the public appearances. From 1997 to 2003, when
Torvalds worked for chipmaker Transmeta Corp., putting out Linux wasn't
even his full-time job -- yet its market share in servers rose from 6.8% to
24%." There's
a picture of Linus and a penguin on the cover as well.
Comments (7 posted)
Robin Bloor
notes
that the open source database scene is getting crowded. "
Can so many
Open Source database products survive? I personally doubt it, but I may be
wrong. They may all generate a healthy and sizable submarket that justifies
their existence and, with Open Source products, it doesn't really matter
how big the user base is, as long as it is big enough to generate the
support network necessary to keep the product evolving and relevant. (CA is
already reporting that it is making a profit from its "open sourcing" of
Ingres - which probably means that Ingres has a brighter future as an Open
Source product than it had as a proprietary solution)."
Comments (8 posted)
Trade Shows and Conferences
KDE.News
covers the
annual meeting of KDE PIM hackers.
"
With over 40 bugs fixed, some interesting features implementented, the Kolab hackers participating, and the draft for GroupDAV revised with Helge Hess from OpenGroupware.org, this meeting was not only a successful boost of KDE PIM development, but also for PIM client-server interoperability in general."
The
meeting overview is online with more information.
Comments (none posted)
Guido van Rossum's presentation at the Amazon DevCon event on January 25
is online with
part one and
part two.
Comments (none posted)
The SCO Problem
There has been a ruling on SCO's discovery motion against IBM; the text is
available on Groklaw.
"
Accordingly, the court HEREBY ORDERS IBM to provide in a readily accessible format all versions and changes to AIX and
Dynix.
In essence, the court is ordering production of the information contained within the CMVC and RCS systems without granting SCO complete access at this time."
Comments (5 posted)
ZDNet
sums up
the state of SCO v. IBM. "
More importantly, the relevance of
this case to open source software in general has been demonstrated to be
small or nil, SCO's intemperate blustering notwithstanding. Forget Darl
McBride's sabre rattling about the GPL being against the US constitution:
the case is as it seemed when everything kicked off in 2003, a result of
SCO's affronted sensibilities at the way IBM ditched Project
Monterey."
Also worth a note: Netcraft has put up a
brief article poking fun at SCO for taking 10 months to put out an
OpenSSL patch.
Comments (2 posted)
As seen on Groklaw, the latest episode in the SCO drama has SCO complaining that IBM's discovery demands are excessive. "
And we now have the hilarious opportunity to watch SCO tell the court how burdensome it would be for SCO to have to produce to IBM every product Caldera distributed for the past 6 years. These are the same folks who whined until they got not only every released version of AIX and Dynix going back to the '80s but every *unreleased* one also, in their own discovery demands."
Comments (5 posted)
Companies
News.com
covers Intel's move to allow Linux laptop vendors to use the
Centrino logo.
"
Although Linux can run on existing Centrino notebooks, Intel until now wouldn't permit companies to sell Linux laptops using the Centrino logo.
The reason for the change: With the release of the 2.6.8 Linux kernel, the open-source operating system's power management abilities now meet Intel's requirements for Centrino notebook battery life, said Karen Regis, manager of mobile programs and promotions at the chipmaker."
Comments (none posted)
MozillaZine
covers the move of Ben Goodger from Mozilla to Google.
"
Ben Goodger announced today on his weblog that he has left the Mozilla
Foundation to take a position at Google, but will continue his roll as leader
of the Firefox project. He gives no details of his or Google's plans, but we
expect things like support for Mozilla in Google's desktop search and a
Google toolbar for Firefox can't be far off."
Comments (none posted)
Linux Adoption
ZDNet UK
looks at
Vienna's approach to free desktop deployment. "
The decision to
switch -- or not -- will be made on the unholy trinity of practicality,
lack of hassle and lowest expense; these are base desires, but
commendable. They are precisely the mundane reasons on which any grand
design will eventually prosper or founder. For this reason, Vienna will be
a bellwether, and we should watch the results carefully."
Comments (8 posted)
Linux at Work
Computerworld
looks at the use of Linux in the Australian Open tennis tournament.
"
"This year, for the first time we have installed an eServer i5 520 running the Internet scoring system and the Web site staging server on Linux," Simpfendorfer said. "At the core of the technology used to deliver the official Australian Open Web site are IBM's iSeries i5 running Linux on a Power chip, IBM Intel-processor based xSeries servers running Linux, and IBM pSeries servers running AIX.""
Comments (1 posted)
Legal
Heise Online
catches up
with the current state of the software patent fight in Europe. "
In
the meantime, the EU Council has also officially confirmed that the
concerns that Poland still has about the directive for software patents
will not be on the agenda of the meeting of agricultural ministers in the
Council of Agriculture and Fisheries, nor does the directive appear on the
list of the items to be resolved without discussion ("A items"). In other
words, the official adoption of the paper has once again been postponed
unless there is some last-minute attempt within the Council this Monday to
have the measure voted on." It could still come back next week,
apparently.
Comments (none posted)
Interviews
Red Hat Magazine
interviews
Chris Blizzard. "
Chris Blizzard has been with Red Hat since
1998. He also sits on the board of the Mozilla Foundation. We asked him to
share some of his insights about Mozilla's remarkable return to
prominence."
Comments (none posted)
Here's an O'ReillyNet
interview with
Scott Long, one of FreeBSD's core developers. "
Over the past
five years, the FreeBSD developer team has worked very hard to improve
performance on multiprocessor systems. Their goal was to remove the big
kernel lock used in the 4.x branch, and replace it with fine-grained SMP
support. This project, often referred to as SMPng ("SMP next generation"),
was a very big effort and took four releases (from 5.0 to 5.3) to reach
stable status. Federico Biancuzzi interviewed FreeBSD Core member Scott
Long about the SMPng technology, the current implementation status, future
goals, and plans."
Comments (6 posted)
Jeremy Andrews
interviews Timothy
Miller, of the Open Graphics Project, on KernelTrap.org.
"
Timothy Miller is a long time developer of graphics chips and
drivers. He has observed that there is a growing trend by graphics hardware
vendors to provide less and less information to free and open source
operating system developers. Without this information, it is becoming more
and more difficult to purchase new graphics hardware that is stable and
reliable on Linux and other free and open source operating systems. In
response, Timothy worked with his employer, Tech Source, to form the Open
Graphics Project."
Comments (8 posted)
Resources
James Morris has written
an article on protecting a network server with SELinux.
"
In this article we take a look at how SELinux can help increase the security of networked systems, as well as the design and implementation of its network-specific security controls. We then walk through an example of using SELinux policy to lock down a simple network application."
Comments (2 posted)
O'ReillyNet
shows how
to build a simple web application using Rails. "
Maybe you've
heard about Ruby on Rails, the super productive new way to develop web
applications, and you'd like to give it a try, but you don't know anything
about Ruby or Rails. This article steps through the development of a web
application using Rails. It won't teach you how to program in Ruby, but if
you already know another object-oriented programming language, you should
have no problem following along (and at the end you can find links on
learning Ruby)."
Comments (3 posted)
Keith Winston
sets up USB Wi-Fi adapter support in Linux, on NewsForge. "
I needed to connect my new desktop PC wirelessly from my second floor office to my first floor network. As I started researching the options for wireless USB adapters, I realized I might have some work ahead of me. Wireless USB in Linux is still in the early stages of development. But a little searching and some trial and error led to a successful connection."
Comments (8 posted)
Jason R. Briggs
shows how to use a wiki site for collaborative design of documentation.
"
Eventually I decided HTML was the obvious way to go and began writing specifications with carefully designed (standards compliant!) style sheets; with hrefs linking them together rather than oddball references in a Word doc. When a colleague installed MediaWiki for various other documentation requirements, it was a head-slapping, Homer Simpson-style Doh! moment."
Comments (none posted)
Reviews
NewsForge
takes a look at a new database application for OpenOffice.org.
"
This story will discuss the OpenOffice.org Base and how it can be
used in your business. I'll touch on the similarities (plus differences)
with the OpenOffice.org database program and Access. I'll continue with a
little commentary on migration issues. We'll finish up by building a basic
contact database, a form, a query, and a report using the wizards. If you
are already an OpenOffice.org believer, you can just skip down to the
"build a quick database application" section to see how it works."
Comments (6 posted)
GnomeDesktop
points to a
long and
detailed review of the current release of Inkscape on Stopped Clock.
"
I thought that if I have to do the icons in SVG ever again, I may as
well revisit the river. Since I just upgraded to Ubuntu Hoary (Gnome 2.10
is slick!), I gave Inkscape a try again. Since I'm an old Illustrator
junkie, I knew it's going to be tough getting used to especially since I've
tried and failed before. I expected being disappointed, I was surprised in
many areas though. Looks like a lot of good stuff happened while I wasn't
watching :) I'm actually confident that it's usable to create less complex
artwork."
Comments (1 posted)
developerWorks
takes
a detailed look at Pyrex, a language specifically designed for the
creation of Python extension modules. "
In well-chosen cases, a Pyrex
module can run 40-50 times faster than a Python version of the same
module. But in contrast to writing the module in C, per se, the Pyrex
version will hardly be any longer than the Python version, and the code
will look much more like Python than like C."
Comments (2 posted)
This NewsForge article
searches for extensible window managers. "
In the past year, a
number of small window managers have appeared that emphasize scriptable
extensibility. My favorite is Kahakai, a Waimea derivative with support for
Python scripting. Unfortunately, Kahakai is no longer under active
development. Many of the former Kahakai developers have contributed to the
Aegis project, which is still not mature enough to adequately assess. I
have also looked at PyEvilWM, a Python-enhanced derivative of the
lightweight keyboard-oriented window manager EvilWM. Fluxbox users may be
interested in FluxSpace, a Fluxbox derivative with support for Python
scripting."
Comments (14 posted)
Harry Halpin
reviews
the W3C document
Architecture of the World Wide Web on O'Reilly.
"
The most significant networked application development yet is the World Wide Web, which has made the the personal computer a must-have item, and a web address as crucial as a phone number for a successful business. This is only the beginning; from web services to the Semantic Web, the web is changing fast. Yet no matter how fast things change, some things remain the same; this holds true for the principles of web architecture. Publication of the "Architecture of the World Wide Web" by the W3C hopes to codify these principles."
Comments (none posted)
Miscellaneous
Jay Lyman
describes the dismal Linux support experience he received
from mainstream vendors Best Buy, Circuit City, CompUSA, and Dell.
"
Calls to three local stores in Oregon proved somewhat disappointing, as the dreaded Linux (incorrectly pronounced L-eye-nux) bewilderment continued. The first store, in Portland, routed my call to computer support, which rang indefinitely with no answer. The second call was to the Best Buy in Beaverton, home to the Open Source Development Labs (OSDL). However, during regular store hours on a regular business day, there was no answer, no answering service, no re-route -- nothing but ringing."
Comments (19 posted)
Mozilla Foundation president Mitchell Baker has posted
a blog entry about the release of Firefox 1.0.
"
After a while the anticlimactic feeling faded as we began to get information about the number of downloads and the general reception of Firefox. As best we can figure it, around 1,000,000 people came to download Firefox on the first day alone. That's an astonishing number, far beyond what we had seen before. As Chris Hofmann put it, the building at the Mozilla Foundation might seem quiet, but the wires were burning up at Oregon State!"
Comments (none posted)
LinuxMedNews
looks at the PHIELD project.
"
The PHIELD project implemented a first generation solution by developing an end-to-end model comprised of Open Source software and documentation for filtering and reporting from a local LIS to the National Electronic Disease Surveillance System (NEDSS) implementation in Nebraska utilizing the Public Health Information Network (PHIN) architected by the Centers for Disease Control and Prevention (CDC)."
Comments (none posted)
The Sydney Morning Herald
covers
the election of Jonathan Oxer as President of
Linux Australia. "
Also voted in
during the elections which concluded on January 15 were Pia Smith
(vice-president), Anthony Towns (secretary), Mark Tearle (treasurer),
Andrew Cowie, Geoffrey Bennett, and Stewart Smith (ordinary committee
members)."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
As a way of demonstrating the cost of overly restrictive intellectual
property laws, the EFF has put up
an Endangered Gizmos List listing
the gadgets which could become illegal - and a few which are already
extinct.
Comments (1 posted)
MozillaZine
reports that Mitchell Baker will return to Mozilla.
"
Mitch Kapor, Chair of the Mozilla Foundation and President and Chair of the Open Source Applications Foundation, has announced that Mozilla Foundation President Mitchell Baker will return to working on the Mozilla project full time. She will continue to be an employee of OSAF and will retain her seat on OSAF's board."
Comments (none posted)
Commercial announcements
Black Duck Software has announced that it has joined the Open Source
Development Labs (OSDL). "
Black Duck Software helps businesses
expand their use of open source software by providing products and services
for understanding and safely managing software licensing compliance. The
company's protexIPT system brings developers, lawyers, and business
decision-makers together and enables enterprises to take advantage of the
dramatic cost, quality, and time-to-market benefits that open source
provides."
Full Story (comments: 1)
OSDL CEO Stuart Cohen was joined by Governor Kulongoski of Oregon and
others at a press conference to unveil the Open Technology Business
Center. "
The Open Technology Business Center, created with $1.2
Million from the city of Beaverton, is a first-of-its-kind facility
dedicated to supporting the formation, funding and growth of new companies
in the Open Technology sector. Programs include an Open Technology
executive institute for advisors, educators, consultants and investors.
Participating entrepreneurs will have unique access to industry thought
leaders and domain experts. Qualified early-stage companies may locate in
the center's facility through its "ventures-in-residence" program."
Full Story (comments: none)
Hewlett-Packard, IBM, Intel and Sun Microsystems have
announced
the formation of the Globus Consortium, a new industry group dedicated to
the commercial advancement of the Globus Toolkit.
Comments (3 posted)
LinuxGenius, LLC has
announced the release of LinuxCBT SUSE Enterprise Edition.
"
LinuxCBT SUSE Enterprise is LinuxGenius'
ninth comprehensive computer based training course focusing on Linux-based
open-source tools and applications. LinuxCBT SUSE Enterprise contains 75 hours
of comprehensive, in depth training that focuses entirely on SUSE Enterprise
Linux 9 and SUSE Professional 9.2 with Windows 2003, Red Hat Linux, and Cisco
PIX Firewall integration."
Comments (none posted)
LPI has announced that Linux Magazine is now a platinum sponsor.
"
This increase in Linux Magazine's sponsorship commitment offers further
recognition of LPI´s position within the Linux and Open Source
community. It demonstrates the value of partnerships, and the important
role we all have to play in promoting professional standards to further
the cause of open source software."
Full Story (comments: none)
The OpenIB Alliance has
announced the acceptance of its Linux Software Stack by kernel.org.
"
The OpenIB Alliance,
an industry association founded to develop an open software stack for
InfiniBand architecture on Linux, today announced the software stack
was accepted by the Linux kernel community into the kernel.org
repository. This will enable a single InfiniBand open source software
environment for Linux customers who require a robust, resilient and
manageable infrastructure for data center, grid and high performance
computing."
An OpenIB Developers Workshop on February 6-9 2005 has also been
announced. The event will take place in Sonoma, CA.
Comments (none posted)
Sun has put out two press releases on its "Open Solaris" plans.
This one
states that Solaris 10 will be made available under Sun's CDDL
license; it should be available in the second quarter of 2005. Sun has
also
released
1600 patents to CDDL licensees. It is not clear from the PR whether
the patents will be available for use outside of the Solaris code base.
More information and downloads will be available at
opensolaris.org.
Comments (11 posted)
VA Linux Systems Japan K.K. has announced x86-64 for its Mini Kernel Dump
utility.
Full Story (comments: none)
Zend Technologies, Inc. has
announced it has received strategic investments from both Intel Capital
and SAP Ventures, a division of SAP AG. Zend will work with both companies
to continue the momentum of open source and PHP solutions for
business-critical web applications in enterprise environments. Terms of the
investments were not disclosed.
Comments (none posted)
New Books
O'Reilly has published the book
Google Hacks, Second Edition
by Tara Calishain and Rael Dornfest.
Full Story (comments: none)
O'Reilly has published the book
QuickTime for Java: A Developer's Notebook by Chris Adamson.
Full Story (comments: 1)
Syngress has published the book
Google Hacking for Penetration Testers by Johnny Long.
Full Story (comments: none)
Resources
The Linux Professional Institute's November/December 2004 Newsletter
is online with the latest LPI news.
Full Story (comments: none)
The Samba site
mentions
a sociological study that looks at the Samba development community.
"
Nico Earnshaw has completed a thesis on the Samba community as part of his Bachelor of Arts Informatics degree at the University of Sydney. The work is a very fine study of the practices of members of the community, with particular attention paid to Samba Team developers (their motivations, goals, practices, etc.). The general question explored seems to be, how does being a part of the Samba community define a developer?"
The paper is available
here (pdf).
Comments (none posted)
Contests and Awards
KDE.News has
announced the winners of the
KDE SVG Wallpaper contest.
"
It was not an easy task as
there was so much incredible artwork. The judges sorted through all 86
entries and choose the top four and the winners are..."
Comments (none posted)
A vote is being held for the OpenOffice.org version 2.0 Splashscreen.
"
Please help us choose a new splash screen for the upcoming
OpenOffice.org 2.0 release. This image will be seen by tens of millions
of users around the world every time they start OpenOffice.org.
Voting is now open for community members."
Full Story (comments: none)
Upcoming Events
Use Perl has a
call for proposals for the 2005 OSCON.
"
Bjørn Hansen writes "OSCON is headed back to friendly, economical Portland, Oregon during the week of August 1-5, 2005. If you've ever wanted to join the OSCON speaker firmament, now's your chance to submit a proposal (or two) by February 13, 2005.""
Comments (none posted)
OSBC, LLC has announced the second annual Open Source Business
Conference(TM) (OSBC), the premier event for open source software and
business, will be held April 5 and 6 at the Westin St. Francis in San
Francisco with featured keynote speakers from IBM, OSDL, SpikeSource, Sun
Microsystems, VA Software, and authors Geoffrey Moore and Lawrence Lessig.
Full Story (comments: none)
Daniel G. Wolf will be the keynote speaker for the
First Security-Enhanced Linux Symposium, the event will be held on
March 2-4, 2005 in Silver Spring, Md.
Full Story (comments: none)
Al Brisard of PingTel has joined the Southern California Linux Expo
panel discussion on the future of VoIP and Open Source. The expo
will be held on February 12-13, 2005 at the Los Angeles Convention Center.
Full Story (comments: none)
A
call for papers has gone out for YAPC::NA 2005.
"
The dates of the conference are Monday - Wednesday 27-29 June 2005. The location will be in downtown Toronto, Ontario, Canada. (Note that a different date block was previously announced, but has been moved to accomodate venue availability.)
The close of the call-for-papers is April 18, 2005 at 11:59 pm."
Comments (none posted)
Use Perl has posted
an update for the 7th German Perl Workshop.
"
JStenzel writes "The schedule of the 7th German Perl Workshop, together with
the abstracts, is now online. A registration form is provided on the same
page. The Workshop will be held in Dresden from 9th to 11th February 2005.
Both German and English talks will be presented in the typical workshop
atmosphere which inspired me as often as I took part.""
Comments (none posted)
IDG World Expo has
announced a number of press conferences by various IT companies.
"
IDG World Expo, the leading producer of world-class tradeshows, conferences and events for technology markets, today announced the press conference schedule at LinuxWorld Conference & Expo(R) Boston on February 14-17, 2005 at the Hynes Convention Center. Many of the world's leading IT companies including HP, IBM, Novell, Red Hat and Veritas, will be announcing new products and upgrades for Linux enterprise users at the event."
Comments (none posted)
| Date | Event | Location |
| January 28 - February 4, 2005 | Asia
Source | (Visthar training venue)Bangalore, India |
| January 31 - February 2, 2005 | OSDL
Enterprise Linux Summit | (Hyatt Hotel)Burlingame,
California |
| February 2 - 3, 2005 | Solutions
Linux 2004 | (CNIT, Paris la Défense)Paris, France |
| February 4 - 6, 2005 | ShmooCon
2005 | (Wardman Park Marriott Hotel)Washington, DC |
| February 7 - 11, 2005 | GlobusWORLD | (Sheraton Boston Hotel)Boston,
MA |
| February 9 - 11, 2005 | German
Perl-Workshop 2005 | Dresden, Germany |
| February 9 - 11, 2005 | Third-Annual
Desktop Linux Summit | (Del Mar Fairgrounds)San Diego, CA |
| February 9, 2005 | OOo
RegiCon North America | (Del Mar Fairgrounds)San Diego,
CA |
| February 11 - 13, 2005 | CodeCon
2005 | San Francisco, CA |
| February 12 - 13, 2005 | Southern California
Linux Expo 2005(SCALE) | (Los Angeles Convention Center)Los Angeles,
CA |
| February 14 - 17, 2005 | Linux World
Conference and Expo | (Hynes Convention Center)Boston, MA |
| February 18, 2005 | Fedora Users and
Developers Conference(FUDcon1) | (Massachusetts Institute of Technology)Boston,
Massachusetts |
| February 24 - 25, 2005 | UKUUG
LISA/Winter Conference | Birmingham, UK |
| February 25, 2005 | Dutch Perl
Workshop | Amsterdam, the Netherlands |
| February 26 - 27, 2005 | Free and Open Source
Developers' European Meeting(FOSDEM 2005) | Brussels,
Belgium |
| February 28 - March 3, 2005 | EclipseCon 2005 | (Hyatt
Regency)Burlingame, CA |
| February 28 - March 1, 2005 | Asia
Debian Mini-Conf 2005 | Beijing, China |
| March 1 - 2, 2005 | JBoss World 2005 User
Conference | (Omni/CNN Center)Atlanta, GA |
| March 2 - 4, 2005 | Security-Enhanced
Linux Symposium | Silver Spring, Maryland |
| March 2 - 3, 2005 | Asia
CodeFest 2005 | Beijing, China |
| March 2 - 4, 2005 | The 5th Asia Open Source
Software Symposium | Beijing, China |
| March 2 - 4, 2005 | The Free and
Open Source Software Workshop | (Al Assad National Library)Damascus,
Syria |
| March 12, 2005 | Gentoo UK
2005 | (University of Salford)Manchester, UK |
| March 12, 2005 | Third Hungarian PHP
Conference | Budapest, Hungary |
| March 14 - 17, 2005 | Emerging
Technology Conference(ETech) | (Westin Horton Plaza)San Diego,
CA |
| March 21 - 24, 2005 | Bellua Cyber Security
Asia 2005 | (Hotel Borobudur)Jakarta, Indonesia |
| March 21 - 24, 2005 | Open
Source Modeling and IDEs Workshop | (Caribe Royale All Suites Resort & Convention
Center)Orlando, FL |
| March 23 - 25, 2005 | PyCon DC
2005 | (GWU Cafritz Conference Center)Washington, DC |
Comments (1 posted)
Web sites
A Hungarian translation of MozillaZine
has been announced.
"
This
brings the total number of localised MozillaZine versions to six."
Comments (none posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| David Heath <david.heath-AT-oneworld.net> |
| To: |
| lwn-AT-lwn.net |
| Subject: |
| Reading LWN on a Palm pilot |
| Date: |
| Thu, 20 Jan 2005 14:02:32 +0000 |
hi,
I thought you (and other LWN readers) might find the attached script
useful. I use it in combination with 'plucker' (http://www.plkr.org/ I
have v1.4) to fetch and download LWN onto my palm pilot. It's very much
a hack but it does work reliably (albeit without much finesse).
When run it will fetch the LWN home page, determine the URL of the
latest LWN edition (ie. this week's) and start fetching the pages from
that edition in 'printable format'. It relies on the cookie database
from galeon to get past authentication for reading the latest week's
news. It prob will work with other browsers just by changing the path of
the cookie file in the script.
Usage:
$ get-lwn.sh
...
$ gpilot-install-file /home/heathd/.plucker/lwn_20050120.pdb.pdb
gpilotd-Message: Activating object OAFIID:GNOME_Pilot_Daemon
fileconduit-Message: palmVx completed 641915326
Dave
PS. I'm just off to the café to read this week's LWN on my PalmV.
--
David Heath
Web Application Developer
OneWorld International, 2nd Floor, River House
143-145 Farringdon Road, London, EC1R 3AB, UK
E: david.heath@oneworld.net
W: http://www.oneworld.net/
T: +44 20 7239 1424
F: +44 20 7833 8347
#!/bin/sh
# gets this weeks list of pages
export DATESTAMP=`date +%Y%m%d`
export OUTPUTDIR=~/Documents/plucker/lwn
export ABSOUTDIR=$OUTPUTDIR/$DATESTAMP
mkdir -p $ABSOUTDIR
cd $ABSOUTDIR
wget --load-cookies /home/heathd/.galeon/mozilla/galeon/cookies.txt -O /dev/stdout -o /dev/null
http://lwn.net/current/ | grep -A 17 'LWN Weekly Edition' | grep '<a href=.*Articles\/[0-9]*\/"' |
sed -r 's/^.*(\/Articles\/)([0-9]+)\/.*$/wget \-\-load\-cookies
\/home\/heathd\/.galeon\/mozilla\/galeon\/cookies.txt \-O \2.html
http:\/\/lwn.net\1\2\/?format=printable/' > lwn-get-list.sh
sh lwn-get-list.sh
ls -1 *.html | sed -r 's/^(.*)$/<a href="\1" >\1<\/a><br \/>/' > index.html
ls -1 *.html | sed -r "s/^(.*)$/<a href='$DATESTAMP\/\1' >\1<\/a><br \/>/" >
../index.html
rm -f lwn-get-list.sh
plucker-build --doc-name "lwn $DATESTAMP" --doc-file=lwn_$DATESTAMP.pdb
--home-url=///home/heathd/Documents/plucker/lwn/$DATESTAMP/index.html
--maxdepth=2
Comments (1 posted)
Page editor: Jonathan Corbet