LWN.net Weekly Edition for May 5, 2005

KOffice heads toward 1.4

The first beta of the KOffice 1.4 release was announced on April 29, so we thought we'd take a look at this release and see how KOffice was shaping up. How does KOffice 1.4 stack up against the competition, namely OpenOffice.org and standalone applications like Gnumeric, Abiword and the Gimp?

Since the release is still in beta, we were checking for features compared to the other suites, but ignored any stability issues. To try out KOffice we downloaded the "Klax" live CD. There are also binary packages and source code. We also compiled KOffice beta1 on Ubuntu "Hoary" with no problems.

Since support for the Open Document Format is one of the big features in KOffice 1.4, we decided to test that out first. Unfortunately, we didn't have much luck. We started by opening a document in OOWriter (from one of the OpenOffice.org 2 preview releases from Ubuntu's package repository) and then saving it in the Open Document Format. KWord refused to open the document, complaining about the paper size. When we tried opening a document from KWord, saved in the Open Document Format, it also failed. KWord had no trouble opening other file types, including Microsoft Word, which is more likely to be found in the wild at the moment anyway.

Next we tried out KSpread and KPresenter using some PowerPoint documents we found online using Google and the Gnumeric testing spreadsheets. Unfortunately, KSpread and KPresenter are a bit less capable than OpenOffice.org or Gnumeric when it comes to handling these documents. The test spreadsheets showed that KSpread doesn't implement many of the functions that are available in Gnumeric and OpenOffice.org Calc. KPresenter had trouble with the Microsoft PowerPoint document, only displaying the text for the slide show and badly mangling the text formatting.

KWord, KSpread and KPresenter are fine for creating original documents, but users may wish to look to OpenOffice.org or Gnumeric and AbiWord for exchanging documents with users of Microsoft Office or OpenOffice.org.

We did like Kivio, the KOffice diagram and flowchart program. It comes with a hefty selection of stencils, and the interface is clean and easy to use. The beta is a bit unstable, but we expect that problem will be taken care of before the final release.

Two applications that make their debut with the 1.4 release are Krita and Kexi. Krita is an image editing application, and Kexi is a database management application. Krita looks promising, though it doesn't seem quite as full-featured as The Gimp just yet. It offers a much different interface than the Gimp and is a bit crowded at first, making it a bit difficult to work on larger images. Krita does allow the user to open new windows with the same image, but this is also a bit less than optimal.

Kexi could be the Access-like application that many Linux users are looking for. It's a bit rough around the edges at the moment, but it could be the answer for many Linux users who want to create simple databases that do not require MySQL or PostgreSQL backend.

KOffice also includes KChart, Karbon14, KFormula and Kugar. Kugar is an application for generating "business quality reports." KChart is, as the name suggests, an application for generating charts. It can be used as a standalone application or within KSpread. It offers a fairly extensive variety of chart types, including bar charts, polar charts, and "ring" charts. Karbon14 is a Illustrator-like application. We didn't get time to test it extensively.

Users who are interested in test-driving KOffice should check out the "Klax" live CD -- it's a relatively small download and offers the full range of KOffice apps and the KDE 3.4 desktop. The final KOffice 1.4 release is slated for June.

In all, it looks like the KOffice 1.4 release will be a significant move forward for KOffice. In some ways, several of the KOffice components are still a way behind the other free office applications in terms of document format support and features, but the suite does provide a usable alternative for Linux users who don't require extensive Microsoft Office compatibility.

Comments (7 posted)

Where community and commerce meet

Free software development projects and for-profit companies can often interact in ways which are rewarding for both. The interaction between the two is not always entirely smooth, however, and occasional frictions can emerge. Resolving these issues as they come up can yield insights about how the free software community operates, and how it interacts with the commercial world.

As an example, consider this note posted by Bruce Momjian to a couple of PostgreSQL mailing lists. Interesting things are happening with free database management systems, and various companies are beginning to take note. Bruce welcomes commercial attention, but worries about some problems which could result if things are not handled carefully.

The main issue would appear to be companies working on features for PostgreSQL without first discussing their proposed changes with the community. These companies risk finding that they have duplicated another company's work; merging overlapping patches then puts a stress on both companies - and on the community. Companies which keep their patches until a late stage may also find that the community is unwilling to merge the finished product for any of a number of reasons.

This kind of problem can usually be dealt with relatively easily if it is caught in an early stage. By the time a large amount of effort has been expended, changing the direction of a project can be a harder task. For this reason, many development communities would like to see proposed additions as early in the process as possible. This desire often clashes with a company's goals: the company knows what sort of patch it wants to produce, and corporate management is often afraid to release code which has not been polished, run through a quality assurance process, and cleared by the lawyers. Releasing early-stage code with missing features and known problems so that the community can redirect the development process is just not the pointy-haired way of doing things.

When a company owns a given free software project (think MySQL, OpenOffice.org, or JBoss), there is usually a certain level of predictability in its development process. The controlling company has its agenda, and will accept or reject patches based on whether the patches further that agenda. Many or most of the major developments are centrally planned from the outset. If another company wishes to encourage development in a certain direction, managers from both sides can get together and work a deal. Managers tend to like to work that way.

A more community-driven project can be harder for companies to engage with. Promises to merge a given feature are hard to obtain and even harder to enforce. The whole process can seem whimsical and hostile to corporate five-year plans. But this is also the process which, at its best, produces high-quality code which is maintainable over the long term. Companies can learn to work with - and appreciate - the community development process, but there is a learning process involved. It all tends to work out with successful projects, but each project seems to have to find its own way to work with the commercial world.

The other problem mentioned by Mr. Momjian is that companies are hiring PostgreSQL developers to work on closed-source extensions. This is OK in general: PostgreSQL carries a BSD license, and it is hard to argue with jobs for PostgreSQL hackers. But the project needs developers to survive; companies which hire those developers and prevent them from working on the core system risk killing their golden goose. Bruce asks that such companies at least allow their developers to spend some of their time working on the free PostgreSQL core.

The interface between corporations and free software development projects has its share of traps and potential problems, just like any other relationship. Given time and sufficient will, these problems can be worked out. It is worth the trouble: each side has a lot which it can offer to the other.

Comments (4 posted)

Software, reverse engineering and the law

Reading about proprietary software law is sometimes a shock, when you are used to the freedoms of the free software community, because your natural response to hearing how the law works outside the community is to say: "But that's awful. That can't be the law." And frankly there is nothing that advertises the benefits of free licenses as clearly as a brief rundown on what you can't do outside that realm of freedom. But with the recent flap about BitKeeper, it might be good to review what the current state of the law is on reverse engineering.

Unfortunately, if we define reverse engineering as "trying to figure out how something works," then the state of the law is that there are places on Planet Earth where there are laws restricting what you are allowed to do. The center of that restrictive universe right now is the US. Cem Kaner, Professor of Software Engineering and Director, Center for Software Testing Education & Research at the Florida Institute of Technology, believes that restrictions on reverse engineering are holding American programmers back from being able to compete:

Let's take a look at what you can and can't do around the world, when you wish to reverse engineer proprietary software. We can view it as we would learning about a repressive government's laws about dress code or some other issue you don't normally worry about, but need to study and obey for travel there, so you don't end up in the clink, so to speak, for wearing shorts or sandals or whatever else they have in their beanie as being worth making a law about.

I polled attorneys and engineers in the US, the UK, and Australia, and I've collected some resources as well, and I've found that there is a good deal of flux and some confusion in this area of law. I am not a lawyer, as you know, so if you need to know how the law applies in a particular situation in your area, please get advice from an attorney.

Why Do People Reverse Engineer Anyway?

People have many reasons why they might wish to reverse engineer software, but two important ones are 1) to make software that can interoperate with the software being studied and 2) to make a product that will compete with it. Why might the the knowledge not be visible? Dan Shearer, Samba Team and open source virtualization specialist, provides some possible reasons:

• The original programmer is dead, or the company has died, or otherwise events have buried the explanation for how a technology works from the engineer and perhaps everyone else;

• Commercial protection. A company feels its commercial goals would be compromised if the knowledge was published, so it keeps the knowledge secret (and often tries to obscure the knowledge so it is difficult for anyone to find it.)

• Encumbrance on the knowledge. The knowledge might be published, but under such terms as anyone who agrees to the conditions under which the publication is made is limited in what he can do with it. Example: Microsoft's approach to detailed API sharing (Kerberos etc etc.) So the reverse engineer may choose not to see the knowledge. A basic encumbrance is sometimes cost for access to the documentation.

Having said that, the problem with seeking to know whether you can do reverse engineering or not is that it isn't consistent around the world, so your answer depends on where you do it and why.

A Brief US History of the Law on Reverse Engineering

Reverse engineering of manufactured products was originally designed, in US law, as a kind of balancing limit on trade secret protection, to ensure that a company couldn't gain, through that back door, a perpetual, unlimited monopoly on unpatented inventions. With manufactured products, the system worked well. As long as you bought the product legally, you were free to take it apart and see how it ticked. Most of us did that to clocks, radios and various other appliances when we were kids. We were free to do that because trade secret law didn't grant the owner the exclusive right to possess the secret. It only protected the owner against improper acquisition and/or disclosure of the trade secret.

That means that if I broke into your factory and stole your product and then reverse engineered it to figure out how you did it, it wasn't all right, but if I bought your product, it was perfectly legal, and you couldn't prevent me from discovering your secret, if I was willing to put in the time and effort to reverse engineer to obtain it. Reverse engineering was a lawful way to obtain a trade secret. And the time and effort involved was considered enough of a barrier that it gave the owner of the trade secret a measure of protection, by giving him a running start ahead of any copycats.

In fact, reverse engineering was considered to be a good thing, and in the 1989 U.S. Supreme Court decision, Bonito Boats, Inc. v. Thunder Craft Boats, Inc., the court said that reverse engineering was "an essential part of innovation," because it could lead to advances in technology. If you remember the DVD Copy Control Association v. Andrew Bunner case in California, it was a trade secrets case that held that reverse engineering is presumptively legal.

Both white box reverse engineering (decompiling the object code to reveal its structure and figure out the interface specifications for interoperability purposes) and black box reverse engineering (where you only look at a program's input and outputs) are legal normally in the US, if the goal is interoperability. I say normally because fair use is decided case by case. Bypassing anticircumvention devices, however, is a separate no no. Section 1201 of the DMCA forbids reverse engineering if it involves circumvention of a technological protection measure, with limited exceptions, such as for encryption research and security testing. You could probably get away with reverse engineering to fix something, and, while security testing is explicitly allowed under the DMCA, this exception is unclear enough that some have become afraid to avail themselves of it. Fred Von Lohmann of the EFF has described Section 1201 like this: "thou shalt not circumvent" and "do not break into my castle and do not violate my house rules -- seen from the perspective of a copyright holder".

Why Software is Different from a Cotton Gin

There are differences between reverse engineering a mechanical device, like a cotton gin, and reverse engineering software. Shearer says this about the difference:

Because computer software can be protected not only by trade secret law but by copyright and patent law as well, the issue of when you can and when you can't reverse engineer gets complex. If I invented the cotton gin, I could patent it for a time, gaining a monopoly for a time with the tradeoff that I must reveal all my secrets, or I could protect how I did it as a trade secret, and I couldn't use patents to protect the product at all. So my cotton gin invention got one form of protection, tops.

With software, you can get at least two bites of the apple simultaneously. Software is automatically copyrighted, and it can be patented too. And you can opt for trade secret protection instead of patents. Then you can slap a restrictive license on top, if the market will let you get away with it. And that is part of what makes it so complicated to figure out when you can and when you can't reverse engineer. It's also why some view software patents as overkill. Kaner on recent US decisions that reverse engineering is not fair use:

The fact that software can be protected so many ways also means you can be sued on all of them - trade secret, copyright, patent and contract law theories - if you were unfortunate enough to have signed away your rights to reverse engineer (or to tell what you learned from doing so). Software licenses that forbid reverse engineering may or may not stand up to a challenge, but most folks think that they will. At any rate, there was a case where a federal court of appeals said that such a provision is enforceable and does not conflict with the Copyright Act, and the Supreme Court declined to review the decision, and they would have, if they had seriously disagreed. So be careful what you agree to.

Software is therefore a separate issue when it comes to reverse engineering. The time and effort involved isn't equivalent to reverse engineering a cotton gin, particularly with computers automating some of the heavy lifting.

When Can You Reverse Engineer? -- It Depends

Copyright protects the expression of an idea, but not the idea itself. That is why you can do reverse engineering to figure out how software works and then write your own program to do the same thing. The problem that arises with copyright and reverse engineering is well expressed in this explanation of how to avoid a copyright infringement claim:

Patents protect the implementation of the idea, and that makes it the bully on the block, particularly in software, where there may be limited optimal ways to accomplish something. There is no fair use or reverse engineering exemption with patents. So you can argue all you want about how you had a fair use right to reverse engineer under copyright law, but if the part of the software you reverse engineered was also patented, you are, with some limited exceptions, sunk.

And how do you know in advance if you are going to end up violating a patent? Don't ask me. Nobody seems to know how to avoid violating someone's software patent under the current US system. You seem to find out mainly when someone sues you. Many observers believe the US patent system is broken and needs to be reformed, at a minimum, so that honest people can figure out how to avoid infringement. Meanwhile, ask your lawyer.

But just know that there is no reverse engineering right per se with patented inventions to find out how they work. It was originally the case that with patents you were supposed to reveal the tricks you used. It was the tradeoff. Sadly, software patents are now granted in the US without applicants having to reveal all the inner workings, so some legal commentators have argued that reverse engineering doesn't infringe under the first sale principle of patent law, or if you do it to satisfy your scientific curiosity, that you could assert an experimental use defense. And note that while under copyright law interfaces are not protected, they can be under patent law.

Whether or not reverse engineering is legal also depends, I've learned, on where you do it and why. Note that what matters is where the reverse engineering was done, not where the software was written. If you are in the US and you are doing it for interoperability purposes, as opposed to for the purpose of creating a similar and competitive product, you are probably safe from a copyright infringement claim, but may run afoul of a patent. (But in any particular situation, hire a lawyer to advise you.)

What About Outside the US?

The US is easy to figure out, compared to, say, Japan. At least in the US, they put it in writing. In Japan, it's assumed that reverse engineering for interoperability purposes is probably legal, but the law doesn't come right out and say so. In Japan, the law has no "fair use" concept for computer software, so reverse engineering is technically copyright infringement. Yet, as noted, most legal scholars say that reverse engineering is probably legal in Japan in a practical sense, even though their copyright law doesn't explicitly say that. Note that Japan does accept software patents.

Here's a PDF that tells you what you can use reverse engineering to accomplish in Australia, and as you can see, it's essentially similar to the US:

I asked Brendan Scott, of Open Source Law, an expert on tech law there, if it would be accurate to say that you can do more in Australia than in the US, or if their new law is as restrictive; here is his answer:

The anti-circumvention language in the FTA looks likely to keep lawyers employed for some time:

In the European Union, reverse engineering is allowed under Article 6 of the European Software Directive, for interoperability purposes only, not for creating a competing program, and the law strictly limits what you can do with the knowledge you gain. You can't publish it, for example. As you know, the patent situation in the EU is a bit messy at the moment. Software patents are supposedly not allowed, after the Munich Convention, but folks have found ways, and that effort continues. Should the directive pass as presently written, it is expected to make reverse engineering of any patented materials illegal, except for limited exceptions. The directive also states that the ideas and principles underlying a program are not protected by copyright, and that logic, algorithms and programming languages may to some extent comprise ideas and principles.

There are some differences between US and UK law, and here's a paragraph from the UK Patent Office website on what constitutes a copy of a computer program in the UK:

There is no provision for decompilation (white-box reverse engineering) in UK copyright law, and no fair use defense if the reverse engineering is for commercial research or study. And, there is no right to breach confidentiality agreements. In Stac Electronics v. Microsoft Corp., Stac was found to have committed a trade secret violation by reverse engineering a beta version of MS DOS that they had gotten in confidence and then using the information they gained in making their own product. However, in the UK, the EU copyright directive trumps any contractual agreement that it contradicts, so decompilation carried out for the purpose of interoperability is allowed, under that umbrella, as long as you don't reveal any confidential data.

There is also a provision (50BA) made for "observing, studying and testing of computer programs":

So, there is no fair use (or fair dealing, UK's much stricter escape hatch) for decompliation or copying during decompilation. However, sniffing (black-box reverse engineering) for interoperability purposes is allowed.

Note that the UK began to revise its patent law in January of 2005.

Summing Up

Kaner points out that there is research going on to make reverse engineering technically impossible:

Shearer brings up an interesting point:

The general trend in the law is to harmonize laws around the world, so they are interoperable, so to speak, to reach an international working consensus on what the laws on copyright and patents ought to be. It's obvious why that would bring benefits. Legislators can see that clearly. Unfortunately, not everyone in the world as readily sees the real benefits that come from interoperability in software.

Everyone sees the benefits of having train tracks be uniform, so you can get on a train in New York and arrive in California safely, and without having to get off and then on another train for another width of tracks. It's no different with software. And as software becomes more and more obviously the underpinning of a globalized society, including its commerce, hopefully more and more legislation will reflect that awareness.

In the meantime, please be careful. That includes using this article only as a jumping off point, and asking your attorney for advice for any real-world application of the law in your area of the world.

Additional resources

Please see this page for a set of pointers to additional reading in international copyright law and reverse engineering.

Comments (25 posted)

Page editor: Jonathan Corbet

Security

Umbrella 0.7

This week the Umbrella team released version 0.7 of Umbrella, a "security mechanism" that implements Process-Based Access Control (PBAC) and authentication of signed binaries for Linux. Since Umbrella 0.7 is the first feature complete release, we thought now might be a good time to take a look at the project. Kristian Sørensen, one of the Umbrella Team members, was kind enough to respond to our questions about Umbrella.

While Umbrella sounds a bit like Security-Enhanced Linux or other on the surface, Sørensen pointed out that Umbrella is designed for consumer devices rather than general-purpose servers or other systems, though it might be useful for "specific server environments." Sørensen provided this explanation of Umbrella:

Umbrella requires a 2.6.9 kernel (or later) and includes a kernel patch, the Umbrella library and a user-space program. Binaries that will be restricted by Umbrella need to be signed using Bsign and GnuPG. Umbrella and DigSig are the only projects this author is aware of that check digital signatures of binaries. The policy for the application is stored in the binary itself.

Since Umbrella can be used to restrict binaries unless they are signed by an authority, we asked Sørensen if Umbrella was similar to so-called "trusted computing" efforts. Sørensen confirmed that Umbrella was "related to 'trusted computing'."

While it's desirable to prevent attacks on consumer electronics devices, we asked if Umbrella could also be used to prevent users from "hacking" devices to expand the capabilities of a device -- something that may not be desirable from the end-user's point of view. Sørensen acknowledged that a device could be designed so that it would be "very difficult" for a user to "tamper with the software of the device."

What about performance? Sørensen said that the team had just finished benchmarking Umbrella, and found that it had "between 2.5% and 4.5% overhead, depending on how the system is stressed. Thus, having Umbrella in the kernel is not noticeable."

According to Sørensen, the Umbrella project started as a master's project, but he has plans to start a company in the fall, based on the Umbrella technology, called Linnovative.

It should be interesting to see how Umbrella develops and whether this approach catches on. It is simpler than SELinux, but doesn't look suitable for use in general systems at this time -- which is a shame, as it would be nice to have a simpler system that's usable for general purpose server and desktop systems. However, Umbrella may be another tool that helps Linux gain acceptance in the embedded and consumer electronics market.

Comments (2 posted)

New vulnerabilities

ethereal: buffer overflow

Package(s):	ethereal	CVE #(s):	CAN-2005-0739
Created:	April 28, 2005	Updated:	May 4, 2005
Description:	The IAPP dissector of Ethereal is vulnerable to a buffer overflow. A remote attacker may be able to create a special network packet in order to take advantage of the problem.
Alerts:	Debian DSA-718-2 2005-04-28 Debian DSA-718-1 2005-04-28

Comments (none posted)

gzip: race condition and directory traversal

Package(s):	gzip	CVE #(s):	CAN-2005-0988 CAN-2005-1228
Created:	May 4, 2005	Updated:	July 13, 2005
Description:	gzip suffers from a race condition which could allow a fast-fingered attacker to change the permissions on files owned by others. There is also a directory traversal vulnerability associated with the -N option.
Alerts:	Debian DSA-752-1 2005-07-11 Red Hat RHSA-2005:357-01 2005-06-13 OpenPKG OpenPKG-SA-2005.010 2005-06-10 OpenPKG OpenPKG-SA-2005.009 2005-06-10 Mandriva MDKSA-2005:092 2005-05-18 Gentoo 200505-05 2005-05-09 Trustix TSLSA-2005-0018 2005-05-06 Ubuntu USN-116-1 2005-05-04

Comments (none posted)

Horde Framework: multiple XSS vulnerabilities

Package(s):	horde	CVE #(s):
Created:	May 2, 2005	Updated:	May 3, 2005
Description:	Cross-site scripting vulnerabilities have been discovered in various modules of the Horde Framework.
Alerts:	Gentoo 200505-01 2005-05-01

Comments (none posted)

ImageMagick: heap corruption

Package(s):	ImageMagick	CVE #(s):	CAN-2005-1275
Created:	April 28, 2005	Updated:	May 25, 2005
Description:	ImageMagick 6.2.1 and earlier has a heap corruption problem in the pnm coder.
Alerts:	Red Hat RHSA-2005:413-01 2005-05-25 Ubuntu USN-132-1 2005-05-23 Gentoo 200505-16 2005-05-21 Fedora FEDORA-2005-344 2005-04-27

Comments (1 posted)

infozip: privilege escalation, directory-traversal

Package(s):	infozip	CVE #(s):	CAN-2003-0282 CAN-2004-1010 CAN-2005-0602
Created:	May 2, 2005	Updated:	August 1, 2005
Description:	InfoZip reports that Zip 2.3 and (presumably) all previous versions have a buffer-overrun vulnerability relating to deep directory paths that could potentially lead to local privilege escalation (e.g., in the case of automated, Zip-based backups). All versions of UnZip through 5.50 have a number of directory-traversal vulnerabilities.
Alerts:	Ubuntu USN-159-1 2005-08-01 Slackware SSA:2005-121-01 2005-05-02

Comments (1 posted)

libnet-ssleay-perl: weakened cryptographic operations

Package(s):	libnet-ssleay-perl	CVE #(s):	CAN-2005-0106
Created:	May 3, 2005	Updated:	January 27, 2006
Description:	Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGD_PATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with known content.
Alerts:	Mandriva MDKSA-2006:023 2006-01-26 Ubuntu USN-113-1 2005-05-03

Comments (none posted)

phpMyAdmin: insecure SQL script installation

Package(s):	phpMyAdmin	CVE #(s):
Created:	May 2, 2005	Updated:	May 3, 2005
Description:	The phpMyAdmin installation process leaves the SQL install script with insecure permissions. A local attacker could exploit this vulnerability to obtain the initial phpMyAdmin password and from there obtain information about databases accessible by phpMyAdmin.
Alerts:	Gentoo 200504-30 2005-04-30

Comments (none posted)

postgresql: database initialization errors

Package(s):	postgresql	CVE #(s):	CAN-2005-1409 CAN-2005-1410
Created:	May 4, 2005	Updated:	February 28, 2006
Description:	PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
Alerts:	Fedora-Legacy FLSA:157366 2006-02-27 Mandriva MDKSA-2005:093 2005-05-26 Red Hat RHSA-2005:433-01 2005-06-01 Gentoo 200505-12 2005-05-15 Fedora FEDORA-2005-368 2005-05-10 Ubuntu USN-118-1 2005-05-04

Comments (none posted)

Pound: buffer overflow

Package(s):	pound	CVE #(s):	CVE-2005-1391
Created:	May 2, 2005	Updated:	January 10, 2006
Description:	Steven Van Acker has discovered a buffer overflow vulnerability in the "add_port()" function in Pound 1.8.2+. A remote attacker could send a request for an overly long hostname parameter, which could lead to the remote execution of arbitrary code with the rights of the Pound daemon process.
Alerts:	Gentoo 200504-29 2005-04-30

Comments (none posted)

prozilla: format string vulnerabilities

Package(s):	prozilla	CVE #(s):	CAN-2005-0523
Created:	May 4, 2005	Updated:	May 4, 2005
Description:	Several format string vulnerabilities have been found in prozilla; an exploit requires a malicious server.
Alerts:	Debian DSA-719-1 2005-04-28

Comments (none posted)

smartlist: wrong input processing

Package(s):	smartlist	CVE #(s):	CAN-2005-0157
Created:	May 3, 2005	Updated:	May 3, 2005
Description:	Jeroen van Wolffelaar noticed that the confirm add-on of SmartList, the listmanager used on lists.debian.org, which is used on that host as well, could be tricked to subscribe arbitrary addresses to the lists.
Alerts:	Debian DSA-720-1 2005-05-03

Comments (none posted)

tcpdump: multiple DoS issues

Package(s):	tcpdump	CVE #(s):	CAN-2005-1280 CAN-2005-1279 CAN-2005-1278
Created:	May 2, 2005	Updated:	April 10, 2006
Description:	The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4. (CAN-2005-1280) tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet, which is not properly handled by RT_ROUTING_INFO, or LDP packet, which is not properly handled by the ldp_print function. (CAN-2005-1279) The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length, as demonstrated using a GRE packet. (CAN-2005-1278)
Alerts:	Fedora-Legacy FLSA:156139 2006-04-04 Debian DSA-850-1 2005-10-09 Mandriva MDKSA-2005:087 2005-05-11 Red Hat RHSA-2005:417-02 2005-05-11 Red Hat RHSA-2005:421-02 2005-05-11 Gentoo 200505-06 2005-05-09 Ubuntu USN-119-1 2005-05-06 Fedora FEDORA-2005-351 2005-05-02

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):	a2ps	CVE #(s):	CAN-2004-1170 CAN-2004-1377
Created:	November 26, 2004	Updated:	December 19, 2005
Description:	The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:	Fedora-Legacy FLSA:152870 2005-12-17 Mandriva MDKSA-2005:097 2005-06-07 OpenPKG OpenPKG-SA-2005.003 2005-01-17 Gentoo 200501-02 2005-01-04 Debian DSA-612-1 2004-12-20 Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

cdrecord: insecure temp file

Package(s):	cdrecord	CVE #(s):	CAN-2005-0866
Created:	March 24, 2005	Updated:	April 28, 2005
Description:	The cdrecord utility makes insecure temp files if DEBUG is enabled in /etc/cdrecord/rscsi. This can allow a local user to launch a sym link attack and execute code with the user's privileges.
Alerts:	Mandriva MDKSA-2005:077 2005-04-20 Ubuntu USN-100-1 2005-03-24

Comments (1 posted)

Convert-UUlib: buffer overflow

Package(s):	Convert-UUlib	CVE #(s):
Created:	April 26, 2005	Updated:	April 27, 2005
Description:	A vulnerability has been reported in Convert-UUlib where a malformed parameter can be provided by an attacker allowing a read operation to overflow a buffer. The vendor credits Mark Martinec and Robert Lewis with the discovery.
Alerts:	Gentoo 200504-26 2005-04-26

Comments (none posted)

cpio - file permissions error

Package(s):	cpio	CVE #(s):	CAN-1999-1572
Created:	February 2, 2005	Updated:	July 19, 2005
Description:	Some versions of cpio contain an ancient vulnerability where files created by that utility have overly generous access permissions.
Alerts:	Fedora-Legacy FLSA:152891 2005-07-15 Red Hat RHSA-2005:080-01 2005-02-18 Red Hat RHSA-2005:073-01 2005-02-15 Mandrake MDKSA-2005:032-1 2005-02-11 Mandrake MDKSA-2005:032 2005-02-10 Ubuntu USN-75-1 2005-02-04 Debian DSA-664-1 2005-02-02

Comments (none posted)

cURL: buffer overflow

Package(s):	curl	CVE #(s):	CAN-2005-0490
Created:	February 28, 2005	Updated:	July 19, 2005
Description:	Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded.
Alerts:	Fedora-Legacy FLSA:152917 2005-07-15 Fedora FEDORA-2005-325 2005-04-20 Red Hat RHSA-2005:340-01 2005-04-05 Conectiva CLA-2005:940 2005-03-21 Gentoo 200503-20 2005-03-16 Mandrake MDKSA-2005:048 2005-03-04 SuSE SUSE-SA:2005:011 2005-02-28 Ubuntu USN-86-1 2005-02-28

Comments (none posted)

cvs: multiple vulnerabilities

Package(s):	cvs	CVE #(s):	CAN-2005-0753
Created:	April 18, 2005	Updated:	July 13, 2005
Description:	CVS (in version prior to 1.11.20) has one or more buffer overflow vulnerabilities, memory leaks, and a NULL pointer dereferencing error. These can be used to launch a remote denial of service or to remotely execute arbitrary code.
Alerts:	Debian DSA-742-1 2005-07-07 Fedora-Legacy FLSA:155508 2005-05-12 Ubuntu USN-117-1 2005-05-04 Red Hat RHSA-2005:387-01 2005-04-25 Gentoo 200504-16:02 2005-04-18 Slackware SSA:2005-111-01 2005-04-22 Trustix TSLSA-2005-0013 2005-04-20 Mandriva MDKSA-2005:073 2005-04-20 Fedora FEDORA-2005-330 2005-04-20 Gentoo 200504-16 2005-04-18 SuSE SUSE-SA:2005:024 2005-04-18

Comments (none posted)

cyrus-imapd: buffer overflows

Package(s):	cyrus-imapd	CVE #(s):	CAN-2005-0546
Created:	February 23, 2005	Updated:	April 10, 2006
Description:	Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system.
Alerts:	Fedora-Legacy FLSA:156290 2006-04-04 Red Hat RHSA-2005:408-01 2005-05-17 Fedora FEDORA-2005-339 2005-04-27 OpenPKG OpenPKG-SA-2005.005 2005-04-05 Conectiva CLA-2005:937 2005-03-17 Mandrake MDKSA-2005:051 2005-03-04 Ubuntu USN-87-1 2005-02-28 SuSE SUSE-SA:2005:009 2005-02-24 Gentoo 200502-29 2005-02-23

Comments (none posted)

dhcp: format string vulnerability

Package(s):	dhcp	CVE #(s):	CAN-2004-1006
Created:	November 4, 2004	Updated:	July 13, 2005
Description:	Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:	Fedora-Legacy FLSA:152835 2005-07-10 Red Hat RHSA-2005:212-01 2005-04-12 Debian DSA-584-1 2004-11-04

Comments (none posted)

Dnsmasq: poisoning and DoS

Package(s):	dnsmasq	CVE #(s):
Created:	April 4, 2005	Updated:	July 21, 2005
Description:	Dnsmasq does not properly detect that DNS replies received do not correspond to any DNS query that was sent. Rob Holland of the Gentoo Linux Security Audit team also discovered two off-by-one buffer overflows that could crash DHCP lease files parsing.
Alerts:	Slackware SSA:2005-201-01 2005-07-21 Gentoo 200504-03 2005-04-04

Comments (none posted)

eGroupWare: XSS and SQL injection vulnerabilities

Package(s):	eGroupWare	CVE #(s):
Created:	April 25, 2005	Updated:	April 27, 2005
Description:	Multiple SQL injection and cross-site scripting vulnerabilities have been found in several eGroupWare modules. An attacker could possibly use the SQL injection vulnerabilities to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie based authentication credentials, potentially compromising the victim's browser.
Alerts:	Gentoo 200504-24 2005-04-25

Comments (none posted)

emacs21: format string vulnerability in "movemail"

Package(s):	emacs21	CVE #(s):	CAN-2005-0100
Created:	February 7, 2005	Updated:	May 15, 2006
Description:	Max Vozeler discovered a format string vulnerability in the "movemail" utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the user and the "mail" group.
Alerts:	Fedora-Legacy FLSA:152898 2006-05-12 Debian DSA-685-1 2005-02-17 Mandrake MDKSA-2005:038 2005-02-15 Gentoo 200502-20 2005-02-15 Fedora FEDORA-2005-146 2005-02-14 Fedora FEDORA-2005-145 2005-02-14 Red Hat RHSA-2005:133-01 2005-02-15 Red Hat RHSA-2005:110-01 2005-02-15 Red Hat RHSA-2005:134-01 2005-02-10 Red Hat RHSA-2005:112-01 2005-02-10 Fedora FEDORA-2005-116 2005-02-08 Fedora FEDORA-2005-115 2005-02-08 Debian DSA-671-1 2005-02-08 Debian DSA-670-1 2005-02-08 Ubuntu USN-76-1 2005-02-07

Comments (none posted)

enscript: arbitrary code execution

Package(s):	enscript	CVE #(s):	CAN-2004-1184 CAN-2004-1185 CAN-2004-1186
Created:	January 21, 2005	Updated:	May 27, 2006
Description:	Erik Sjölund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. Unsanitized input can cause the execution of arbitrary commands via EPSF pipe support. Due to missing sanitizing of filenames it is possible that a specially crafted filename can cause arbitrary commands to be executed. Multiple buffer overflows can cause the program to crash.
Alerts:	rPath rPSA-2006-0083-1 2006-05-26 Fedora-Legacy FLSA:152892 2005-12-17 Red Hat RHSA-2005:040-01 2005-02-15 Mandrake MDKSA-2005:033 2005-02-10 Gentoo 200502-03 2005-02-02 Red Hat RHSA-2005:039-01 2005-02-01 Fedora FEDORA-2005-096 2005-01-31 Fedora FEDORA-2005-092 2005-01-28 Fedora FEDORA-2005-091 2005-01-28 Fedora FEDORA-2005-016 2005-01-26 Fedora FEDORA-2005-015 2005-01-26 Ubuntu USN-68-1 2005-01-24 Debian DSA-654-1 2005-01-21

Comments (none posted)

evolution: arbitrary code execution

Package(s):	evolution	CVE #(s):	CAN-2005-0102
Created:	January 24, 2005	Updated:	May 19, 2005
Description:	Max Vozeler discovered an integer overflow in camel-lock-helper. A user-supplied length value was not validated, so that a value of -1 caused a buffer allocation of 0 bytes; this buffer was then filled by an arbitrary amount of user-supplied data. A local attacker or a malicious POP3 server could exploit this to execute arbitrary code with root privileges (because camel-lock-helper is installed as setuid root).
Alerts:	Red Hat RHSA-2005:238-01 2005-05-19 Conectiva CLA-2005:925 2005-02-16 Debian DSA-673-1 2005-02-10 Mandrake MDKSA-2005:024 2005-01-27 Gentoo 200501-35 2005-01-24 Ubuntu USN-69-1 2005-01-24

Comments (1 posted)

evolution: message crash vulnerability

Package(s):	evolution	CVE #(s):	CAN-2005-0806
Created:	March 17, 2005	Updated:	August 11, 2005
Description:	The Evolution mail client can be crashed when reading certain types of messages.
Alerts:	Ubuntu USN-166-1 2005-08-11 Red Hat RHSA-2005:397-01 2005-05-04 Conectiva CLA-2005:950 2005-04-27 Fedora FEDORA-2005-338 2005-04-22 Mandrake MDKSA-2005:059 2005-03-16

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):	foomatic	CVE #(s):	CAN-2004-0801
Created:	September 20, 2004	Updated:	May 31, 2006
Description:	There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:	SuSE SUSE-SA:2006:026 2006-05-30 Fedora-Legacy FLSA:2076 2004-11-05 Conectiva CLA-2004:880 2004-10-27 Fedora FEDORA-2004-303 2004-09-21 Gentoo 200409-24 2004-09-20

Comments (none posted)

gaim: client freezes

Package(s):	gaim	CVE #(s):	CAN-2005-0472 CAN-2005-0473
Created:	February 22, 2005	Updated:	April 27, 2005
Description:	The Gaim client freezes when receiving certain invalid messages and crashes when receiving specific malformed HTML. See this Secunia Advisory for additional information.
Alerts:	Debian DSA-716-1 2005-04-27 Ubuntu USN-85-1 2005-02-25 Fedora FEDORA-2005-160 2005-02-21 Fedora FEDORA-2005-159 2005-02-21

Comments (none posted)

gaim: buffer overflow, DoS

Package(s):	gaim	CVE #(s):	CAN-2005-0965 CAN-2005-0966
Created:	April 5, 2005	Updated:	May 15, 2005
Description:	Jean-Yves Lefort discovered a buffer overflow in the gaim_markup_strip_html() function. This caused Gaim to crash when receiving certain malformed HTML messages. (CAN-2005-0965) Jean-Yves Lefort also noticed that many functions that handle IRC commands do not escape received HTML metacharacters; this allowed remote attackers to cause a Denial of Service by injecting arbitrary HTML code into the conversation window, popping up arbitrarily many empty dialog boxes, or even causing Gaim to crash. (CAN-2005-0966)
Alerts:	Slackware SSA:2005-133-01 2005-05-15 Conectiva CLA-2005:949 2005-04-27 Slackware SSA:2005-111-03 2005-04-22 Mandriva MDKSA-2005:071 2005-04-13 Red Hat RHSA-2005:365-01 2005-04-12 Gentoo 200504-05 2005-04-06 Fedora FEDORA-2005-299 2005-04-05 Fedora FEDORA-2005-298 2005-04-05 Ubuntu USN-106-1 2005-04-05

Comments (none posted)

gtk-pixbuf, gtk2: denial of service

Package(s):	gdk-pixbuf gtk2	CVE #(s):	CAN-2005-0891
Created:	March 30, 2005	Updated:	December 19, 2005
Description:	The BMP image processing code in gdk-pixbuf and gtk2 contains a denial of service vulnerability exploitable via a specially crafted image file.
Alerts:	Fedora-Legacy FLSA:155510 2005-12-17 Fedora-Legacy FLSA:154272 2005-07-15 SuSE SUSE-SR:2005:010 2005-04-08 Mandrake MDKSA-2005:069 2005-04-07 Mandrake MDKSA-2005:068 2005-04-07 Ubuntu USN-108-1 2005-04-05 Red Hat RHSA-2005:343-01 2005-04-05 Red Hat RHSA-2005:344-01 2005-04-01 Fedora FEDORA-2005-268 2005-03-30 Fedora FEDORA-2005-267 2005-03-30 Fedora FEDORA-2005-266 2005-03-30 Fedora FEDORA-2005-265 2005-03-30

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):	gettext	CVE #(s):	CAN-2004-0966
Created:	October 11, 2004	Updated:	March 1, 2006
Description:	gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:	Mandriva MDKSA-2006:051 2006-02-28 Fedora-Legacy FLSA:136323 2006-01-09 Gentoo 200410-10:02 2004-10-10 OpenPKG OpenPKG-SA-2004.055 2004-12-23 Ubuntu USN-5-1 2004-10-27 Gentoo 200410-10 2004-10-10

Comments (1 posted)

gftp: missing input sanitizing

Package(s):	gftp	CVE #(s):	CAN-2005-0372 CAN-2004-1376
Created:	February 17, 2005	Updated:	July 13, 2005
Description:	gftp has a directory traversal vulnerability. A remote server could use specially crafted filenames to overwrite local files.
Alerts:	Fedora-Legacy FLSA:152908 2005-07-10 Red Hat RHSA-2005:410-01 2005-06-13 Fedora FEDORA-2005-310 2005-04-07 Fedora FEDORA-2005-309 2005-04-07 Mandrake MDKSA-2005:050 2005-03-04 Gentoo 200502-27 2005-02-19 SuSE SUSE-SR:2005:005 2005-02-18 Debian DSA-686-1 2005-02-17

Comments (none posted)

ghostscript: symlink vulnerabilities

Package(s):	ghostscript	CVE #(s):	CAN-2004-0967
Created:	October 20, 2004	Updated:	September 28, 2005
Description:	The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:	Red Hat RHSA-2005:081-01 2005-09-28 Ubuntu USN-3-1 2004-10-27 Gentoo 200410-18 2004-10-20

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):	glibc	CVE #(s):	CAN-2004-1453
Created:	August 17, 2004	Updated:	May 26, 2005
Description:	Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:	Red Hat RHSA-2005:256-01 2005-05-18 Gentoo 200408-16 2004-08-16

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):	glibc	CVE #(s):	CAN-2004-0968
Created:	October 21, 2004	Updated:	November 14, 2005
Description:	The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:	Fedora-Legacy FLSA:152848 2005-11-13 Red Hat RHSA-2005:261-01 2005-04-28 Debian DSA-636-1 2005-01-12 Mandrake MDKSA-2004:159 2004-12-29 Red Hat RHSA-2004:586-01 2004-12-20 Fedora FEDORA-2004-356 2004-11-11 Ubuntu USN-4-1 2004-10-27 Gentoo 200410-19 2004-10-21

Comments (none posted)

gnupg: information leak

Package(s):	gnupg	CVE #(s):	CAN-2005-0366
Created:	March 16, 2005	Updated:	August 19, 2005
Description:	GnuPG (and other PGP-like systems) suffers from an information leak which could, in some situations, be used by an attacker to obtain plain text from an encrypted message. See this message for a detailed explanation of the problem. "We know of no real-world application that is affected by this type of attack. It is an attack that requires the active participation of someone who holds the actual key required to decrypt a message. Thus, it is not something you are likely to see."
Alerts:	Ubuntu USN-170-1 2005-08-19 Gentoo 200503-29 2005-03-24 Mandrake MDKSA-2005:057 2005-03-15

Comments (none posted)

grip: buffer overflow

Package(s):	grip	CVE #(s):	CAN-2005-0706
Created:	March 10, 2005	Updated:	November 19, 2008
Description:	Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:	Fedora FEDORA-2008-9604 2008-11-19 Fedora FEDORA-2008-9521 2008-11-19 Fedora-Legacy FLSA:152919 2005-09-15 Mandriva MDKSA-2005:074 2005-04-20 Mandriva MDKSA-2005:075 2005-04-20 Gentoo 200504-07 2005-04-08 Mandrake MDKSA-2005:066 2005-04-01 Red Hat RHSA-2005:304-01 2005-03-28 Gentoo 200503-21 2005-03-17 Fedora FEDORA-2005-203 2005-03-09 Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

groff: insecure temporary directory

Package(s):	groff	CVE #(s):	CAN-2004-0969
Created:	November 1, 2004	Updated:	February 9, 2006
Description:	Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:	Mandriva MDKSA-2006:038 2006-02-08 Gentoo 200411-15 2004-11-08 Ubuntu USN-13-1 2004-11-01

Comments (none posted)

htdig: cross site scripting

Package(s):	htdig	CVE #(s):	CAN-2005-0085
Created:	February 14, 2005	Updated:	January 10, 2006
Description:	Michael Krax discovered that ht://Dig fails to validate the 'config' parameter before displaying an error message containing the parameter. This flaw could allow an attacker to conduct cross-site scripting attacks.
Alerts:	Fedora-Legacy FLSA:152907 2006-01-09 Mandrake MDKSA-2005:063 2005-03-31 Red Hat RHSA-2005:090-01 2005-02-15 Debian DSA-680-1 2005-02-14 Gentoo 200502-16 2005-02-13

Comments (none posted)

imap: buffer overflow in c-client

Package(s):	imap	CVE #(s):	CAN-2003-0297
Created:	February 18, 2005	Updated:	April 10, 2006
Description:	A buffer overflow flaw was found in the c-client IMAP client. An attacker could create a malicious IMAP server that if connected to by a victim could execute arbitrary code on the client machine.
Alerts:	Fedora-Legacy FLSA:184074 2006-04-04 Fedora-Legacy FLSA:152912 2005-05-12 Red Hat RHSA-2005:114-01 2005-02-18

Comments (none posted)

imlib2: buffer overflows

Package(s):	imlib2	CVE #(s):	CAN-2004-0802 CAN-2004-0817
Created:	September 8, 2004	Updated:	October 26, 2005
Description:	The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:	Debian DSA-548-2 2005-10-26 Conectiva CLA-2004:870 2004-09-28 Debian DSA-552-1 2004-09-22 Debian DSA-548-1 2004-09-16 Red Hat RHSA-2004:465-01 2004-09-15 Gentoo 200409-12 2004-09-08 Fedora FEDORA-2004-301 2004-09-09 Fedora FEDORA-2004-300 2004-09-09 Mandrake MDKSA-2004:089 2004-09-07

Comments (none posted)

junkbuster: heap corruption and settings modification

Package(s):	junkbuster	CVE #(s):	CVE-2005-1108 CVE-2005-1109
Created:	April 13, 2005	Updated:	November 5, 2005
Description:	JunkBuster through version 2.02-r2 contains two vulnerabilities: a heap corruption bug and a possible privacy violation.
Alerts:	Debian DSA-713-1 2005-04-21 Gentoo 200504-11 2005-04-13

Comments (1 posted)

kdelibs: unsanitzied input

Package(s):	kdelibs	CVE #(s):	CAN-2004-1165
Created:	January 10, 2005	Updated:	July 19, 2005
Description:	Thiago Macieira discovered a vulnerability in the kioslave library, which is part of kdelibs, which allows a remote attacker to execute arbitrary FTP commands via an ftp:// URL that contains an URL-encoded newline before the FTP command.
Alerts:	Fedora-Legacy FLSA:152769 2005-07-15 Mandrake MDKSA-2005:045 2005-02-17 Red Hat RHSA-2005:065-01 2005-02-15 Red Hat RHSA-2005:009-01 2005-02-10 Fedora FEDORA-2005-064 2005-01-25 Fedora FEDORA-2005-063 2005-01-25 Gentoo 200501-18 2005-01-11 Debian DSA-631-1 2005-01-10

Comments (none posted)

kdelibs: dcopserver vulnerability

Package(s):	kdelibs	CVE #(s):	CAN-2005-0396 CAN-2005-0237 CAN-2005-0365
Created:	March 17, 2005	Updated:	May 17, 2005
Description:	The KDE Desktop Communication Protocol daemon (dcopserver) is vulnerable to lockup by a local user, leading to a denial of service.
Alerts:	Conectiva CLA-2005:953 2005-05-17 SuSE SUSE-SA:2005:022 2005-04-11 Red Hat RHSA-2005:307-01 2005-04-06 Fedora FEDORA-2005-245 2005-03-23 Fedora FEDORA-2005-244 2005-03-23 Red Hat RHSA-2005:325-01 2005-03-23 Gentoo 200503-22 2005-03-19 Mandrake MDKSA-2005:058 2005-03-16

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2005-0400 CAN-2005-0749 CAN-2005-0750 CAN-2005-0815 CAN-2005-0839
Created:	April 1, 2005	Updated:	July 1, 2005
Description:	More kernel vulnerabilities have been discovered including: Mathieu Lafon discovered an information leak in the ext2 file system driver. (CAN-2005-0400) Yichen Xie discovered a Denial of Service vulnerability in the ELF loader. (CAN-2005-0749) Ilja van Sprundel discovered that the bluez_sock_create() function did not check its "protocol" argument for negative values. (CAN-2005-0750) Michal Zalewski discovered that the iso9660 file system driver fails to check ranges properly in several cases. (CAN-2005-0815) Previous kernels did not restrict the use of the N_MOUSE line discipline in the serial driver. (CAN-2005-0839)
Alerts:	Mandriva MDKSA-2005:110 2005-06-30 Mandriva MDKSA-2005:111 2005-06-30 Fedora-Legacy FLSA:152532 2005-06-04 Conectiva CLA-2005:952 2005-05-02 Red Hat RHSA-2005:284-01 2005-04-28 Red Hat RHSA-2005:283-01 2005-04-28 Red Hat RHSA-2005:293-01 2005-04-22 Fedora FEDORA-2005-313 2005-04-11 Trustix TSLSA-2005-0011 2005-04-05 SuSE SUSE-SA:2005:021 2005-04-04 Ubuntu USN-103-1 2005-04-01

Comments (1 posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2005-0449 CAN-2005-0209 CAN-2005-0529 CAN-2005-0530 CAN-2005-0532 CAN-2005-0384 CAN-2005-0210 CAN-2005-0504 CAN-2005-0003
Created:	March 24, 2005	Updated:	May 31, 2006
Description:	A number of vulnerabilities have been found in the Linux kernel, including a PPP-related denial of service problem, an integer overflow in the epoll() code, memory corruption in the ELF loader, and exploitable overflows in the ISO9660 code.
Alerts:	Debian DSA-1082-1 2006-05-29 Debian DSA-1069-1 2006-05-20 Debian DSA-1070-1 2006-05-21 Debian DSA-1067-1 2006-05-20 Conectiva CLA-2005:945 2005-03-31 Fedora FEDORA-2005-262 2005-03-28 SuSE SUSE-SA:2005:018 2005-03-24

Comments (none posted)

kimgio input validation errors

Package(s):	kimgio	CVE #(s):	CAN-2005-1046
Created:	April 22, 2005	Updated:	July 19, 2005
Description:	KDE has issued a security advisory for kimgio. This is found in kdelibs as shipped with KDE 3.2 up to including KDE 3.4. kimgio contains a PCX image file format reader that does not properly perform input validation. A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers, some of them exploitable to execute arbitrary code.
Alerts:	Ubuntu USN-114-2 2005-05-27 Red Hat RHSA-2005:393-01 2005-05-17 Mandriva MDKSA-2005:085 2005-05-12 Ubuntu USN-114-1 2005-05-03 Fedora FEDORA-2005-350 2005-05-02 Debian DSA-714-1 2005-04-26 Gentoo 200504-22 2005-04-22

Comments (none posted)

Kommander untrusted code execution

Package(s):	kommander	CVE #(s):	CAN-2005-0754
Created:	April 22, 2005	Updated:	May 20, 2005
Description:	KDE has issued a security advisory for Kommander. Quanta 3.1.x, KDE 3.2 and new up to including KDE 3.4.0 are vulnerable. Kommander executes without user confirmation data files from possibly untrusted locations. As they contain scripts, the user might accidentally run arbitrary code.
Alerts:	Gentoo 200504-23:02 2005-04-22 Ubuntu USN-115-1 2005-05-03 Fedora FEDORA-2005-345 2005-04-28 Gentoo 200504-23 2005-04-22

Comments (none posted)

libdbi-perl: insecure temporary file

Package(s):	libdbi-perl	CVE #(s):	CAN-2005-0077
Created:	January 25, 2005	Updated:	March 2, 2006
Description:	Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.
Alerts:	Fedora-Legacy FLSA:178989 2006-03-01 Gentoo 200501-38:03 2005-01-26 Red Hat RHSA-2005:072-01 2005-02-15 Mandrake MDKSA-2005:030 2005-02-08 Red Hat RHSA-2005:069-01 2005-02-01 Gentoo 200501-38 2005-01-26 Ubuntu USN-70-1 2005-01-25 Debian DSA-658-1 2005-01-25

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):	libgd2	CVE #(s):	CAN-2004-0990 CAN-2004-0941
Created:	October 29, 2004	Updated:	June 28, 2006
Description:	Several buffer overflows have been discovered in libgd's PNG handling functions. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges. Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:	Mandriva MDKSA-2006:114 2006-06-27 Red Hat RHSA-2006:0194-01 2006-02-01 Fedora-Legacy FLSA:152838 2005-07-15 Red Hat RHSA-2004:638-01 2004-12-17 Ubuntu USN-33-1 2004-11-29 Debian DSA-602-1 2004-11-29 Debian DSA-601-1 2004-11-29 Mandrake MDKSA-2004:132 2004-11-15 Ubuntu USN-25-1 2004-11-15 Fedora FEDORA-2004-412 2004-11-11 Fedora FEDORA-2004-411 2004-11-11 Ubuntu USN-21-1 2004-11-09 Debian DSA-591-1 2004-11-09 Debian DSA-589-1 2004-11-09 Gentoo 200411-08 2004-11-03 OpenPKG OpenPKG-SA-2004.049 2004-10-30 Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libtiff: buffer overflow

Package(s):	libtiff	CVE #(s):	CAN-2004-1308
Created:	December 22, 2004	Updated:	May 19, 2005
Description:	The libtiff image manipulation library contains several exploitable buffer overflows.
Alerts:	Fedora-Legacy FLSA:152815 2005-05-18 Red Hat RHSA-2005:035-01 2005-02-15 Conectiva CLA-2005:920 2005-01-20 Red Hat RHSA-2005:019-01 2005-01-13 SuSE SUSE-SA:2005:001 2005-01-10 Fedora FEDORA-2005-598 2005-01-07 Fedora FEDORA-2005-597 2005-01-07 Ubuntu USN-54-1 2005-01-06 Mandrake MDKSA-2005:002 2005-01-06 Mandrake MDKSA-2005:001 2005-01-06 Gentoo 200501-06 2005-01-05 Debian DSA-626-1 2005-01-06 Debian DSA-617-1 2004-12-24 Fedora FEDORA-2004-577 2004-12-22 Fedora FEDORA-2004-576 2004-12-22 Ubuntu USN-46-1 2004-12-22

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):	libxml2	CVE #(s):	CAN-2004-0989
Created:	October 28, 2004	Updated:	August 19, 2009
Description:	libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Ubuntu USN-89-1 2005-02-28 Red Hat RHSA-2004:650-01 2004-12-16 Conectiva CLA-2004:890 2004-11-18 Red Hat RHSA-2004:615-01 2004-11-12 Mandrake MDKSA-2004:127 2004-11-04 Debian DSA-582-1 2004-11-02 Gentoo 200411-05 2004-11-02 Trustix TSLSA-2004-0055 2004-10-29 OpenPKG OpenPKG-SA-2004.050 2004-10-31 Ubuntu USN-10-1 2004-10-28 Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libXpm: new buffer overflows

Package(s):	libXpm	CVE #(s):	CAN-2005-0605
Created:	March 4, 2005	Updated:	March 8, 2006
Description:	A new vulnerability has been discovered in libXpm, which is included in OpenMotif and LessTif, that can potentially lead to remote code execution.
Alerts:	Fedora-Legacy FLSA:168264 2006-03-07 Fedora-Legacy FLSA:152803 2006-01-09 Fedora FEDORA-2005-815 2005-08-26 Fedora FEDORA-2005-808 2005-08-25 Red Hat RHSA-2005:198-01 2005-06-08 Red Hat RHSA-2005:473-01 2005-05-24 Red Hat RHSA-2005:412-01 2005-05-11 Debian DSA-723-1 2005-05-09 Mandriva MDKSA-2005:081 2005-05-05 Mandriva MDKSA-2005:080 2005-04-28 Red Hat RHSA-2005:044-01 2005-04-06 Red Hat RHSA-2005:331-01 2005-03-30 Fedora FEDORA-2005-273 2005-03-29 Fedora FEDORA-2005-272 2005-03-29 Ubuntu USN-97-1 2005-03-16 Gentoo 200503-15 2005-03-12 Ubuntu USN-92-1 2005-03-07 Gentoo 200503-08 2005-03-04

Comments (none posted)

lsh: buffer overflow and more

Package(s):	lsh-utils	CVE #(s):	CAN-2003-0826 CAN-2005-0814
Created:	April 27, 2005	Updated:	April 27, 2005
Description:	The lsh implementation of SSH2 suffers from a number of vulnerabilities, including an exploitable buffer overflow.
Alerts:	Debian DSA-717-1 2005-04-27

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):	lvm10	CVE #(s):	CAN-2004-0972
Created:	November 1, 2004	Updated:	July 25, 2005
Description:	Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:	Fedora-Legacy FLSA:152842 2005-07-24 Mandrake MDKSA-2004:144 2004-12-06 Gentoo 200411-22 2004-11-11 Debian DSA-583-1 2004-11-03 Ubuntu USN-15-1 2004-11-01

Comments (none posted)

mailman: path traversal

Package(s):	mailman	CVE #(s):	CAN-2005-0202
Created:	February 9, 2005	Updated:	July 13, 2005
Description:	The "private" module in the mailman mailing list manager fails to sanitize path names adequately. An attacker could exploit this vulnerability to retrieve private information, including passwords and private list archives. This vulnerability was used to compromise the Full-Disclosure list.
Alerts:	Fedora-Legacy FLSA:152895 2005-07-10 Ubuntu USN-78-2 2005-02-17 Debian DSA-674-3 2005-02-21 Mandrake MDKSA-2005:037 2005-02-14 Red Hat RHSA-2005:137-01 2005-02-15 SuSE SUSE-SA:2005:007 2005-02-14 Debian DSA-674-2 2005-02-11 Red Hat RHSA-2005:136-01 2005-02-10 Gentoo 200502-11 2005-02-10 Fedora FEDORA-2005-132 2005-02-10 Fedora FEDORA-2005-131 2005-02-10 Ubuntu USN-78-1 2005-02-09

Comments (none posted)

mc: buffer overflow

Package(s):	mc	CVE #(s):	CAN-2005-0763
Created:	March 29, 2005	Updated:	August 11, 2005
Description:	An unfixed buffer overflow has been discovered by Andrew V. Samoilov in mc, the midnight commander, a file browser and manager.
Alerts:	Fedora-Legacy FLSA:152889 2005-08-10 Red Hat RHSA-2005:512-01 2005-06-16 Debian DSA-698-1 2005-03-29

Comments (none posted)

MediaWiki: multiple vulnerabilities

Package(s):	mediawiki	CVE #(s):	CAN-2005-0534 CAN-2005-0535 CAN-2005-0536
Created:	February 28, 2005	Updated:	June 13, 2005
Description:	A security audit of the MediaWiki project discovered that MediaWiki is vulnerable to several cross-site scripting and cross-site request forgery attacks, and that the image deletion code does not sufficiently sanitize input parameters.
Alerts:	Gentoo 200506-12 2005-06-13 Gentoo 200502-33 2005-02-28

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: remote access vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2005-0088
Created:	February 10, 2005	Updated:	April 10, 2006
Description:	mod_python has a vulnerability in the publisher handler that may allow a remote user to use a specially crafted URL to allow access to objects that should be protected. An information leak can result.
Alerts:	Fedora-Legacy FLSA:152896 2006-04-04 Conectiva CLA-2005:926 2005-03-02 Debian DSA-689-1 2005-02-23 Red Hat RHSA-2005:100-01 2005-02-15 Gentoo 200502-14 2005-02-13 Trustix TSLSA-2005-0003 2005-02-11 Ubuntu USN-80-1 2005-02-11 Red Hat RHSA-2005:104-01 2005-02-10 Fedora FEDORA-2005-140 2005-02-10 Fedora FEDORA-2005-139 2005-02-10

Comments (none posted)

Mozilla Firefox, Mozilla Suite: multiple vulnerabilities

Package(s):	mozilla	CVE #(s):	CAN-2005-0989
Created:	April 19, 2005	Updated:	July 18, 2005
Description:	The following vulnerabilities were found and fixed in the Mozilla Suite and Mozilla Firefox: Vladimir V. Perepelitsa reported a memory disclosure bug in JavaScript's regular expression string replacement when using an anonymous function as the replacement argument (CAN-2005-0989). moz_bug_r_a4 discovered that Chrome UI code was overly trusting DOM nodes from the content window, allowing privilege escalation via DOM property overrides. Michael Krax reported a possibility to run JavaScript code with elevated privileges through the use of javascript: favicons. Michael Krax also discovered that malicious Search plugins could run JavaScript in the context of the displayed page or stealthily replace existing search plugins. shutdown discovered a technique to pollute the global scope of a window in a way that persists from page to page. Doron Rosenberg discovered a possibility to run JavaScript with elevated privileges when the user asks to "Show" a blocked popup that contains a JavaScript URL. Finally, Georgi Guninski reported missing Install object instance checks in the native implementations of XPInstall-related JavaScript objects. The following Firefox-specific vulnerabilities have also been discovered: Kohei Yoshino discovered a new way to abuse the sidebar panel to execute JavaScript with elevated privileges. Omar Khan reported that the Plugin Finder Service can be tricked to open javascript: URLs with elevated privileges.
Alerts:	Gentoo 200507-17 2005-07-18 Fedora-Legacy FLSA:152883 2005-05-18 Red Hat RHSA-2005:384-01 2005-04-28 SuSE SUSE-SA:2005:028 2005-04-27 Red Hat RHSA-2005:386-01 2005-04-26 Slackware SSA:2005-111-04 2005-04-22 Red Hat RHSA-2005:383-01 2005-04-21 Gentoo 200504-18 2005-04-19

Comments (none posted)

MPlayer: heap overflows

Package(s):	mplayer	CVE #(s):
Created:	April 20, 2005	Updated:	July 12, 2005
Description:	Heap overflows have been found in the code handling RealMedia RTSP and Microsoft Media Services streams over TCP (MMST). By setting up a malicious server and enticing a user to use its streaming data, a remote attacker could possibly execute arbitrary code on the client computer with the permissions of the user running MPlayer.
Alerts:	Mandriva MDKSA-2005:115 2005-07-11 Gentoo 200504-19 2005-04-20

Comments (none posted)

MySQL: input validation and temporary file vulnerabilities

Package(s):	mysql	CVE #(s):	CAN-2005-0709 CAN-2005-0710 CAN-2005-0711
Created:	March 16, 2005	Updated:	July 19, 2005
Description:	MySQL (prior to version 4.0.24) suffers from two input validation errors and a temporary file vulnerability.
Alerts:	Fedora-Legacy FLSA:152925 2005-07-15 OpenPKG OpenPKG-SA-2005.006 2005-04-20 Debian DSA-707-1 2005-04-13 Fedora FEDORA-2005-305 2005-04-05 Fedora FEDORA-2005-304 2005-04-05 Red Hat RHSA-2005:348-01 2005-04-05 Conectiva CLA-2005:946 2005-04-04 Red Hat RHSA-2005:334-01 2005-03-28 SuSE SUSE-SA:2005:019 2005-03-24 Mandrake MDKSA-2005:060 2005-03-21 Trustix TSLSA-2005-0009 2005-03-21 Ubuntu USN-96-1 2005-03-16 Gentoo 200503-19 2005-03-16

Comments (none posted)

nasm: Buffer overflow vulnerability

Package(s):	nasm	CVE #(s):	CAN-2004-1287
Created:	December 20, 2004	Updated:	May 4, 2005
Description:	Jonathan Rockway discovered that NASM-0.98.38 has an unprotected vsprintf() to an array in preproc.c. This code vulnerability may lead to a buffer overflow and potential execution of arbitrary code.
Alerts:	Red Hat RHSA-2005:381-01 2005-05-04 Fedora FEDORA-2005-322 2005-04-18 Mandrake MDKSA-2005:004 2005-01-06 Debian DSA-623-1 2004-01-04 Ubuntu USN-45-1 2004-12-22 Gentoo 200412-20 2004-12-20

Comments (4 posted)

ncpfs: multiple vulnerabilities

Package(s):	ncpfs	CVE #(s):	CAN-2005-0013 CAN-2005-0014
Created:	January 31, 2005	Updated:	May 15, 2006
Description:	Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).
Alerts:	Fedora-Legacy FLSA:152904 2006-05-12 Fedora FEDORA-2005-435 2005-08-16 Red Hat RHSA-2005:371-01 2005-05-17 Mandrake MDKSA-2005:028 2005-02-01 Gentoo 200501-44 2005-01-30

Comments (none posted)

nfs-utils: denial of service

Package(s):	nfs-utils	CVE #(s):	CAN-2004-1014
Created:	December 1, 2004	Updated:	May 15, 2005
Description:	The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker.
Alerts:	Fedora-Legacy FLSA:152871 2005-05-12 Red Hat RHSA-2004:583-01 2004-12-20 Gentoo 200412-08 2004-12-14 Trustix TSLSA-2004-0065 2004-01-09 Debian DSA-606-1 2004-12-08 Mandrake MDKSA-2004:146 2004-12-06 Ubuntu USN-36-1 2004-12-01

Comments (none posted)

nfs-utils: arbitrary code execution

Package(s):	nfs-utils	CVE #(s):	CAN-2004-0946
Created:	January 11, 2005	Updated:	February 27, 2006
Description:	Arjan van de Ven discovered a buffer overflow in rquotad on 64bit architectures; an improper integer conversion could lead to a buffer overflow. An attacker with access to an NFS share could send a specially crafted request which could then lead to the execution of arbitrary code.
Alerts:	Fedora-Legacy FLSA:138098 2006-02-25 Red Hat RHSA-2005:014-01 2005-01-12 Mandrake MDKSA-2005:005 2005-01-11

Comments (none posted)

openmosixview: insecure temp file

Package(s):	openmosixview	CVE #(s):	CAN-2005-0894
Created:	April 21, 2005	Updated:	April 27, 2005
Description:	openMosixview and the openMosixcollector daemon can create an insecure temporary file, this can be exploited by a local user to overwrite arbitrary files via symbolic links.
Alerts:	Gentoo 200504-20 2005-04-21

Comments (none posted)

OpenOffice.org: .doc parser buffer overflow

Package(s):	openoffice.org	CVE #(s):	CAN-2005-0941
Created:	April 13, 2005	Updated:	May 13, 2005
Description:	OpenOffice.org suffers from a buffer overflow in the parsing code for MS Word files; see this advisory for details. Since this vulnerability could conceivably be exploited via files received in email messages, it should be taken seriously.
Alerts:	Fedora-Legacy FLSA:154988 2005-05-12 Ubuntu USN-121-1 2005-05-06 Mandriva MDKSA-2005:082 2005-05-06 Red Hat RHSA-2005:375-01 2005-04-25 SuSE SUSE-SA:2005:025 2005-04-19 Gentoo 200504-13 2005-04-15 Fedora FEDORA-2005-316 2005-04-13

Comments (none posted)

openssl: der_chop script temp file vulnerability

Package(s):	openssl	CVE #(s):	CAN-2004-0975
Created:	November 11, 2004	Updated:	July 19, 2005
Description:	The der_chop script in openssl has a temp file vulnerability that may allow an attacker to overwrite arbitrary files with the permissions that the script is running under.
Alerts:	Fedora-Legacy FLSA:152841 2005-07-15 Mandrake MDKSA-2004:147 2004-12-06 Debian DSA-603-1 2004-12-01 Ubuntu USN-24-1 2004-11-11

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

Opera: multiple vulnerabilities

Package(s):	opera	CVE #(s):
Created:	February 14, 2005	Updated:	June 22, 2005
Description:	Opera is vulnerable to several vulnerabilities which could result in information disclosure and facilitate execution of arbitrary code.
Alerts:	SuSE SUSE-SA:2005:034 2005-06-22 Gentoo 200502-17 2005-02-14

Comments (none posted)

perl: setuid vulnerabilities

Package(s):	perl	CVE #(s):	CAN-2005-0155 CAN-2005-0156
Created:	February 2, 2005	Updated:	August 11, 2006
Description:	There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access.
Alerts:	Red Hat RHSA-2006:0605-01 2006-08-10 Fedora FEDORA-2005-353 2005-05-02 Red Hat RHSA-2005:103-01 2005-02-15 Gentoo 200502-13 2005-02-11 SuSE SUSE-SR:2005:004 2005-02-11 Mandrake MDKSA-2005:031 2005-02-08 Red Hat RHSA-2005:105-01 2005-02-07 Ubuntu USN-72-1 2005-02-02

Comments (none posted)

perl: symlink vulnerability

Package(s):	perl	CVE #(s):	CAN-2005-0448
Created:	March 9, 2005	Updated:	January 30, 2006
Description:	The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries.
Alerts:	Fedora-Legacy FLSA:152845 2006-01-24 Red Hat RHSA-2005:674-01 2005-10-05 Fedora FEDORA-2005-600 2005-07-22 Mandriva MDKSA-2005:079 2005-04-28 Debian DSA-696-1 2005-03-22 Ubuntu USN-94-1 2005-03-09

Comments (none posted)

php4: integer overflow and denial of service

Package(s):	php4	CVE #(s):	CAN-2005-1042 CAN-2005-1043
Created:	April 14, 2005	Updated:	July 13, 2005
Description:	The php4 EXIF module has two vulnerabilities. An integer overflow in the exif_process_IFD_TAG() function can be exploited to cause a buffer overflow for the purpose of arbitrary code execution. EXIF headers with a large IFD nesting level can be used to cause a denial of service. Remote exploits are possible.
Alerts:	Fedora-Legacy FLSA:155505 2005-07-10 Red Hat RHSA-2005:406-01 2005-05-04 Red Hat RHSA-2005:405-01 2005-04-28 Mandriva MDKSA-2005:072 2005-04-18 Ubuntu USN-112-1 2005-04-14

Comments (none posted)

php4: denial of service vulnerabilities

Package(s):	php4	CVE #(s):	CAN-2005-0524 CAN-2005-0525
Created:	April 5, 2005	Updated:	May 26, 2005
Description:	Two DoS vulnerabilities exist in PHP versions 4.2.2, 4.3.9, 4.3.10 and 5.0.3. One in the php_handle_iff function in image.c allows remote attackers to cause a denial of service (infinite loop) via a -8 size value. The php_next_marker function in image.c allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek. This later vulnerability also exists in PHP 3.
Alerts:	Debian DSA-729-1 2005-05-26 Gentoo 200504-15 2005-04-18 Fedora FEDORA-2005-315 2005-04-15 Debian DSA-708-1 2005-04-15 SuSE SUSE-SA:2005:023 2005-04-15 Slackware SSA:2005-095-01 2005-04-06 Ubuntu USN-105-1 2005-04-05

Comments (none posted)

postgresql: EXECUTE privilege vulnerability

Package(s):	postgresql	CVE #(s):	CAN-2005-0244 CAN-2005-0245 CAN-2005-0246 CAN-2005-0247
Created:	February 10, 2005	Updated:	July 19, 2005
Description:	postgresql has a vulnerability in which the EXECUTE privilege may not be checked on custom functions. This may allow any database user to circumvent the EXECUTE restriction on functions.
Alerts:	Fedora-Legacy FLSA:152844 2005-07-16 Trustix TSLSA-2005-0015 2005-04-25 SuSE SUSE-SA:2005:027 2005-04-20 SuSE SUSE-SR:2005:008 2005-03-18 SuSE SUSE-SR:2005:006 2005-02-25 Fedora FEDORA-2005-158 2005-02-22 Fedora FEDORA-2005-157 2005-02-22 Mandrake MDKSA-2005:040 2005-02-17 Red Hat RHSA-2005:150-01 2005-02-16 Debian DSA-683-1 2005-02-15 Red Hat RHSA-2005:138-01 2005-02-15 Gentoo 200502-19 2005-02-14 Ubuntu USN-79-1 2005-02-10

Comments (none posted)

qt3: BMP image parser heap overflow

Package(s):	qt3/qt3-non-mt/qt3-32bit/qt3-static	CVE #(s):	CAN-2004-0691 CAN-2004-0692 CAN-2004-0693
Created:	August 19, 2004	Updated:	May 15, 2005
Description:	A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution.
Alerts:	Fedora-Legacy FLSA:152763 2005-05-12 Conectiva CLA-2004:866 2004-09-22 Whitebox WBSA-2004:414-01 2004-09-20 Debian DSA-542-1 2004-08-30 Fedora FEDORA-2004-271 2004-08-23 Fedora FEDORA-2004-270 2004-08-23 Gentoo 200408-20 2004-08-22 Red Hat RHSA-2004:414-01 2004-08-20 Mandrake MDKSA-2004:085 2004-08-18 SuSE SUSE-SA:2004:027 2004-08-19

Comments (none posted)

realplayer: arbitrary code execution

Package(s):	realplayer helixplayer	CVE #(s):	CAN-2005-0755
Created:	April 20, 2005	Updated:	June 27, 2005
Description:	RealNetworks, Inc. has fixed a security vulnerability that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine. Linux RealPlayer 10 (10.0.0 - 3) and Helix Player (10.0.0 - 3) are vulnerable.
Alerts:	Red Hat RHSA-2005:523-01 2005-06-23 Red Hat RHSA-2005:517-01 2005-06-23 Gentoo 200504-21 2005-04-22 Red Hat RHSA-2005:394-01 2005-04-20 Red Hat RHSA-2005:392-03 2005-04-20 Red Hat RHSA-2005:363-03 2005-04-20 Fedora FEDORA-2005-329 2005-04-20 SuSE SUSE-SA:2005:026 2005-04-20

Comments (none posted)

Rootkit Hunter: insecure temporary file creation

Package(s):	rkhunter	CVE #(s):	CAN-2005-1270
Created:	April 26, 2005	Updated:	April 27, 2005
Description:	Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux Security Team have reported that the check_update.sh script and the main rkhunter script insecurely creates several temporary files with predictable filenames.
Alerts:	Gentoo 200504-25 2005-04-26

Comments (none posted)

rp-pppoe, pppoe: missing privilege dropping

Package(s):	rp-pppoe, pppoe	CVE #(s):	CAN-2004-0564
Created:	October 4, 2004	Updated:	November 15, 2005
Description:	Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver from Roaring Penguin. When the program is running setuid root (which is not the case in a default Debian installation), an attacker could overwrite any file on the file system.
Alerts:	Fedora-Legacy FLSA:152794 2005-11-14 Mandrake MDKSA-2004:145 2004-12-06 Debian DSA-557-1 2004-10-04

Comments (none posted)

ruby: infinite loop

Package(s):	ruby	CVE #(s):	CAN-2004-0983
Created:	November 8, 2004	Updated:	May 15, 2005
Description:	The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.
Alerts:	Fedora-Legacy FLSA:152768 2005-05-12 Red Hat RHSA-2004:635-01 2004-12-13 Gentoo 200411-23 2004-11-16 Fedora FEDORA-2004-403 2004-11-11 Fedora FEDORA-2004-402 2004-11-11 Ubuntu USN-20-1 2004-11-08 Mandrake MDKSA-2004:128 2004-11-08 Debian DSA-586-1 2004-11-08

Comments (none posted)

samba: integer overflow vulnerability

Package(s):	samba	CVE #(s):	CAN-2004-1154
Created:	December 16, 2004	Updated:	July 19, 2005
Description:	Samba has an integer overflow vulnerability that may allow an authenticated remote user to execute arbitrary code on the Samba server.
Alerts:	Fedora-Legacy FLSA:152874 2005-07-15 Debian DSA-701-2 2005-04-21 Debian DSA-701-1 2005-03-31 Conectiva CLA-2005:913 2005-01-06 Red Hat RHSA-2005:020-01 2005-01-05 Mandrake MDKSA-2004:158 2004-12-27 SuSE SUSE-SA:2004:045 2004-12-22 Red Hat RHSA-2004:681-01 2004-12-21 Fedora FEDORA-2004-562 2004-12-20 Fedora FEDORA-2004-561 2004-12-20 Gentoo 200412-13 2004-12-17 Ubuntu USN-41-1 2004-12-17 OpenPKG OpenPKG-SA-2004.054 2004-12-17 Red Hat RHSA-2004:670-01 2004-12-16

Comments (none posted)

SpamAssassin: Denial of Service vulnerability

Package(s):	spamassassin	CVE #(s):	CAN-2004-0796
Created:	August 9, 2004	Updated:	August 11, 2005
Description:	SpamAssassin contains an unspecified Denial of Service vulnerability. By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin service.
Alerts:	Fedora-Legacy FLSA:129284 2005-08-10 Fedora-Legacy FLSA:2268 2005-03-24 Red Hat RHSA-2004:451-01 2004-09-30 Conectiva CLA-2004:867 2004-09-22 OpenPKG OpenPKG-SA-2004.041 2004-09-15 Mandrake MDKSA-2004:084 2004-08-18 Gentoo 200408-06 2004-08-09

Comments (none posted)

squid: denial of service

Package(s):	squid	CVE #(s):	CAN-2005-0718
Created:	April 14, 2005	Updated:	April 29, 2005
Description:	Squid has a remote denial of service vulnerability that can be triggered by a remote connection abort during a PUT or POST request, leading to an eventual server crash.
Alerts:	SuSE SUSE-SR:2005:012 2005-04-29 Mandriva MDKSA-2005:078 2005-04-28 Conectiva CLA-2005:948 2005-04-27 Ubuntu USN-111-1 2005-04-14

Comments (none posted)

SquirrelMail: multiple vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2005-0075 CAN-2005-0103 CAN-2005-0104
Created:	January 28, 2005	Updated:	July 19, 2005
Description:	SquirrelMail 1.4.4 has been released, fixing a number of security issues that have been resolved since 1.4.3a.
Alerts:	Fedora-Legacy FLSA:152900 2005-07-16 Fedora FEDORA-2005-260 2005-03-28 Fedora FEDORA-2005-259 2005-03-28 Debian DSA-662-2 2005-03-14 Red Hat RHSA-2005:099-01 2005-02-15 Red Hat RHSA-2005:135-01 2005-02-10 Debian DSA-662-1 2005-02-01 Gentoo 200501-39 2005-01-28

Comments (none posted)

sudo: environment variable sanitizing

Package(s):	sudo	CVE #(s):	CAN-2004-1051
Created:	November 17, 2004	Updated:	May 15, 2005
Description:	Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information.
Alerts:	Fedora-Legacy FLSA:152856 2005-05-12 OpenPKG OpenPKG-SA-2005.002 2005-01-17 Debian DSA-596-2 2004-11-24 Debian DSA-596-1 2004-11-24 Ubuntu USN-28-1 2004-11-17 Mandrake MDKSA-2004:133 2004-11-15

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

telnet: buffer overflows

Package(s):	telnet	CVE #(s):	CAN-2005-0468 CAN-2005-0469
Created:	March 28, 2005	Updated:	August 1, 2005
Description:	Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server.
Alerts:	Slackware SSA:2005-210-01 2005-08-01 Debian DSA-765-1 2005-07-22 Fedora-Legacy FLSA:154276 2005-07-24 Fedora-Legacy FLSA:152583 2005-07-11 Debian DSA-731-1 2005-06-02 Gentoo 200504-28 2005-04-28 Gentoo 200504-04 2005-04-06 Debian DSA-703-1 2005-04-01 Gentoo 200504-01 2005-04-01 Gentoo 200503-36 2005-03-31 Red Hat RHSA-2005:330-01 2005-03-30 Mandrake MDKSA-2005:061 2005-03-29 Fedora FEDORA-2005-274 2005-03-30 Fedora FEDORA-2005-277 2005-03-30 Fedora FEDORA-2005-270 2005-03-29 Fedora FEDORA-2005-269 2005-03-29 SuSE SUSE-SR:2005:009 2005-03-29 Debian DSA-699-1 2005-03-29 Debian DSA-697-1 2005-03-29 Red Hat RHSA-2005:327-01 2005-03-28

Comments (none posted)

UnAce: buffer overflow and directory traversal

Package(s):	unace	CVE #(s):	CAN-2005-0160 CAN-2005-0161
Created:	February 28, 2005	Updated:	June 17, 2005
Description:	Ulf Harnhammar discovered that UnAce suffers from buffer overflows when testing, unpacking or listing specially crafted ACE archives (CAN-2005-0160). He also found out that UnAce is vulnerable to directory traversal attacks, if an archive contains "./.." sequences or absolute filenames (CAN-2005-0161).
Alerts:	SuSE SUSE-SR:2005:016 2005-06-17 Gentoo 200502-32 2005-02-28

Comments (none posted)

vixie-cron: crontab allows any user to read another users crontabs

Package(s):	vixie-cron	CVE #(s):	CAN-2005-1038
Created:	April 15, 2005	Updated:	March 15, 2006
Description:	crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235. See also this Security Focus report.
Alerts:	Red Hat RHSA-2006:0117-01 2006-03-15 Red Hat RHSA-2005:361-01 2005-10-05 Fedora FEDORA-2005-320 2005-04-15

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):	xchat	CVE #(s):	CAN-2004-0409
Created:	April 19, 2004	Updated:	November 15, 2005
Description:	XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:	Fedora-Legacy FLSA:123013 2005-11-14 Red Hat RHSA-2004:585-01 2004-10-27 Netwosix NW-2004-0014 2004-05-01 Red Hat RHSA-2004:177-01 2004-04-30 Mandrake MDKSA-2004:036 2004-04-21 Debian DSA-493-1 2004-04-21 Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-lib: two heap overflow vulnerabilities

Package(s):	xine-lib	CVE #(s):	CAN-2005-1195
Created:	April 26, 2005	Updated:	June 2, 2005
Description:	Heap overflows have been found in the code handling RealMedia RTSP and Microsoft Media Services streams over TCP (MMST). See Xine Advisory XSA-2004-8 for details.
Alerts:	Mandriva MDKSA-2005:094 2005-05-26 SuSE SUSE-SR:2005:013 2005-05-18 Ubuntu USN-123-1 2005-05-06 Slackware SSA:2005-121-02 2005-05-02 Gentoo 200504-27 2005-04-26

Comments (none posted)

xine-lib: buffer overflows

Package(s):	xine-lib	CVE #(s):	CAN-2004-1379
Created:	September 22, 2004	Updated:	April 10, 2006
Description:	xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:	Fedora-Legacy FLSA:152873 2006-04-04 Debian DSA-657-1 2005-01-25 Mandrake MDKSA-2004:105 2004-10-06 Slackware SSA:2004-266-04 2004-09-22 Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):	xine-ui	CVE #(s):	CAN-2004-0372
Created:	April 6, 2004	Updated:	April 27, 2006
Description:	Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:	Gentoo 200404-20 2004-04-27 Slackware SSA:2004-111-01 2004-04-20 Mandrake MDKSA-2004:033 2004-04-19 Debian DSA-477-1 2004-04-06

Comments (none posted)

xloadimage: missing input sanitizing, integer overflow

Package(s):	xloadimage	CVE #(s):	CAN-2005-0638 CAN-2005-0639
Created:	March 21, 2005	Updated:	May 4, 2005
Description:	Tavis Ormandy of the Gentoo Linux Security Audit Team has reported a flaw in the handling of compressed images, where shell meta-characters are not adequately escaped. CAN-2005-0638 Insufficient validation of image properties in have been discovered which could potentially result in buffer management errors. CAN-2005-0639
Alerts:	Mandriva MDKSA-2005:076 2005-04-20 Red Hat RHSA-2005:332-01 2005-04-19 Debian DSA-695-1 2005-03-21 Debian DSA-694-1 2005-03-21 Fedora FEDORA-2005-237 2005-03-18 Fedora FEDORA-2005-236 2005-03-18

Comments (none posted)

xorg-x11: integer overflows

Package(s):	xorg-x11	CVE #(s):	CAN-2004-0914
Created:	November 18, 2004	Updated:	September 12, 2005
Description:	The X.Org libXpm library has several integer overflow vulnerabilities An attacker can modify XPM images to execute malicious code.
Alerts:	Ubuntu USN-83-2 2005-09-12 Fedora-Legacy FLSA:152804 2005-05-12 Ubuntu USN-83-1 2005-02-16 Gentoo 200502-07 2005-02-07 Gentoo 200502-06 2005-02-06 Red Hat RHSA-2004:612-01 2004-12-20 Red Hat RHSA-2004:610-01 2004-12-20 Debian DSA-607-1 2004-12-10 Mandrake MDKSA-2004:137-1 2004-11-29 Mandrake MDKSA-2004:137 2004-11-22 Mandrake MDKSA-2004:138 2004-11-22 Gentoo 200411-28 2004-11-19 Fedora FEDORA-2004-434 2004-11-17 Fedora FEDORA-2004-433 2004-11-17 SuSE SUSE-SA:2004:041 2004-11-17

Comments (none posted)

xpdf: buffer overflow

Package(s):	xpdf	CVE #(s):	CAN-2005-0064
Created:	January 19, 2005	Updated:	March 15, 2007
Description:	iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:	Fedora FEDORA-2007-1219 2007-03-14 Gentoo 200506-06 2005-06-09 Red Hat RHSA-2005:026-01 2005-03-16 Red Hat RHSA-2005:066-01 2005-02-15 Red Hat RHSA-2005:057-01 2005-02-15 Red Hat RHSA-2005:053-01 2005-02-15 Red Hat RHSA-2005:034-01 2005-02-15 Fedora-Legacy FLSA:2353 2005-02-10 Fedora-Legacy FLSA:2352 2005-02-10 Gentoo 200502-10 2005-02-09 Red Hat RHSA-2005:049-01 2005-02-01 SuSE SUSE-SR:2005:002 2005-01-26 Red Hat RHSA-2005:059-01 2005-01-26 Mandrake MDKSA-2005:020 2005-01-25 Mandrake MDKSA-2005:019 2005-01-25 Mandrake MDKSA-2005:016 2005-01-25 Mandrake MDKSA-2005:021 2005-01-25 Mandrake MDKSA-2005:018 2005-01-25 Mandrake MDKSA-2005:017 2005-01-25 Fedora FEDORA-2005-061 2005-01-25 Fedora FEDORA-2005-062 2005-01-25 Fedora FEDORA-2005-059 2005-01-25 Fedora FEDORA-2005-060 2005-01-25 Conectiva CLA-2005:921 2005-01-25 Fedora FEDORA-2004-049 2005-01-24 Fedora FEDORA-2004-048 2005-01-24 Gentoo 200501-32 2005-01-23 Gentoo 200501-31 2005-01-23 Gentoo 200501-30 2005-01-22 Gentoo 200501-28 2005-01-21 Fedora FEDORA-2005-052 2005-01-20 Fedora FEDORA-2005-051 2005-01-20 Ubuntu USN-64-1 2005-01-19 Debian DSA-645-1 2005-01-19 Debian DSA-648-1 2005-01-19

Comments (1 posted)

XV: multiple vulnerabilities

Package(s):	xv	CVE #(s):
Created:	April 19, 2005	Updated:	July 19, 2005
Description:	Greg Roelofs has reported multiple input validation errors in XV image decoders. Tavis Ormandy of the Gentoo Linux Security Audit Team has reported insufficient validation in the PDS (Planetary Data System) image decoder, format string vulnerabilities in the TIFF and PDS decoders, and insufficient protection from shell meta-characters in malformed filenames. Successful exploitation would require a victim to view a specially created image file using XV, potentially resulting in the execution of arbitrary code.
Alerts:	Slackware SSA:2005-195-02 2005-07-15 Gentoo 200504-17 2005-04-19

Comments (none posted)

zlib: denial of service

Package(s):	zlib	CVE #(s):	CAN-2004-0797
Created:	August 25, 2004	Updated:	June 10, 2005
Description:	Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks.
Alerts:	OpenPKG OpenPKG-SA-2005.007 2005-06-10 Fedora-Legacy FLSA:2043 2005-02-23 Conectiva CLA-2004:878 2004-10-25 Slackware SSA:2004-278-02 2004-10-04 Conectiva CLA-2004:865 2004-09-13 Mandrake MDKSA-2004:090 2004-09-07 SuSE SUSE-SA:2004:029 2004-09-02 Gentoo 200408-26 2004-08-27 OpenPKG OpenPKG-SA-2004.038 2004-08-25

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current stable 2.6 kernel is 2.6.11.8, released on April 29.

The current 2.6 prepatch remains 2.6.12-rc3.

Linus's git repository contains a number of new "sparse" annotations, a CIFS update, various architecture updates, resource limits for niceness and realtime scheduling (see below), a new valid_signal() function (for testing signal numbers), a JFS update, some networking tweaks, and lots of fixes.

The current -mm tree is 2.6.12-rc3-mm2. Recent changes to -mm include a number of new git trees, a cpufreq update, a new /proc/zoneinfo file, some preparatory patches for Xen, and some ext3 latency reduction work.

Comments (none posted)

Kernel development news

Quote of the week

-- Andrew Morton

Comments (none posted)

A web interface to git

Further evidence that the the kernel source code management situation is slowly stabilizing: there is now a web interface to the kernel.org git repositories. Most people, perhaps, will be interested in Linus's tree, where the latest patches merged into the mainline can be viewed, but there are several developer trees available as well. (Thanks to Steven Cole).

Comments (16 posted)

Audio latency - resource limits win

The long debate on how to provide preferential scheduling for audio applications would appear to have come to an end. The realtime Linux security module has not been merged; instead, the mainline now includes a version of the rlimit patch. This is not the outcome which was most favored by the audio development community, but it will still be useful for them.

The patch creates two new resource limits. RLIMIT_NICE controls the maximum "niceness" that the process can set for itself in the normal timesharing scheduler. The limit has a range of 0..39, with 39 corresponding to an internal niceness value of -20 - the highest priority. The difference between the resource limit value and the actual niceness values may seem confusing, but apparently it's unavoidable: the Single Unix Standard specifies that resource limits must be unsigned values.

The other limit is RLIMIT_RTPRIO; it can have a range of 0..100. If it is nonzero, the process is empowered to use the realtime scheduling classes up to the indicated priority.

The problem with this approach, from the point of view of the audio community, is that it is not currently supported by any distribution. It is easy to set up PAM to give expanded limits to specific users or groups - once PAM has been patched to understand the new limits. Shells, too, must be patched before their ulimit commands can be used to change the limits. So it will be some time before an "out of the box" Linux system will be able to take advantage of this new capability.

In the long term, however, the rlimit patch looks like a minimally invasive way of making realtime scheduling available, in a relatively safe way, to ordinary users. Anybody wanting to play with the new mechanism before their distribution catches up can find instructions and patches on this web page.

Comments (3 posted)

API change: synchronize_kernel() deprecated

The read-copy-update mechanism works with the fundamental assumption that, if no pointer to an RCU-protected data structure exists, there will be no references to that structure after every processor on the system has scheduled at least once. This assumption works because the rules require that accesses to RCU-protected data structures be atomic; scheduling while holding such a reference is not legal. When RCU was added to the kernel, it brought with it a function called synchronize_kernel() which would wait for every processor to schedule. Since it seemed that this capability could be useful outside of RCU itself, synchronize_kernel() was exported to the world.

A quick grep of the 2.6.12-rc kernel shows a fair number of synchronize_kernel() calls. The module loader uses it to let things calm down when an attempted load fails. The AT keyboard driver calls it at disconnect time to ensure that no processor is still trying to work with the device. The kernel profiling code uses synchronize_kernel() to ensure that all processors notice the unregistration of its timer hook. And so on.

The external uses of synchronize_kernel() have reached a point where they are putting extra demands on the RCU code. RCU, after all, does not really have to wait until every processor has scheduled; the important constraint, instead, is that every processor running within rcu_read_lock() exits from the critical section. This distinction has become more important as the kernel developers have sought ways to make RCU more compatible with the low-latency work.

So, as of 2.6.12-rc4, synchronize_kernel() will be officially deprecated. Its replacements will be synchronize_sched(), which retains the current "wait for all processors to schedule" semantics, and synchronize_rcu(), which is only guaranteed to wait until any processors executing within rcu_read_lock() critical sections have exited those sections. Most external users probably need to be switched over to synchronize_sched(). The comments suggest that a synchronize_irq() variant is also envisioned, but it has not been added as of this writing.

One other significant change: unlike synchronize_kernel(), the two replacements are exported GPL-only.

Comments (none posted)

Defending against fork bombs

Standard wisdom says that the proper defense against fork bomb attacks (where a simple script forks children until the system chokes under the load) is to use resource limits. Put a cap on the number of processes which can be created, and the problem goes away. In reality it's not quite so simple; the limit can be softened by logging in multiple times. And, in any case, some people feel that the system should not collapse when faced with such an attack. A Linux system, it is said, should not be so easy to bring down in its default configuration.

The last defense against fork bombs is typically the out-of-memory (OOM) killer. As the system fills up with processes, it will eventually run out of memory and, in its desperation, start looking for processes to kill. The OOM killer has a set of heuristics which attempt to choose the "best" process to kill. These rules help the system to avoid (sometimes) killing processes which are vital to the continued operation of the system. They are not particularly helpful in dealing with fork bombs, however.

Coywolf Qi Hunt has posted a patch which tries to do a better job of defending against fork bombs in the OOM killer. It works by extending the task structure to keep better track of a process's "biological" parent and children. These lists are maintained separately from the regular process hierarchy pointers, and are not actually used during normal system operation. They are, in other words, pure overhead most of the time.

Things change, however, when an out-of-memory situation hits. When the OOM killer starts up, it will select its first victim in the usual way. When a second process is chosen for an untimely death, however, the new lists come into play. For both the current and previous victim, the OOM killer will traverse the "biological parent" pointers to create a path through the process hierarchy. Using those paths, the code can select the "least common ancestor," the lowest process which is an ancestor to both victims. Then, rather than killing the second chosen victim directly, the OOM killer goes after the ancestor - and all of its children. If the OOM situation persists, the killer should be able to quickly work its way up the process hierarchy until it finds (and eliminates) the process responsible for the whole mess.

Coywolf has a set of test cases and a system he is willing to run them on; for all but the nastiest of the three, the patched system was able to put an end to the fork bomb attack without any ill effects beyond a temporary slowdown. In the worst case, the system still recovered, but with some collateral damage. The patch adds some significant overhead (one pointer and two list_head structures) to each process in the system, so it may encounter some resistance - most systems will pay that overhead, but never actually need to run the OOM killer. But, for systems which are exposed to that sort of attack, this patch could be a useful last line of defense.

Comments (2 posted)

The Philips webcam driver - again

The 2.6.12-rc kernels include, among many other things, the long-awaited return of the Philips web camera driver. This driver, remember, was removed at the original author's request; that author (known as "Nemosoft Unv") objected to the removal of a special-purpose hook which allowed a non-free decompression module to be loaded into the kernel. After the removal, Luc Saillard took over the driver, with the goal of getting it back into the mainline. As part of that process, he reverse engineered the image decompression code and included it in the GPL-licensed module. It would appear that this episode has led to a good result: the Philips driver is back, and more free than before.

Nemosoft has recently resurfaced, however, to make the claim that things may not be quite as good as they seem. According to Nemosoft, no real reverse engineering job was done. Instead:

Mr. Saillard has been silent on how he performed the reverse engineering task. A look at the code (example - pwc-kiara.c) is somewhat unenlightening - the decompression code consists mostly of a set of tables filled with mysterious numbers. It is hard to imagine how those tables could be created in any way other than extracting them from the binary decompressor module.

If the code was truly decompiled and relicensed, there could be a copyright issue here. On the other hand, the tables used for decompression will be hard to protect if they are truly the only way to interpret images produced by the camera. Alan Cox (who forwarded the PWC patches for merging) acknowledges that there could be an issue with the decompression code, but he is not overly worried about it:

Alan also points out an issue others have raised: by Nemosoft's admission, the non-disclosure agreement which forced the decompression code to be proprietary ran out some time ago. Nemosoft could thus resolve the licensing issues by simply releasing the decompression code under a free license.

Comments (3 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.6.12-rc3-mm1. (May 2, 2005)

• Andrew Morton: 2.6.12-rc3-mm2. (May 2, 2005)

• Greg KH: Linux 2.6.11.8. (April 30, 2005)

• Con Kolivas: 2.6.11-ck6. (May 2, 2005)

Core kernel code

• Benjamin LaHaise: unify semaphore implementations. (April 28, 2005)

• john stultz: new timeofday core subsystem (v A4). (April 30, 2005)

• john stultz: new timeofday vsyscall proof of concept (v A4). (April 30, 2005)

• Nishanth Aravamudan: new timeofday-based soft-timer subsystem. (April 30, 2005)

• Dinakar Guniguntala: Dynamic sched domains (v0.5). (May 2, 2005)

• Eric Piel: ARTiS, an asymmetric real-time scheduler. (May 3, 2005)

• Eric Piel: ARTiS, an asymmetric real-time scheduler. (May 3, 2005)

Development tools

• Tejun Heo: gitkdiff 0.1. (April 28, 2005)

• Paul Mackerras: Quick git command reference. (May 2, 2005)

• Matt Mackall: Mercurial v0.4c. (May 4, 2005)

• Matt Mackall: Mercurial v0.4d. (May 4, 2005)

Documentation

• Pavel Machek: kernel hacker's git howto. (April 28, 2005)

• Greg KH: kernel maintainer's HOWTO for quilt and -mm. (April 29, 2005)

Filesystems and block I/O

• Mingming Cao: Adding multiple block allocation to current ext3. (April 28, 2005)

• Robert Love: latest inotify.. (April 29, 2005)

• Robert Love: 2.6-mm inotify update. (May 3, 2005)

• Miklos Szeredi: [PATCH] unprivileged mount/umount. (May 3, 2005)

Memory management

• Christoph Lameter: Page Fault Scalability V20: Overview. (April 29, 2005)

• Christoph Lameter: Page Fault Scalability V20: Avoid spurious page faults. (April 29, 2005)

• Christoph Lameter: Page Fault Scalability V20: Avoid lock for anonymous write fault. (April 29, 2005)

• Christoph Lameter: Page Fault Scalability V20: Avoid first acquisition of lock. (April 29, 2005)

• Rik van Riel: non resident page management, #4. (April 29, 2005)

• David Gibson: Hugepage consolidation. (May 2, 2005)

• Rik van Riel: cleanup of use-once. (May 3, 2005)

• Mel Gorman: Avoiding external fragmentation with a placement policy Version 10. (May 3, 2005)

Networking

• Evgeniy Polyakov: : Asynchronous IPsec processing.. (May 2, 2005)

Architecture-specific

• Arnd Bergmann: ppc64: Introduce BPA platform. (April 28, 2005)

• Arnd Bergmann: ppc64: add BPA platform type. (April 28, 2005)

• Arnd Bergmann: ppc64: Add SPU file system. (April 28, 2005)

• Arnd Bergmann: ppc64: Add driver for BPA iommu. (April 28, 2005)

• Arnd Bergmann: ppc64: Add driver for BPA interrupt controllers. (April 28, 2005)

• john stultz: new timeofday arch specific hooks (v A4). (April 30, 2005)

• john stultz: [RFC][PATCH (3/4)] new timeofday arch specific timesource drivers (v A4). (April 30, 2005)

• Hyok S. Choi: release of the ARM MPU/noMMU support 2.6.11.8-hsc0. (May 3, 2005)

• Eric Piel: ARTiS, an asymmetric real-time scheduler - x86. (May 3, 2005)

• Eric Piel: ARTiS, an asymmetric real-time scheduler - IA-64. (May 3, 2005)

Security-related

• Kristian =?iso-8859-1?q?S=F8rensen?=: Umbrella is now feature complete! (v0.7 released). (April 28, 2005)

• Coywolf Qi Hunt: oom lca -- fork bombing killer v2.2. (May 3, 2005)

Miscellaneous

• Aneesh Kumar: OpenSSI 1.9.0 released. (April 28, 2005)

• Dave Kleikamp: jfsutils-1.1.8. (May 3, 2005)

• Erik van Konijnenburg: yaird 0.0.6, a mkinitrd based on hotplug concepts. (May 4, 2005)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Testing Kubuntu 5.04

Once you install Kubuntu on your desktop computer, it is easy to see why the Ubuntu project has been such a resounding success. A simple, text-based installation procedure, excellent hardware auto-detection and configuration, an intuitive desktop that most people will find easy-to-navigate, and a great support community. And although, in line with most other major distribution, setting up the playback of multimedia files or installing browser plugins requires extra effort, this has been made considerably easier - thanks to the excellent 60-page Unofficial Ubuntu Guide. The only complaint about the previous version of Ubuntu -- its strong preference for the GNOME desktop and brown colors -- has now also been addressed - by Kubuntu, an increasingly popular sub-project of Ubuntu Linux.

As the name suggests, Kubuntu is essentially Ubuntu for users who prefer KDE over GNOME. The developers created DEB packages of the latest version of KDE and built installation and live CDs for three architectures - i386, PPC and x86_64. We installed the i386 edition of Kubuntu 5.04 ("Hoary Hedgehog") on a test computer powered by a Pentium 4 1.4GHz processor and Intel 850 chipset with 384 MB of RAM and a Matrox Millennium G450 graphics card. The installation program, based on a recent Debian Sarge installer, was a straightforward affair requiring little human intervention. At the end of it, we found ourselves looking at a KDM login screen, and shortly afterward, at a KDE desktop with a cool blue wallpaper and desktop theme.

The first thing we normally do after installing a new distribution is to check for security updates. For package management, Kubuntu uses Kynaptic, a graphical front-end for apt-get, which comes pre-configured with sources pointing to Ubuntu's security and update servers. Kynaptic is obviously modeled on Synaptic, but despite its better integration with the KDE desktop, it fades in comparison with its better-known counterpart - it lacks a way to update the sources.list file from within its GUI and it also has some interface quirks, which usually indicate that the product has not quite reached the 1.0 status. Nevertheless, as a simple package management utility, it works fine and we were able to refresh the package information and upgrade a handful of packages that were listed as being already installed, but needed upgrades.

As Kubuntu comes on only one CD, it goes without saying that many useful packages have been omitted from the CD and are only available from Ubuntu's online repositories (Kubuntu does not have its own repository). We went on to create a more functional developer's workstation by installing software that we normally use around here, including Apache, BitTorrent, gFTP, GIMP, Java, PHP, Firefox, Quanta, and a number of other packages. This completed without a hitch. Since Kubuntu basically represents a subset of Ubuntu Linux, we decided to install a full GNOME desktop too, just to prove the concept. This can be done by selecting the "ubuntu-desktop" package from the list and the 200+ dependent packages are then selected automatically. The installation completed flawlessly and a new "GNOME" entry has appeared under the KDM's "Session Type" menu; however the GNOME desktop came up with an unpopulated default panel and without the usual desktop icons. Nevertheless, the concept worked and we were able to turn the Kubuntu installation into a full Kubuntu + Ubuntu desktop.

Usable as the default Kubuntu desktop is, some users will undoubtedly want more - notably some of the proprietary applications and multimedia codecs, but also some useful open source applications that are not in the official Ubuntu repositories. This is where the above-mentioned Unofficial Ubuntu Guide comes handy - it explains things in layman's terms and guides users through re-configuring sources.list and installing applications. We followed the instructions and installed and configured Java Runtime Environment, Macromedia Flash Plugin, Acrobat Reader, Skype, several multimedia codecs and DVD playback functionality, MPlayer and RealPlayer. With instructions about how to install non-Latin fonts and how to configure input method editors for inputting Asian character sets, international users are not neglected either. The guide also explains how to install several commercial applications, popular games, the NVIDIA driver, and drivers for certain winmodems. After less than an hour of following the instructions in the guide, we succeeded in turning a stock Kubuntu installation into a powerful and highly usable Linux workstation with just about everything a desktop user might need.

And this is when we suddenly realized why the Ubuntu project has been such an enormous success. It is not just the wealthy sponsor and the skilled Linux developers that produce quality software, it is also the existence of various sub-projects and community efforts (such as Kubuntu or the Unofficial User Guide) that have contributed a great deal towards its growing acceptance. Of course, there are many excellent distributions on the market. But to our knowledge, none of them can boast an existence of a comprehensive free manual that tells its users how to install, configure and use some of the useful non-free software and how to enhance their Linux operating system to get, in terms of usability, as close as possible to Mac OS or MS Windows. This guide, already translated into a number of languages, should be the first stop of any new Ubuntu/Kubuntu user.

Both Ubuntu and Kubuntu are impressive distributions that are deservedly becoming the leaders of the desktop Linux (of course, they can be used on servers too). In fact, it is very hard to find any fault with Hoary Hedgehog - it has a solid installer, hands-off hardware setup, and many little enhancements that makes computers so much more fun. Its community resources are hard to beat and it is still the only project that has produced both installation and live CDs for three architectures. If you haven't tried Ubuntu/Kubuntu, do yourself a favor and install it on a spare partition. Chances are that it will find a permanent home on your hard disk.

Comments (11 posted)

New Releases

Nimbus 4.0 for secure supercomputing

Linux Labs has announced the availability of Nimbus 4.0, a distribution aimed at secure supercomputing applications. Nimbus combines the bproc single system image patches with SELinux, and tosses in the cryptographic filesystem (CFS) as well. The distribution does not appear to be available for download, however.

Comments (none posted)

Progeny Debian 3.0 Developer Edition PR1 released

Progeny Componentized Linux has announced the release of Progeny Debian 3.0 Developer Edition PR1. "Progeny Debian 3.0 Developer Edition is an example distribution based on Componentized Linux. It is essentially a snapshot of Debian sarge as of April 2005 that includes an easy-to-use, graphical installer and a fully integrated GNOME desktop environment."

Comments (none posted)

Mandriva Linux LE2005 available for download

ISO images for Mandriva's Linux LE2005 release are now available for download; click below for the announcement, or go straight to the product page to find a download site.

Full Story (comments: 1)

CDMEDIC PACS WEB 6 Released (LinuxMedNews)

LinuxMedNews covers the release of version 6 of CDMEDIC, a live Linux CD with PACS WEB [Picture Archive and Communication System], medical spell checker and more.

Comments (none posted)

Distribution News

Debian Sarge freezes

Those awaiting a stable Debian Sarge release may be encouraged by the news that the release managers have declared a freeze. "Now to explain what, exactly, we mean by "freeze". The base freeze upload policy of uploading changes in through unstable if you can, and testing-proposed-updates if you must, has worked well (or so is the subjective opinion of the release team), so we plan to continue to apply the same policy for the freeze of the rest of the archive."

Full Story (comments: 18)

Debian Sarge release notes

There will be a Bug Squashing Party May 5 to May 8, 2005 to squish RC bugs, test woody->sarge upgrades, fix remaining security issues (especially non-RC ones), and more.

This update looks at the infrastructure and release status as of April 30, 2005.

Comments (none posted)

GNOME 2.10 LiveCD (GnomeDesktop)

Footnotes takes note that a live Linux CD showcasing GNOME 2.10 has been downloaded more than 50,000 times, and it is also available in Greek.

Comments (none posted)

Announcing the availability of Unofficial Ubuntu 5.04 Add-On CD

An unofficial add-on CD is available for Ubuntu 5.04, with lots of extra packages.

Full Story (comments: none)

Stateless Debian Project

The Stateless Debian Project is looking for active volunteers/developers. "Stateless Linux converts normal Linux desktop/clients to Stateless machines or appliances, which means if throw your computer out of window you still will be able to get exactly same same settings/data when you log from any other pc in the network ....A single administrator can easily manage network thousands of desktops ...Stateless Linux centralizes the state in a Gold server (different from CFengine) and rest of clients are updated regularly from it . This is different from thin clients as local processing power and memory of clients is used (or cached client)"

Full Story (comments: 2)

Debconf5 update

DebConf5 is coming up in July. This updates takes a look at the current sponsors, speakers and topics and more. "For people that want to hack together in a focused way, the location is available ahead of time. Note that it has proven to be of limited productivity to come and "just work on something" or "just help". You can read mail and browse the web at home. If you however work on a team (e.g. d-i, debian-edu, debian-cd, ...) you are very welcome: This is your opportunity for tight face-to-face cooperation and team work! Please let us know how many you are and when you want to come. The dorm is available for you from the 3rd. We will still be setting up the infrastructure, but basic net access will be there from the start."

Full Story (comments: none)

Distribution Newsletters

Debian Weekly News

The Debian Weekly News for May 3, 2005 is out with a look at the minutes of the leadership team meeting, some thoughts about dealing with PHP application design flaws, the Debian administration website, a Debconf update, and more.

Full Story (comments: none)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of May 2, 2005 is out. This edition covers some officially unofficial developer documentation, speed bumps on the way to OpenLDAP 2.2, ebuild cruft, headhunter spam, KDE-look.org migrates to a Gentoo Linux host, and several other topics.

Full Story (comments: none)

DistroWatch Weekly, Issue 98

The DistroWatch Weekly for May 2, 2005 is out. "If you are losing patience waiting for the ISO images of the new Mandriva Linux 2005, why not perform a network installation instead? It is easy and we'll show you how. Will will also address the issue of the never-ending stream of new distributions vying for our attention, and point out some serious problems with the latest release of the GCC compiler. In the biggest DistroWatch Weekly ever, we have a user-contributed review of the increasingly popular SLAX live CD, and present FetchYahoo in Robert Storey's "Tips, tricks & hints" section."

Comments (none posted)

Package updates

Fedora updates

Fedora Core 3 updates: wireless-tools-27-2.2.0.fc3 (fix iwlist command), spamassassin-3.0.3-3.fc3 (a bunch of bug fixes), gimp-2.2.6-0.fc3.2 (silence %post), bootparamd-0.17-19.FC3 (bug fixes), php-4.3.11-2.5 (fixes a compatibility issue), vte-0.11.13-1.fc3 (a whole bunch of upstream fixes), policycoreutils-1.18.1-2.12 (eliminate bogus error on upgrading policy), words-3.0-2.3 (sort with --dictionary-order and remove possessives), util-linux-2.12a-24.1 (bug fixes).

The i386 perl package was accidentally shipped with FC3 x86_64. This causes updates to clash and fail on FC3 x86_64 systems. To recover from this error use:

yum remove perl.i386

Comments (none posted)

Mandriva Linux updates

Mandriva Linux 10.2 (LE2005) updates: ldetect-lst (provides support for the XBook modem), rpmdrake (fixes a bug in the Software Media Manager), mdkonline (Mandriva domain name changes - also available for 10.0, 10.1, Corporate Server 3.0 and Multi Network Firewall 2.0).

Mandriva Linux Corporate Server 3.0 updates: lsb (provides corrected install_initd, remove_initd scripts).

Comments (none posted)

Slackware Linux updates

Click below for this week's slice of the Slackware change log. Upgraded packages include hdparm, Linux kernel 2.4.30, bind, getmail, gxine and more.

Full Story (comments: none)

Trustix Secure Linux updates

Trustix Secure Linux Bugfix Advisory #2005-0017 covers bug fixes in apache, bind, imagemagick, initscripts, kernel, libcap, libpcap, perl-convert-uulib, php, pptpd, proftpd, setup and squid.

Full Story (comments: none)

Distribution reviews

SuSE Linux Professional 9.3 (eWeek)

eWeek reviews SUSE Linux 9.3 Pro. "Novell Inc.'s SuSE Linux Professional 9.3 is an excellent general-purpose operating system. In fact, when it comes to combining leading-edge Linux and open-source software, Version 9.3 is the most polished and complete Linux distribution eWEEK Labs has tested."

Comments (none posted)

Mandriva LE--The Drake Flies South for the Future (LinuxPlanet)

LinuxPlanet reviews Mandriva Limited Edition. "Mandriva offers a nice, customized Control Center to enable you to customize your system's appearance, behavior, and configuration. It offers some truly cool features that I haven't seen in other control centers, such as the ability to set up an Uninterruptible Power Supply (UPS) for power monitoring and to define WebDAV mount points for accessing Web-based Distributed Authoring and Versioning sites as filesystems."

Comments (none posted)

First Look at a Distro Changed: Mandriva LE 2005 (MadPenguin)

MadPenguin reviews Mandriva Limited Edition 2005. "When everything is said and done and I've finally powered down the test system, I'd have to say that the Mandriva Limited Edition 2005 desktop was an all around good performer. Of all the applications I tested, none failed to open and the desktop was extremely responsive. The installation was simple enough for new users but had the capability of fine tuning for advanced users, boot time was good, device support was good for the systems I tested on (although it's high time we invested in some oddball systems to test on. Most of the hardware here is fairly standard and needs to be noted) and my overall opinion of this release is strong."

Comments (none posted)

Ututo-e, the 'only free distribution' (NewsForge)

NewsForge reviews the Ututo-e distribution. "Ututo-e is a Gentoo-based distribution developed in Argentina. Of all the x86 distributions listed on DistroWatch, Ututo-e is the only distribution endorsed by the Free Software Foundation (FSF). Since he first noticed Ututo-e while visiting Argentina last August, Richard Stallman has described it as "the only free GNU/Linux distro I know of" -- an endorsement that promises to boost its user base the way that John F. Kennedy's endorsement of the James Bond books boosted their sales."

Comments (16 posted)

My Workstation OS: VidaLinux (NewsForge)

NewsForge has this article about VidaLinux. "Many call VidaLinux a "simpler Gentoo." It uses many of Gentoo's features, such as the Portage software distribution system, but also manages to make it all seem less intimidating. For instance, it uses Red Hat's Anaconda installation system. Anaconda is a graphical interface, which many find easier than Gentoo's command-line installation. Vida's system components also come prebuilt and ready for installation, whereas Gentoo's installation requires everything to be built from the command line, which intimidates some people."

Comments (none posted)

Review: PCQuest Linux 2005 (NewsForge)

NewsForge reviews PCQuest Linux 2005. "Two of the most interesting installation options provided with PCQ Linux 2005 are Supercomputing and Grid Computing. PCQ Linux includes OSCAR (Open Source Cluster Application Resources) and some management utilities to help you set up your own backyard supercomputer, limited only by the number of machines you have. An article in the magazine covers the initial setup, hardware requirements, and network configuration."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Amuc - the Amsterdam Music Composer

Version 1.0 of Amuc, the Amsterdam Music Composer, was released by author Wouter Boeke in time for the 2005 Linux Audio Conference.

Amuc is described as: "a Linux application for composing and playing music". The online manual and screen shots page explains more about Amuc's capabilities:

Amuc uses graphical score entry windows for entry of a series of musical notes. Note pitches are displayed by vertical position on the score and time duration is displayed as line length. Synthesized waveforms include FM synthesis, variable frequency sine waves, random waveforms, pulse waveforms with chorus capabilities, and additive synthesis.

The scores form the basic compositional building blocks, there are capabilities for doing various editing processes to the notes grouped in a score. The scores can be combined to form the big score that represents the entire musical composition.

Scripting capabilities add a high-level control structure over the scores, they can be used to manipulate a variety of score parameters such as pitch, amplitude, and synthesis parameters.

Once a composition has been assembled, it is possible to play it in real-time, or save it as a wave (.wav) or MIDI (.mid) file. The composition itself is saved as a score file (.sco) and a script file (.scr). The tune can be modified as it is played by adjusting various parameters including tempo, volume, and a multitude of synthesizer parameters.

For an idea of how the software functions, see the example screen shot while listening to the matching dance.mp3 musical sample.

Comments (2 posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new versions of ZynAddSybFX, Ardour, the rtirq startup script, Libcddb, Libcdio, Vcdimager, Libdvdread, Dvdauthor, OpenEXR, LCMS, Cinepaint, and Libjackasyn.

Comments (none posted)

Backup Software

Dump/restore 0.4b40 released.

Version 0.4b40 of Dump/restore, an set of backup and restore tools, is out. "This release features a few bug fixes and support for ext2/ext3 extended attributes (EA)."

Full Story (comments: none)

Database Software

Daffodil Replicator v1.8 released (SourceForge)

Version 1.8 of Daffodil Replicator, a database replication application, is out with new features. "Daffodil Replicator project team announced the release of Daffodil Replicator v1.8 with new features like Scheduling, Debugging, Special Character handling, and Replication Process Monitoring. Daffodil Replicator is Open Source data synchronization software that ensures high availability of data in environments that make use of heterogeneous databases."

Comments (none posted)

Mail Software

Sendmail X

The Alpha 0 release of Sendmail X, a mail transfer agent, has been announced. "sendmail X is a modularized message transfer system consisting of five (or more) persistent processes, four of which are multi-threaded. A central queue manager controls SMTP servers and SMTP clients to receive and send e-mails, an address resolver provides lookups in various maps including DNS for mail routing, and a main control program starts the others processes and watches over their execution. The queue manager organizes the flow of messages through the system and provides measures to avoid overloading the local or remote systems by implementing a central control instance." The code has been released under the Sendmail Open Source License.

Comments (none posted)

Printing

CUPS tips

The CUPS site (Common Unix Printing System) has published a series of small articles with tips on customizing CUPS. The article topics include: Administrative Privileges From A Remote Location, What Printer Model Is A Printer Using?, Changing The Printing Prioity For A Queued Job, and How To Assign Printing Administration Capabilities To Users.

Comments (none posted)

Security

Two Factor Authentication on Linux / Mac / Windows

Mohit Muthanna has announced a new two-factor authentication system. "If anyone is interested, I am currently testing my new two-factor authentication system and am offering the service for free. It does not use keys, tags or other special hardware since it authenticates a user by calling them on their land / cell phone and requesting a PIN code."

Full Story (comments: 2)

Secure programming with the OpenSSL API, Part 2 (IBM developerWorks)

Kenneth Ballard presents part two of an IBM developerWorks series on secure programming. "Securing the handshake during a Secure Sockets Layer session (SSL) is vital, since almost all of the security involving the connection is set up inside the handshake. Learn how to secure the SSL handshake against a man in the middle (MITM) attack -- in which the intruding party masquerades as another, trusted source. This article also introduces the concept of digital certificates and how the OpenSSL API handles them."

Comments (none posted)

Web Site Development

IssueTrackerProduct 0.6.6 announced

Version 0.6.6 of IssueTrackerProduct, an issue tracker web application for Zope, has been announced. Here are the change notes: "17 new features and 16 bug fixes makes the 0.6.6 one of the most exciting releases since the semi-rewrite 0.6 release. This release is considered a Development release because of the number of new features. Most of the new features are rather minor and none breaks old versions. Many of them are relatively cosmetic. There are some quite important bug fixes that makes it worth upgrading if you feel affected".

Comments (none posted)

The REST of the Web (O'ReillyNet)

Jason R. Briggs writes about REST on O'Reilly. "REST, Representational State Transfer, is a collection of design principles that use simple, stateless HTTP for data transfer, without the method-call-like abstractions of RMI or SOAP. Jason R. Briggs shows how you can use this simple architecture, with Jython and Velocity, to develop nimble, loosely coupled web applications."

Comments (none posted)

A Day in the Life of #Apache (O'Reilly)

Rich Bowen explains Apache's RewriteMap on O'Reilly. "A huge number of the questions on #apache have to do with mod_rewrite. And, fairly frequently, I find myself thinking that the problem being discussed would be so much easier to solve if we could just write a Perl script to deal with it. Of course, you can, using the RewriteMap, but it's moderately hard to come by good examples of using this, either in the documentation, or elsewhere online. As some of you may know, I'm working on the documentation, and, hopefully, it will soon contain some good examples of using RewriteMap. But, until then, this article will serve to provide a simple, as well as a not-so-simple, example."

Comments (none posted)

Wiki 0.2.0 released (SourceForge)

Version 0.2.0 of the Wiki module for phpWebSite has been announced. New features include BBCode support, Extended character support, Image Upload, Page locks, and more.

Comments (none posted)

Miscellaneous

ClamAV Releases Version 0.84

Version 0.84 of ClamAV, an open-source anti-virus suite, is out. "The new version improves detection of JPEG (MS04-028) based exploits, introduces support for TNEF (Winmail.dat) files and new detection mechanisms. Various bugfixes and improvements have also been made."

Full Story (comments: none)

Desktop Applications

Audio Applications

ReZound 0.12.0 beta is out

Version 0.12.0 beta of ReZound, a graphical audio file editor, is available. "This release adds a few new major features and some overdue bug fixes." See the changes document for more information.

Comments (none posted)

CAD

Twenty-fourth release of PythonCAD now available

Release 24 of PythonCAD, a CAD package, is available. "The twenty-fourth release contains numerous improvements to the code used for constructing the user interface and the entity drawing routines. This release utilizes the GTK Action and ActionGroup classes for building and controlling the menubar and menus. Using these classes greatly simplifies and enhances the ability to manipulate the menu items, and these features are used extensively in this release. Many menu choices are now activated when the functionality they provide can be used, and deactivated when their use is not possible. More enhancements of this nature will be appearing in future releases. Another significant improvement is the refactoring of the entity drawing routines."

Full Story (comments: none)

Desktop Environments

GNOME Art (GnomeDesktop)

GnomeDesktop.org looks at GNOME Art. "The GNOME Art Collection written in ruby is a collection of tools for managing art from the art.gnome.org website. The first app, GNOME Art is a graphical frontend for art.gnome.org. Backgrounds and all themes can be downloaded and previewed. Backgrounds, icon themes and splash screens can be installed directly. GNOME Splash Screen Manager is an application for managing the splash screens of your GNOME desktop."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced this week:

• evolution-gconf-tools-0.1.1 (code improvements)
• evolution-gconf-tools-0.1.3 (- char support in hostnames)
• Glom 0.8.24 (new features and bug fixes)
• GStreamer 0.8.10 (bug fixes and translation work)
• Muine 0.8.3 (new features and bug fixes)
• Serpentine 0.5 (Gtk+ 2.6 support and and code clean up)

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week:

• digiKam 0.7.3-beta2 (new features)
• KMidimon 0.1 & KMetronome 0.5 (new and updated apps)
• KOffice 1.4-beta1 (new features and bug fixes) (read more)

Comments (none posted)

KDE CVS-Digest (KDE.News)

The April 29, 2005 edition of the KDE CVS-Digest is online, here's the content summary: "amaroK and Kexi support KNewStuff for database examples, Context Themes and amaroK scripts. amaroK adds support for Helix multimedia backend. Kmail filters now can be applied to messages from IMAP accounts. KWifiManager implements switch network from GUI feature."

Comments (none posted)

GUI Packages

FLTK Weekly Snapshots

The FLTK project has released the FLTK 2.0.x Weekly Snapshot and the FLTK 1.1.x Weekly Snapshot, both are dated April 29, 2005.

Comments (none posted)

Imaging Applications

Blender Development Digest

Issue #5 of the Blender Development Digest is online with the latest news about Blender 3D, a three dimensional content creation and animation suite. Thanks to Tom M.

Comments (none posted)

Medical Applications

Free Open Source ED Patient tracking software (LinuxMedNews)

LinuxMedNews introduces Free Ed, "A free emergency department patient tracking system. This is a tracking system similar to several commercial systems."

Comments (none posted)

Music Applications

Patchage 0.2.0 announced

Version 0.2.0 of Patchage, a modular patch bay for Jack audio and Alsa Midi, is out. "This release adds Alsa Midi patching support, and numerous bugfixes."

Full Story (comments: none)

wcnt 1.127 released

Release 1.127 of wcnt (Wav Composer Not Toilet), a not-real-time modular audio synthesis, sequencer, and sampler, is out. "This release has removed an enourmous amount of memory leaks, fixed several segmentation faults, and, other bug issues have been fixed. Validation of parameters is now updated, and working. Various re-codings have resulted in a slightly smaller executable."

Full Story (comments: none)

Office Suites

OpenOffice.org Newsletter

The April, 2005 edition of the OpenOffice.org Newsletter is online with the latest news about the OpenOffice.org office suite.

Full Story (comments: none)

Digital Photography

KimDaBa 2.1 Released

Version 2.1 of KimDaBa, a photo management application, has been released. Changes include a new data/status bar, thumbnail viewing changes, the ability to attach keyboard tokens to images for grouping purposes, and more.

Full Story (comments: none)

Web Browsers

Mozilla Links Newsletter

The April 28, 2005 edition of the Mozilla Links Newsletter is online. Read about the latest anti-phishing features that have been added to Firefox and Thunderbird.

Full Story (comments: none)

Miscellaneous

Krusader v1.60.0 - The Twin-Panel File Manager for Linux

The Krusader Krew has announced the latest stable release of Krusader v1.60.0. Krusader is fully integrated with the KDE Desktop Environment and operates reliably in all Linux graphical environments. "Krusader Version 1.60.0 is immediately available under the GNU General Public License and may be downloaded freely in a "ready to compile" package or in a variety of custom binaries for easy installation on most of the leading Linux distributions." See the Change Log for the complete list of new features, updates, and improvements.

Full Story (comments: 14)

Languages and Tools

C

GCC Newsletter

Issue #16 of the GCC Newsletter was published on May 2, 2005. "After an extensive pause, I will now attempt to hit at least the highest of the high spots of the GCC mailing list for the last few months. My intention is to mention at least briefly the events of each month from November 2004 through April 2005 in retrospect."

Comments (none posted)

Caml

Caml Weekly News

The Caml Weekly News for April 26 - May 3, 2005 is online with the latest Caml language discussions.

Full Story (comments: none)

Java

GNU Classpath 0.15 released

Version 0.15 of GNU Classpath, a set of essential libraries for java, has been released. Here are the change highlights: "Optimized nio and nio.charset packages plus io streams integration leading to large speedups in character stream performance. To complement this new framework a native iconv based charset provider was added. Better support for free swing metal and pluggable lafs. Some org.omg.CORBA support added. Better java.beans support for the Eclipse Visual Editor Project. Completely lock free ThreadLocal implementation added. More javax.swing.text support for RTF and HTML. More flexible runtime interfaces and build configuration options added."

Full Story (comments: none)

Generic Types, Part 1 (O'ReillyNet)

O'Reilly has published part one in a book excerpt series. "In part one of this two-part excerpt from Java in a Nutshell, 5th Edition author David Flanagan explores the basic use of generics in typesafe collections, and then delves into their more complex uses. In addition, he covers type parameter wildcards and bounded wildcards."

Comments (none posted)

Java theory and practice: Enable initialization atomicity (IBM developerWorks)

Brian Goetz looks at API design issues on IBM developerWorks. "Decisions made during API design can have an effect on the API's usability. In designing an API, you need to put yourself in your user's shoes, imagining how the API might be used, and try and make the common use cases convenient for the user. This month, columnist Brian Goetz discusses an API design technique, the self-return idiom, that can make life easier for users of your API in certain circumstances."

Comments (none posted)

Perl

This Week in Perl 6 (O'Reilly)

The April 20-26, 2005 edition of This Week in Perl 6 is online with new Perl 6 development news.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The May 3, 2005 edition of Dr. Dobb's Python-URL! is out with the week's Python language articles and resources.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The May 3, 2005 edition of Dr. Dobb's Tcl-URL! is out with the week's new Tcl/Tk articles.

Full Story (comments: none)

XML

Not Quite Restful (O'Reilly)

John E. Simpson explores the Google Maps project on O'Reilly. "In this month's XML Tourist column, we'll take a look at a couple of web "services" that aren't quite formally RESTful, but demonstrate REST-like and nonetheless useful behaviors."

Comments (none posted)

Forming Opinions, Part Two (O'Reilly)

Micah Dubinko continues an O'Reilly series on Web Forms 2.0 with part two. "To resume the discussion, we'll continue our look inside WF2 where we left off in section 2. One of my favorite parts of this section consists of all the little tweaks suggested to classic forms as we know them. Anyone who has worked with form-scripting has probably run into one of these limitations."

Comments (none posted)

Principles of XML design: When the order of XML elements matters (IBM developerWorks)

Uche Ogbuji writes about XML element ordering on IBM developerWorks. "When multiple XML elements occur within another element, does element order matter? Whether it's the order in which the parser reports elements to applications, or the question of whether or not to mandate specific order in schema patterns, things are not always as simple as they may seem. In this article, Uche Ogbuji covers design and processing considerations related to the order of XML elements."

Comments (none posted)

Managing XML data: Identify XML documents (IBM developerWorks)

Elliotte Rusty Harold works with XML identification issues on IBM developerWorks. "The name of an XML file does not have to end in .xml. In fact, an XML document doesn’t have to be in a file at all. It can be a database record, a piece of a file, a transitory stream of bytes in memory that’s never written to disk, or a combination of several different files. However, many XML documents do reside on hard disks and other fixed media. When they do, it’s useful to be able to identify them quickly. This article summarizes the common file extensions and MIME media types that are used for XML documents."

Comments (none posted)

IDEs

DrPython 3.10.13 Released

Version 3.10.13 of DrPython, an IDE for the Python language, is out. " This release fixes a critical bugfix in the file dialog (which caused the UI to freeze), adds major/critical bugfixes in indentation handling/autoindent, and includes an exact method for prompt sync, fixes in the drscript menu, support for numpad enter treated as enter, plus a few minor fixes and tweaks."

Comments (none posted)

Version Control

Git Traffic #1

Zack Brown has published the first issue of Git Traffic, a (lengthy) summary of discussions on the development of the git source code management system.

Comments (18 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Ubuntu Linux backer tackles collaboration (ZDNet.au)

ZDNet Australia looks at LaunchPad from Ubuntu Down Under. "The aim of the project -- called The Launchpad -- is to make it easier for Linux developers to find the latest enhancements to the operating system and its myriad packages, no matter which distribution they were contributed to. The effort encompasses distributed bug tracking, revision control, language translations and more."

Comments (none posted)

History of the Linux Kernel Archives (KernelTrap)

KernelTrap talks with Peter Anvin and others to provide a history of the Linux kernel archives. "Peter Anvin has been involved with Linux since nearly the beginning. When Linus Torvalds purchased his first computer on which he began writing the Linux kernel, the state-of-the art PC with 4 megabytes of RAM and running at 33 megahertz was too expensive for him to buy outright. Therefore, he financed much of the nearly $3,500 price, planning to pay it off over three years. Within a year as the Linux kernel began to evolve and a community of users formed, Peter organized an online collection that raised $3,000 and paid it off."

Comments (3 posted)

Trade Shows and Conferences

Proceedings of the 2005 Linux Audio Conference

The proceedings from the 2005 International Linux Audio Conference (held last month in Karlsruhe, Germany) have been posted; a quick look shows just how much is going on in the area of free audio software. Dave Phillips's "Where are we going?" paper (PDF format) is a good overview of the state of the art.

Comments (10 posted)

MusE at LAD 2005

The developers of the MusE MIDI/Audio sequencer have posted an account of a meeting they held at the 2005 Linux Audio Developer conference. "We have some good news for you! The first time nearly all MusE developers got together at the Linux Audio Developer conference. It took place at the "Zentrum für Kunst und Medien, short ZKM" in Karlsruhe, Germany. It was a nice meeting and we were discussing a lot about new features and implementation issues."

Comments (none posted)

Linuxfest Northwest 2005 in review (NewsForge)

News Forge is running a review of the recent Linuxfest Northwest conference. "If giving away T-shirts is an accurate way to estimate attendees, then at least 750 people made the trip to Linuxfest Northwest in Bellingham, Wash., last weekend. Linuxfest Northwest 2005 continued the conference's strong focus on highly technical presentations -- this is not a vendor-centric event."

Comments (none posted)

European Common Lisp Meeting Materials Online

Materials from the recent European Common Lisp Meeting are online. "The European Common Lisp Meeting took place in Amsterdam on April, 24 2005. The organizers are making available pictures, slides and videos of some of the talks at the event's web site."

Full Story (comments: none)

Companies

Novell hires top Samba programmer from HP (News.com)

News.com covers the hiring of Jeremy Allison by Novell. "Novell has hired Jeremy Allison, one of the core programmers behind a widely used open-source project called Samba. Allison previously worked for Hewlett-Packard. He said he made the switch because he believes that he can benefit from the experience Novell programmers have in the area of file servers. "These guys know a lot about file sharing," said Allison, who starts the new job on Thursday."

Comments (4 posted)

Linux Adoption

Defense Department signs Red Hat deal (News.com)

News.com reports that the US Department of Defense has renewed a major contract to use security software now sold by Red Hat. "The department's Defense Information Systems Agency agreed Monday to purchase subscriptions for Red Hat Certificate System software, Red Hat spokeswoman Leigh Day confirmed Friday. The deal renews support for software that was sold by America Online's Netscape Communications group until Red Hat acquired it in December." The DoD will also be switching its servers from Solaris to RHEL.

Comments (none posted)

Linux at Work

Linux Comes to Wall Street (eWeek)

eWeek looks at the use of Linux by Wall Street financial firms. "Long relegated to menial file and print server duties in most enterprises, Linux is now playing a mission-critical role in financial trading and other highly sensitive networks on Wall Street. The traction in the financial sector is part of broader Linux adoption growth, which is expected to continue through this year and next, according to Deborah Williams, an analyst at IDC, in Framingham, Mass. "On Wall Street, time is money, and for 2005 the buzzword is going to be latency. If you can speed things up and address that latency, you can make more money," Williams said."

Comments (3 posted)

Interviews

Mandriva (ex Mandrake) Linux Founder Gael Duval (LinuxQuestions.org)

LinuxQuestions.org interviews Mandriva's Gaël Duval. "LQ) There have been rumors that some Linux distributors, including Novell, may follow what Red Hat has done and have an Enterprise release and a "Community" release. Is this direction something that has been considered by Mandriva? GD) No. Mandriva Linux will still be distributed as both a download edition and commercial offers, with full official support for updates (bugfixes, security)."

Comments (8 posted)

Jakub Stachowski: Zeroconf Support in KDE (KDE.News)

KDE.News interviews Jakub Stachowski the man behind Zeroconf for KDE. "Zeroconf is a name used by IETF for several techniques that should allow you to setup and use a simple network with no need for any manual configuration. One of its parts, DNS-SD, is the service discovery protocol based on standard DNS. Rendezvous is just Apple's name for Zeroconf, this has recently been changed to Bonjour after a trademark dispute. It is trademarked so you will not find it anywhere in KDE code or documentation. SLP is another service discovery protocol used primarily by Novell. It has nothing to do with DNS-SD or Zeroconf."

Comments (none posted)

People Behind Perl: brian d foy (O'Reilly)

O'Reilly has posted an interview with Brian d Foy. "brian d foy is a longtime leader in the Perl community. Besides founding the Perl Mongers and being a trainer for Stonehenge Consulting Services, he founded and edits The Perl Review, a quarterly magazine for Perl users. If that weren't enough, he writes and contributes to several CPAN modules. Recently, Perl.com interviewed brian on his work and plans."

Comments (1 posted)

Resources

The Daemon, The GNU and the Penguin - Ch. 6 ~ by Dr. Peter H. Salus (Groklaw)

Groklaw has the next installment of Dr. Salus' history of free/open source software. "By and large, Unix users refer to "Sixth Edition" and "V6" interchangeably. At Bell Labs, there was a continually changing version of Unix running. Only when Doug McIlroy caused the first "UNIX PROGRAMMER'S MANUAL" to be written, did there appear to be a fixed form. So, the manuals were listed by "Edition," and the system referred to was the "Version."".

Comments (none posted)

The Second Commandment of system administration (NewsForge)

NewsForge takes a look at integrity checkers. "Each integrity checker is a little different, so do some research before deciding on one. There are many excellent integrity checking applications out there, but the one I recommend and prefer is called afick (Another File Integrity ChecKer). Afick offers several advantages over integrity checkers such as Tripwire and AIDE. The first and foremost difference is that afick is written in Perl, which gives it the advantage of speed. Afick finishes the initialization of the database that stores filesystem attributes almost a minute faster than AIDE. Being written in Perl also means that afick is highly portable between operating systems."

Comments (11 posted)

Rich Web Text Editing with Kupu (O'ReillyNet)

O'ReillyNet looks at Kupu. "Kupu is an open source application, written in JavaScript, that implements a flexible, full-featured HTML editor that runs in a web page without any special plugins. Its primary use is as an embedded editor in content management systems (CMS), like Zope or Plone, where it allows users to create their own web pages. Its design is flexible enough so that you can embed it into pretty much any web application without too much difficulty."

Comments (8 posted)

Making Packager-Friendly Software, Part 2 (O'ReillyNet)

O'ReillyNet continues making software that is easy to package, with a look at dependencies, configuration files and more. "Many packaging systems (including pkgsrc) let you build packages as a regular user and require only superuser privileges to install them (to have the right permissions, ownerships, setuid flags, and so on). Therefore, you should make sure that your program builds correctly without superuser privileges to ease the packaging task. I can't think of an example in which a program requires full privileges to build."

Comments (5 posted)

The ins and outs of USB (IBM developerWorks)

Peter Seebach discusses the USB standard on IBM developerWorks. The article is mostly presented from a Window/Mac perspective. "The USB specification may be an example of that hybrid de jure or de facto standard, one that clearly earned wide acceptance through its technical merit. Learn the history of the USB standard and some of its benefits to users and vendors, as well as where it missed the boat."

Comments (30 posted)

Reviews

Getting Flat, Part 2 (Linux Journal)

Doc Searls looks at The World is Flat: A Brief History of the Twenty-First Century, by Tom Friedman. "In Part 2, I want to examine the human origins of the open-source materials we're using to build this new world. And I want to start by distinguishing them from corporate origins. Again, this is not to diminish the importance of big-company contributions to the flat-world revolution but to subordinate them to the profound work being done by individuals and small groups."

Comments (3 posted)

Debian on Steroids III: Libranet 3.0 (Linux Journal)

The Linux Journal reviews Libranet 3.0. "The heavyweight classification I give this latest Libranet comes from its distribution size--five CDs or one DVD--and its comprehensive list of included applications. Although a number of Debian-based distributions are available at less or no cost, none include as many programs as Libranet 3.0 does. This is of primary interest to me and other Linux users who lack broadband or simply don't want to spend their time downloading packages in order to get the functionality we want."

Comments (4 posted)

Miscellaneous

Linus Torvalds' BitKeeper blunder (InfoWorld)

InfoWorld sounds off on the BitKeeper episode. "The business community likes to distance itself from the ideological debates surrounding free and open source software, but the BitKeeper case is a prime example of why enterprise IT management can't ignore software licensing issues. You don't want your PBX vendor telling you how to use your phone system, or your printer vendor telling you what to print. Wouldn't you prefer software that didn't tell you how to run your business either?" It's hard to imagine seeing such words in the mainstream press even a year or two ago.

Comments (51 posted)

Page editor: Forrest Cook

Announcements

Commercial announcements

Carrier Grade Linux news

MontaVista Software has announced the registration of MontaVista Linux Carrier Grade Edition (CGE) with both the Service Availability(TM) Forum (SA Forum) specifications and Open Source Development Lab (OSDL) Carrier Grade Linux requirements.

FSMLabs, Inc. has announced availability of Carrier Grade RTLinuxPro 2.2, a complete OSDL-registered Carrier Grade Linux implementation and development environment plus the hard real-time of FSMLabs RTCore real-time server.

Comments (none posted)

Globus Toolkit, Version 4.0 (GT4) Released to Open Source Grid Development Community

The Globus Consortium has announced the release of Globus Toolkit, version 4.0 (GT4). "GT4 is the most stable, "enterprise ready" version of the Globus Toolkit ever -- incorporating the latest web services standards, new security and authorization features, and the collaborative efforts of a global community of open source Grid developers." Download GT4.

Comments (none posted)

JBoss opens new office in India

JBoss, Inc. has announced the opening of a new office in Bangalore, India. "The expansion comes as the company scales to meet growing enterprise customer demand for the JBoss(R) Enterprise Middleware System (JEMS(TM)) in the Asia market. With this key office, JBoss can more effectively deliver services, including 24x7 production support and training, to customers."

Comments (none posted)

Linbox Rescue Server under GPL.

LinboxFAS has announced that the company will release the source code of its computer asset management software, the Linbox Rescue Server, under the terms of the GNU GPL. "The operation relies on the capitalization of software license sales. The goal of LinboxFAS is to open the source code of the software, as soon as the investments made around the product will have been amortized thanks to the selling of licenses."

Full Story (comments: 5)

Palamida offers license verification tool

Palamida, Inc. has announced general availability of IP AMPlifier 3.0 in the new market for automated software intellectual property (IP) management and compliance. ""The sheer volume of software code in use at the average enterprise company today creates a profound need for a solution that automates the process of software intellectual property detection and identification," said Mark Driver, vice president and research director, Gartner Inc. "The right solution will help companies establish a competitive advantage by accelerating the use of third-party components and open source software free from the inefficiencies of manual methods of software license and IP verification.""

Comments (6 posted)

TimeSys Introduces New Linux Development Kits

TimeSys has announced new Linux Development Kits for several Freescale (formerly Motorola) processor chips. "TimeSys(R) Corporation, a leader in embedded Linux(R) technologies and development tools, today introduced 2.6-based TimeStorm(R) Linux Development Kits (LDKs) for a wide range of Freescale PowerQUICC(TM) III, PowerQUICC II and PowerQUICC I integrated communications processors and MPC7XXX and MPC7XX high-performance PowerPC processors."

Full Story (comments: none)

Win4Lin Pro updated

Win4Lin has announced the immediate shipping of Win4Lin Pro 1.1, a major upgrade to the company's flagship product. New in the product is full support for Windows XP, file system integration and major performance upgrades.

Full Story (comments: 2)

New Books

O'Reilly's Releases The Art of Project Management

O'Reilly has published the book The Art of Project Management by Scott Berkun.

Full Story (comments: none)

"Digital Audio Essentials" Released by O'Reilly

O'Reilly has published the book Digital Audio Essentials by Bruce Fries and Marty Fries.

Full Story (comments: none)

Resources

(IN)SECURE Magazine 1.1

(IN)SECURE Magazine has released issue 1.1 in PDF format. Articles include Linux security - is it ready for the average user? and An introduction to securing Linux with Apache, ProFTPd & Samba, among other topics.

Comments (none posted)

Contests and Awards

2005 Readers' Choice Awards nominations being accepted (Linux Journal)

Linux Journal has announced that it is accepting nominations for the 2005 Readers' Choice Awards. "The nomination period closes on May 25, 2005. On May 27, we'll publish the ballot for the elimination round of voting. The categories receiving the most nominations and the top nominees in those categories will be on the ballot. Vote for your favorite in each of the categories and mail the ballot back to us. You will be able to do write-in votes at this stage."

Comments (none posted)

Upcoming Events

Dynamic Languages Symposium 2005

The Dynamic Languages Symposium 2005 will be held on October 18, 2005 in San Diego, California.

Comments (none posted)

AGNULA Libre Music at (L)eft Meeting

Some folks from the AGNULA audio distribution project will attend the (L)eft meeting. "The AGNULA project will attend the (L)eft Meeting, a two-days event that will take place in Bologna, Italy on May 7 and 8, 2005. During the meeting Andrea Glorioso will talk about the AGNULA Libre Music web portal, its history, goals and the next steps."

Full Story (comments: none)

Seattle OpenVistA R and D Meeting (LinuxMedNews)

LinuxMedNews has an announcement for the Seattle OpenVistA R & D Meeting, the event will take place from May 12-15, 2005.

Comments (none posted)

YAPC North America schedule is released (use Perl)

use Perl has announced the schedule for YAPC North America conference. The event will be held in Toronto, Ontario, Canada from June 27-29, 2005.

Comments (none posted)

Events: May 5 - June 30, 2005

Date	Event	Location
May 5 - 7, 2005	DallasCon 2005	(Richardson Hotel)Dallas, TX
May 5 - 6, 2005	CanSecWest/core05	Vancouver, B.C.
May 5, 2005	International PHP Conference	(RAI Conference Center)Amsterdam, the Netherlands
May 11 - 15, 2005	php|tropics 2005	(Moon Palace Resort)Cancun, Mexico
May 13 - 14, 2005	BSDCan 2005	(University of Ottawa)Ottawa, Canada
May 19 - 21, 2005	GUADEC-es 2005	A Coruña, Spain
May 22 - 25, 2005	Gelato Federation Meeting	(HP's Palo Alto and Cupertino campuses)San Jose, CA
May 23 - 26, 2005	PalmSource Worldwide Mobile Summit and DevCon	(Fairmont Hotel)San Jose, California
May 24 - 27, 2005	XTech 2005 Conference	(Amsterdam RAI Center)Amsterdam, the Netherlands
May 25 - 26, 2005	Linux World New York Summit 2005	(New York City Marriott Marquis)New York, NY
May 28 - 29, 2005	Linux Unix Group of Bulgaria Seminar	Stara Zagora, Bulgaria
May 29 - 31, 2005	GNOME Users and Developers European Conference(GUADEC 2005)	Stuttgart, Germany
June 1 - 3, 2005	The Red Hat Summit 2005	(Hilton New Orleans)New Orleans, LA
June 1 - 4, 2005	Fórum Internacional Software Livre(FISL)	Porto Alegre/RS, Brazil
June 9 - 10, 2005	Austrian Perl Workshop	(Kapsch CarrierCom)Vienna, Austria
June 9 - 10, 2005	The French Perl Workshop	(Faculté des Sciences de Luminy)Marseille, France
June 11, 2005	PHP West	Vancouver, BC, Canada
June 15 - 17, 2005	AstriCon Europe 2005	(Auditorium Madrid Hotel)Madrid, Spain
June 17 - 19, 2005	RECON 2005	Montreal, Quebec, Canada
June 19 - 22, 2005	International Lisp Conference 2005(ILC 2005)	(Stanford University)Palo Alto, CA
June 22 - 25, 2005	LinuxTag 2005	(Kongresszentrum)Karlsruhe, Germany
June 23 - 24, 2005	Italian Perl Workshop 2005	(University of Pisa)Pisa, Italy
June 25, 2005	LugRadio Live 2005	(Molyneux Stadium)Wolverhampton, UK
June 25, 2005	XML Prague 2005	Malá Strana, Prague, Czech Republic
June 27 - 29, 2005	Yet Another Perl Conference(YAPC::NA 2005)	(University of Toronto)Toronto, Ontario, Canada
June 29 - 30, 2005	Where 2.0 Conference	(Westin St. Francis Hotel)San Francisco, CA

Comments (none posted)

Mailing Lists

New open source free software healthcare mailing list (LinuxMedNews)

LinuxMedNews mentions the creation of a new Open Health email discussion list. "The purpose of this group is to discuss issues pertaining to the use of open source free software in health care settings."

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Linus Torvalds' BitKeeper blunder

From:		Bradley Chapman <kakadu-AT-gmail.com>
To:		neil_mcallister-AT-infoworld.com, letters-AT-infoworld.com
Subject:		Linus Torvalds' BitKeeper blunder
Date:		Wed, 4 May 2005 10:20:57 +0100
Cc:		letters-AT-lwn.net

Mr. McAllister,
 
After reading your short InfoWorld article* about Linus Torvalds'
so-called 'blunder' with regards to the termination of the free
BitKeeper client, I am curious as to why you chose the term 'blunder'.
If the removal of BitKeeper had caused the complete collapse of the
kernel development community, the term 'blunder' would have been
justified - however, it did not, and now the kernel is being developed
using git, a tool written by Linus in direct response to the loss of
BK.
 
Personally I don't feel that Linus fell for the free beer argument
when he chose to migrate to BitKeeper; I feel that he cast aside any
thoughts on ideology and chose to use it because it was the best tool
for the job, despite the criticisms of others who felt that
introducing closed-source software into such a critical role was
dangerous to the health of kernel development.
 
Now that the 'free beer' version of BitKeeper has been removed due to
the so-called reverse engineering done by Andrew Tridgell, Linus's
decision is better seen as a well-intentioned mistake, not as a
blunder. Your comments about the dangers of being forced to switch
gears due to software withdrawal are valid, but in this case the gear
switch was not as traumatic as it may have been for other software
projects - the creation of git is proof positive of that.
 
In my opinion, Linus Torvalds' choice to use BitKeeper was made
entirely for technical reasons, and therefore, at best could only be
considered a mistake after the fact.
 
Yours,
 
Bradley Chapman
 
* - http://www.infoworld.com/article/05/05/02/18OPopenent_1.html

Comments (12 posted)

Page editor: Jonathan Corbet