LWN.net Logo

LWN.net Weekly Edition for November 17, 2005

LiPS service

One might think that there are already enough industry bodies working on Linux in telephone applications. But, on November 14, a new group, called the "Linux Phone Standards Forum" (or "LiPS") announced its existence. According to the release:

The LiPS Forum will accelerate the adoption of Linux in fixed, mobile and converged devices by standardizing Linux-based services and APIs that most directly influence the development, deployment and interoperability of applications and user-level services.

In essence, LiPS wants to push toward the creation of a standard low-level phone platform which allows vendors to focus their efforts on the higher-level features which set their offerings apart. The appeal of this idea is not that hard to understand. As an operating system for telephones, Linux is hard to beat: it can be customized to taste, it is efficient, and it lacks per-unit royalty costs. In addition, mobile platforms have become powerful enough to run Linux, and many mobile applications are sufficiently demanding to require a complete operating system like Linux. On the other hand, Linux lacks the features specific to telephony which can be found in a proprietary platform like Symbian. By filling in that layer of telephony-specific features, LiPS hopes to create a competitive platform for future products.

LiPS will probably be successful in scheduling meetings, generating white papers, and cranking out press releases. But if LiPS truly wants to turn Linux into a platform it can rely upon in the future, its management may want to consider engaging openly with the development community; "cooperating with OSDL" is not sufficient in this regard. If LiPS sees itself as another proprietary, members-only consortium, it will cut itself off from much that the community can provide.

A good start would be to admit some community projects to the group. For example, since they claim to be trying to build platforms for telephony in general - not limited to mobile devices - the LiPS member companies might well benefit from having somebody from the Asterisk and Bayonne projects at the table.

Even better would be to work with the community directly. A look at the list of companies which have joined LiPS (ARM, Cellon, Esmertec, France Telecom/Orange, FSM Labs, Huawei, Jaluna, MIZI Research, MontaVista Software, Open-Plug and PalmSource) and the other companies which have been active in Linux-based telephones (Motorola, Haier, Nokia, NEC, Panasonic, Samsung, ...) has few intersections with the list of companies participating in Linux kernel development. If the LiPS members truly want to get the most out of Linux, they will be better off working with the development community and contributing back their improvements. The recent announcement by the Consumer Electronics Linux Forum that it had hired a Linux kernel developer is a step in the right direction, but it is only a beginning.

Finally, if LiPS truly wants to achieve world domination with Linux-based phones, it should give some thought to the creation of a user-hackable platform. A phone which can be extended to perform functions never envisioned by its creators will be a far more valuable device, and it should find a wider market. Unfortunately, the mobile phone market tends to be dominated by companies which behave like, well, telephone companies, with the result that even routine features (such as Bluetooth) can be locked down, and user-hackable devices are a rarity. When a device is fully locked down, it matters little to the user whether it is running Linux or something else altogether. If LiPS were sufficiently enlightened that it could go against the closed nature of the industry and specify the creation of Linux-based phones which have not had the natural freedom of Linux stripped out of them, it could be the start of something truly interesting.

Comments (10 posted)

Sony's rootkit: an update

For most companies, simply being caught installing rootkit-like software onto the systems of customers who simply thought they were playing a music CD would be bad enough. Certainly, since the Halloween disclosure that some SonyBMG discs install a rootkit (called "XCP") has been a source of grief for that company, and rightly so. It takes a truly expansive interpretation of the notion of "intellectual property rights" to believe that such rights allow the installation of malware on other peoples' computers. As this event - and those which have come after - have shown, however, SonyBMG appears to have learned little from the whole episode.

Just how little the company has learned can be heard on this NPR interview with SonyBMG manager Thomas Hesse. When asked about the rootkit, Mr. Hesse responded:

Most people, I think, don't even know what a rootkit is, so why should they care about it?

As the class-action suits begin to pile up, and as even Microsoft feels the need to create a Sonyware removal tool, maybe Mr. Hesse will eventually realize that people (who are rapidly learning what a rootkit is) do care.

SonyBMG has claimed that there is no "phone home" capability in this software. Unfortunately for the company, connections back home are relatively easy to detect. Some investigation quickly showed that SonyBMG's software does indeed make a connection back home when the CD is played. Nowhere has SonyBMG alerted its users to this behavior and the associated privacy problems.

For additional amusement, see the EULA which comes with the rootkit software.

SonyBMG has made an uninstaller available for those few users which are capable of understanding what a rootkit does and being upset by it. It turns out, however, that this uninstaller is worse than the original rootkit. Running the uninstaller opens a number of holes - which can be exploited via web pages - in the target system. So victims of SonyBMG's rootkit who care about the security of their systems are in a bind; there is currently no straightforward way to get that software off the system without compromising the system even further.

Yet another ironic twist is the possibility that Sony's rootkit includes some LGPL-licensed code, but does not comply with the license. If this were true (and there are some doubts on this point, though they seem to be getting smaller), the hypocrisy would be complete.

In response to all this, SonyBMG announced that it would "temporarily" stop making CDs with XCP on them. There was no apology, much less an offer to compensate people whose systems have been compromised. Neither was there a recall of the (apparently millions) of malware-infected discs which were still in the retail pipeline. Only on November 15 did SonyBMG finally give in, recall the outstanding XCP-infected CDs, and offer to replace discs in the hands of its customers. Said users are still waiting for the compensation offer, however.

It is also worth noting that Sony is still shipping CDs with Sunncomm's MediaMax DRM code on them. MediaMax may not be quite as bad as XCP, but it is still hostile software which, among other things, phones home.

In the end, SonyBMG appears to have been slapped down fairly hard for its actions. It would be a mistake to assume that this sort of incident will not happen again, however. The entertainment industry has managed to create such a strawman enemy out of "pirates" that any sort of response appears to be justified. In a world where these folks can dictate the design of radios and televisions, attempt to legalize online attacks against "pirates," and file lawsuits against children, the addition of malware to a music disc seems like a small thing. Until such a time as this industry stops seeing its own customers as enemies, it will fail to show those customers any respect.

Linux users should not expect much respect either. Efforts like the broadcast flag already threaten to make the creation of free television and radio receivers impossible. Beyond any doubt, the music industry looks forward to the day when even playing a song on a free system will be disallowed. As Linux users, we are not much impressed by the idea that, in order to play a music track, we must accept the installation of hostile software onto our systems. Unfortunately, we may yet see a day when that is the only choice we have.

(See also: the EFF's open letter to SonyBMG and the Sony timeline on BoingBoing).

Comments (56 posted)

FOSS.IN 2005

One would think that free software would be a natural for a country like India. With free software, a developing nation can take greater control of its infrastructure, avoid paying hard-currency licensing fees, and worry less about "pirates" creating difficulties with foreign companies and governments. When the country also has vast numbers of smart and highly-educated people, as India does, free software seems like an even better fit. There is no doubt that use of free software in India is growing, but the country has not always been strongly represented in the development community.

Things are clearly changing however, and one of the clearest signs of that change is the upcoming FOSS.IN conference, starting November 29 in Bangalore. This conference, now in its fifth year, expects some 3000 attendees, offers over 140 talks, 20 tutorials, and [foss.in poster] a growing list of BOF sessions. The list of speakers includes many Indian names, quite a few of which are known well beyond India. Other speakers, whose names might be more familiar to most LWN readers, include Andrew Cowie, Harald Welte, Alan Cox, Jeremy Zawodny, Brian Behlendorf, Dave Phillips, James Morris, Rasmus Lerdorf, and Danese Cooper. The talks cover a vast range of topics, including legal and advocacy issues, a strong education track, embedded systems, kernel hacking, security, and much more. FOSS.IN, in other words, is working toward being a world-class free software conference.

This conference is certainly taken seriously within India. The Visvesvaraya Technological University (the leading technical university in the state of Karnataka) has sent out a letter to over 100 engineering colleges asking them to urge their students to attend FOSS.IN. As it grows to become one of the largest technical free software events anywhere, FOSS.IN is increasingly going for world-wide respect.

That notwithstanding, the conference organizers have also consented to let LWN editor Jonathan Corbet speak at the event. This was an opportunity not to be turned down, and your editor is looking forward to attending and reporting from FOSS.IN (even if he's a little less enthusiastic about the 24-hour travel time each way). Look for the first reports in the December 1 Weekly Edition.

(The image shown above was taken from this very nice set of posters put together by Hari Krishnan).

Comments (none posted)

LWN Weekly comes out early next week

A reminder: the (U.S.) Thanksgiving holiday is next week. LWN's editors traditionally publish the Weekly Edition one day early on Thanksgiving week in order to be able to go join their families and eat enough food to last through the end of the year. We'll return to the regular schedule the following week.

Comments (2 posted)

Page editor: Jonathan Corbet

Security

Some trusted computing security modules

IBM has been pushing the use of the "trusted platform module" chip found in its laptops (and on other systems as well) for some time; see this report from OLS 2005 for a summary of the benefits they see from trusted computing. Now IBM's developers have posted a new set of security modules which make use of the TPM to lock down a system. The three modules are:

  • The simple Linux integrity model, or SLIM. This module associates two attributes with every process and every file: the integrity level and the privacy level. The integrity levels are "system," "user," and "untrusted." Any process may read or execute any file with an equal or higher integrity level (subject to the usual permissions). Read and execute access to lower-integrity files is also allowed, but, as a result, the process will, itself, be demoted to the lower level. Writing files with a higher integrity level is not allowed. The integrity levels thus implement a form of simple, automatic sandboxing; if a process touches untrusted resources, it also loses trust and has a lowered ability to change things elsewhere on the system. Network sockets, incidentally, are always considered to have an "untrusted" integrity level.

    The privacy level has four levels: public, user, user-sensitive, and system-sensitive. Processes can read files of equal or lower sensitivity. If, instead, a process reads a higher-sensitivity file, its own sensitivity level is raised to match. Writing lower-sensitivity files is not allowed. This "high watermark" mechanism is intended to prevent the leakage of secret data to less-trusted contexts.

  • The SLIM module, like SELinux, depends on the extended attributes of a file to make security decisions. But what if something is able to change those attributes? The extended verification module (EVM) is an attempt to keep that from happening. EVM creates its own extended attribute on each file which is an HMAC hash of the file's contents and attributes. If the file and the HMAC fail to match, EVM will deny access to the file.

    One might argue that EVM's hash is no less susceptible to tampering than the other attributes on the file. The difference is that EVM uses the hardware TPM module to sign the HMAC result. The TPM will only perform this operation if it is satisfied that the proper "secure boot" rituals have been followed, and that the integrity of the running system has not been compromised. Since the TPM key is specific to that particular chip, it is not possible to remove the drive and forge HMACs on a different system. If the trusted boot chain, starting with the BIOS, holds, there should be a high level of assurance that the system's files and their attributes have not been tampered with.

  • The third module is the integrity measurement architecture. LWN readers have seen IMA before, so that discussion will not be repeated. In short, IMA is a remote attestation feature which can provide a convincing proof that a system is running (only) well-known, trusted versions of approved software.

The IMA module was not well received when it was last posted. The developers hope that the largest objections have been addressed, and that the set of TPM-related modules as a whole can be considered, eventually, for merging. Before reaching that point, however, these modules have another obstacle to overcome: they rely on the ability to run multiple Linux security modules in a "stacked" mode. Stacked security modules have been a contentious issue for some time, and that capability has never been merged. The developers claim that the new modules will make the case for stacking, but that conversation has yet to take place.

Comments (none posted)

Brief items

Discontinued SUSE Linux Distribution: 9.0

SUSE has a reminder that no security updates will be available for SUSE Linux 9.0 after December 15, 2005. "As a consequence, the SUSE Linux 9.0 distribution directory on our ftp server ftp.suse.com has been moved from /pub/suse/i386/9.0/ to the /pub/suse/discontinued/ directory tree structure to free space on our mirror sites. The 9.0 directory in the update tree /pub/suse/i386/update/9.0 will follow, as soon as all updates have been published."

Full Story (comments: none)

New vulnerabilities

acidlab: SQL injection

Package(s):acidlab CVE #(s):CVE-2005-3325
Created:November 14, 2005 Updated:November 16, 2005
Description: Remco Verhoef has discovered a vulnerability in acidlab, Analysis Console for Intrusion Databases, and in acidbase, Basic Analysis and Security Engine, which can be exploited by malicious users to conduct SQL injection attacks.
Alerts:
Debian DSA-893-1 2005-11-14

Comments (none posted)

emacs: lisp execution vulnerability

Package(s):emacs CVE #(s):CAN-2003-1232
Created:November 10, 2005 Updated:November 16, 2005
Description: Version 21.2 of the EMACS editor has a vulnerability in which text files containing Lisp code can be executed without warning the user. Attackers can cause users to execute arbitrary code.
Alerts:
Mandriva MDKSA-2005:208 2005-11-09

Comments (none posted)

flash-plugin: buffer overflow

Package(s):flash-plugin CVE #(s):CVE-2005-2628
Created:November 10, 2005 Updated:November 25, 2005
Description: The Mozilla browser Macromedia Flash Player plug-in has a buffer overflow vulnerability. A user who opens a maliciously created Macromedia Flash file may be tricked into executing arbitrary code.
Alerts:
Gentoo 200511-21 2005-11-25
Red Hat RHSA-2005:835-00 2005-11-09

Comments (none posted)

ftpd: remote buffer overflow

Package(s):ftpd CVE #(s):CVE-2005-3524
Created:November 14, 2005 Updated:November 16, 2005
Description: A buffer overflow vulnerability has been found in the linux-ftpd-ssl package. A command that generates an excessively long response from the server may overrun a stack buffer. An attacker that has permission to create directories that are accessible via the FTP server could exploit this vulnerability. Successful exploitation would execute arbitrary code on the local machine with root privileges.
Alerts:
Debian DSA-896-1 2005-11-15
Gentoo 200511-11 2005-11-13

Comments (none posted)

gdk-pixbuf: multiple vulnerabilities

Package(s):gdk-pixbuf gtk2 CVE #(s):CVE-2005-3186 CVE-2005-2976 CVE-2005-2975
Created:November 15, 2005 Updated:March 20, 2006
Description: The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code when the file was opened by a victim.

Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code or crash when the file was opened by a victim.

Ludwig Nussel also discovered an infinite-loop denial of service bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to stop responding when the file was opened by a victim.

Alerts:
Fedora-Legacy FLSA:173274 2006-03-16
Debian DSA-913-1 2005-12-01
Debian DSA-911-1 2005-11-29
Trustix TSLSA-2005-0066 2005-11-18
Mandriva MDKSA-2005:214 2005-11-18
Ubuntu USN-216-1 2005-11-16
SuSE SUSE-SA:2005:065 2005-11-16
Gentoo 200511-14 2005-11-16
Fedora FEDORA-2005-1088 2005-11-15
Fedora FEDORA-2005-1087 2005-11-15
Fedora FEDORA-2005-1086 2005-11-15
Fedora FEDORA-2005-1085 2005-11-15
Red Hat RHSA-2005:811-01 2005-11-15
Red Hat RHSA-2005:810-01 2005-11-15

Comments (none posted)

lynx: arbitrary command execution

Package(s):lynx CVE #(s):CVE-2005-2929
Created:November 14, 2005 Updated:September 14, 2009
Description: An arbitrary command execute bug was found in the lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx.
Alerts:
Gentoo 200909-15 2009-09-12
Fedora-Legacy FLSA:152832 2005-12-17
OpenPKG OpenPKG-SA-2005.026 2005-12-03
Fedora FEDORA-2005-1079 2005-11-14
Fedora FEDORA-2005-1078 2005-11-14
Gentoo 200511-09 2005-11-13
Mandriva MDKSA-2005:211 2005-11-12
Red Hat RHSA-2005:839-01 2005-11-11

Comments (none posted)

phpsysinfo: programming errors

Package(s):phpsysinfo CVE #(s):CVE-2005-3347 CVE-2005-3348
Created:November 15, 2005 Updated:November 23, 2005
Description: Christopher Kunz discovered that local variables get overwritten unconditionally and are trusted later, which could lead to the inclusion of arbitrary files. Christopher Kunz also discovered that user-supplied input is used unsanitized, causing a HTTP Response splitting problem.
Alerts:
Gentoo 200511-18 2005-11-22
Debian DSA-898-1 2005-11-17
Mandriva MDKSA-2005:212 2005-11-16
Debian DSA-897-1 2005-11-15

Comments (none posted)

RAR: format string and buffer overflow

Package(s):rar CVE #(s):
Created:November 14, 2005 Updated:November 16, 2005
Description: Tan Chew Keong reported two vulnerabilities in RAR: a format string error exists when displaying a diagnostic error message that informs the user of an invalid filename in an UUE/XXE encoded file and some boundary errors in the processing of malicious ACE archives can be exploited to cause a buffer overflow.
Alerts:
Gentoo 200511-10 2005-11-13

Comments (none posted)

scorched3d: multiple vulnerabilities

Package(s):scorched3d CVE #(s):
Created:November 15, 2005 Updated:August 11, 2006
Description: Luigi Auriemma discovered multiple flaws in the Scorched 3D game server, including a format string vulnerability and several buffer overflows. A remote attacker could exploit these vulnerabilities to crash a game server or execute arbitrary code with the rights of the game server user.
Alerts:
Gentoo 200511-12:03 2005-11-15
Gentoo 200511-12 2005-11-15

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):a2ps CVE #(s):CAN-2004-1170 CAN-2004-1377
Created:November 26, 2004 Updated:December 19, 2005
Description: The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:
Fedora-Legacy FLSA:152870 2005-12-17
Mandriva MDKSA-2005:097 2005-06-07
OpenPKG OpenPKG-SA-2005.003 2005-01-17
Gentoo 200501-02 2005-01-04
Debian DSA-612-1 2004-12-20
Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

abiword: buffer overflow

Package(s):abiword CVE #(s):CAN-2005-2964
Created:September 29, 2005 Updated:November 14, 2005
Description: The RTF import module of the AbiWord word processor has a buffer overflow vulnerability. A user can be tricked into opening a maliciously crafted RTF file, giving the attacker the ability to execute code with the permissions of the user.
Alerts:
Debian DSA-894-1 2005-11-14
Gentoo 200510-17 2005-10-20
Ubuntu USN-203-1 2005-10-13
Fedora FEDORA-2005-955 2005-09-30
Gentoo 200509-20 2005-09-30
Ubuntu USN-188-1 2005-09-29

Comments (none posted)

apache information disclosure if modssl=yes

Package(s):apache CVE #(s):CAN-2005-2700
Created:September 2, 2005 Updated:November 10, 2005
Description: An information disclosure vulnerability was discovered in mod_ssl, the SSL/TLS module of the Apache webserver. When "SSLVerifyClient optional" was configured in the global virtual host configuration, an "SSLVerifyClient require" in per-location context was not enforced.
Alerts:
Fedora-Legacy FLSA:166941 2005-11-09
Gentoo 200509-12 2005-09-19
SuSE SUSE-SA:2005:052 2005-09-12
Red Hat RHSA-2005:773-01 2005-09-15
Slackware SSA:2005-251-03 2005-09-14
Debian DSA-807-1 2005-09-12
Slackware SSA:2005-251-02 2005-09-09
Fedora FEDORA-2005-849 2005-09-07
Mandriva MDKSA-2005:161 2005-09-08
Fedora FEDORA-2005-848 2005-09-07
Debian DSA-805-1 2005-09-08
Ubuntu USN-177-1 2005-09-07
Red Hat RHSA-2005:608-01 2005-09-06
OpenPKG OpenPKG-SA-2005.017 2005-09-02

Comments (none posted)

awstats: command injection vulnerability

Package(s):awstats CVE #(s):CAN-2005-1527
Created:August 11, 2005 Updated:November 10, 2005
Description: AWStats has a command injection vulnerability that can be exploited by specially crafting referrer URLs that contain Perl code. The code can then be executed with the privileges of the web server.
Alerts:
Debian DSA-892-1 2005-11-10
Gentoo 200508-07 2005-08-16
Ubuntu USN-167-1 2005-08-11

Comments (2 posted)

bzip2: race condition and infinite loop

Package(s):bzip2 CVE #(s):CAN-2005-0953 CAN-2005-1260
Created:May 17, 2005 Updated:January 10, 2007
Description: A race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. Also specially crafted bzip2 archives may cause an infinite loop in the decompressor.
Alerts:
rPath rPSA-2007-0004-1 2007-01-09
Debian DSA-741-1 2005-07-07
Red Hat RHSA-2005:474-01 2005-06-16
OpenPKG OpenPKG-SA-2005.008 2005-06-10
SuSE SUSE-SR:2005:015 2005-06-07
Debian DSA-730-1 2005-05-27
Mandriva MDKSA-2005:091 2005-05-18
Ubuntu USN-127-1 2005-05-17

Comments (2 posted)

chmlib: several vulnerabilities

Package(s):chmlib CVE #(s):CVE-2005-2659 CVE-2005-2930 CVE-2005-3318
Created:November 7, 2005 Updated:November 28, 2005
Description: Several vulnerabilities have been discovered in chmlib, a library for dealing with CHM format files.
Alerts:
Gentoo 200511-23 2005-11-28
Debian DSA-886-1 2005-11-07

Comments (none posted)

clamav: multiple vulnerabilities

Package(s):clamav CVE #(s):CVE-2005-3239 CVE-2005-3500 CVE-2005-3501 CVE-2005-3303
Created:November 7, 2005 Updated:November 9, 2005
Description: Multiple security holes were found in clamav that may allow attackers to cause a denial of service, memory corruption and execution of arbitrary code.
Alerts:
Mandriva MDKSA-2005:205 2005-11-07
Debian DSA-887-1 2005-11-07
Gentoo 200511-04 2005-11-06
Debian-Testing DTSA-21-1 2005-11-03

Comments (none posted)

common-lisp-controller: design error

Package(s):common-lisp-controller CVE #(s):CAN-2005-2657
Created:September 14, 2005 Updated:November 21, 2005
Description: François-René Rideau discovered a bug in common-lisp-controller, a Common Lisp source and compiler manager, that allows a local user to compile malicious code into a cache directory which is executed by another user if that user has not used Common Lisp before.
Alerts:
Debian DSA-811-2 2005-11-21
Debian DSA-811-1 2005-09-14

Comments (none posted)

cpio: directory traversal

Package(s):cpio CVE #(s):CAN-2005-1111
Created:June 20, 2005 Updated:December 26, 2005
Description: There is a vulnerability in cpio (2.6 and previous) that allows a malicious cpio file to extract to an arbitrary directory of the attackers choice. cpio will extract to the path specified in the cpio file, this path can be absolute.
Alerts:
Mandriva MDKSA-2005:237 2005-12-23
Red Hat RHSA-2005:806-01 2005-11-10
Debian DSA-846-1 2005-10-07
Ubuntu USN-189-1 2005-09-29
Red Hat RHSA-2005:378-01 2005-07-21
Mandriva MDKSA-2005:116-1 2005-07-19
Mandriva MDKSA-2005:116 2005-07-11
Trustix TSLSA-2005-0030 2005-06-24
Gentoo 200506-16 2005-06-20

Comments (1 posted)

cyrus-imapd: buffer overflows

Package(s):cyrus-imapd CVE #(s):CAN-2005-0546
Created:February 23, 2005 Updated:April 10, 2006
Description: Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system.
Alerts:
Fedora-Legacy FLSA:156290 2006-04-04
Red Hat RHSA-2005:408-01 2005-05-17
Fedora FEDORA-2005-339 2005-04-27
OpenPKG OpenPKG-SA-2005.005 2005-04-05
Conectiva CLA-2005:937 2005-03-17
Mandrake MDKSA-2005:051 2005-03-04
Ubuntu USN-87-1 2005-02-28
SuSE SUSE-SA:2005:009 2005-02-24
Gentoo 200502-29 2005-02-23

Comments (none posted)

dia: missing input sanitizing

Package(s):dia CVE #(s):CAN-2005-2966
Created:October 4, 2005 Updated:April 6, 2006
Description: Joxean Koret discovered that the SVG import plugin did not properly sanitize data read from an SVG file. By tricking an user into opening a specially crafted SVG file, an attacker could exploit this to execute arbitrary code with the privileges of the user.
Alerts:
Debian DSA-1025-1 2006-04-06
Mandriva MDKSA-2005:187 2005-10-20
Gentoo 200510-06 2005-10-06
Debian DSA-847-1 2005-10-08
SuSE SUSE-SR:2005:022 2005-10-07
Ubuntu USN-193-1 2005-10-04

Comments (none posted)

elm: buffer overflow

Package(s):elm CVE #(s):CAN-2005-2665
Created:August 23, 2005 Updated:November 11, 2005
Description: A buffer overflow flaw in Elm was discovered that was triggered by viewing a mailbox containing a message with a carefully crafted 'Expires' header. An attacker could create a malicious message that would execute arbitrary code with the privileges of the user who received it.
Alerts:
Slackware SSA:2005-311-01 2005-11-08
Red Hat RHSA-2005:755-01 2005-08-23

Comments (none posted)

emacs21: format string vulnerability in "movemail"

Package(s):emacs21 CVE #(s):CAN-2005-0100
Created:February 7, 2005 Updated:May 15, 2006
Description: Max Vozeler discovered a format string vulnerability in the "movemail" utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the user and the "mail" group.
Alerts:
Fedora-Legacy FLSA:152898 2006-05-12
Debian DSA-685-1 2005-02-17
Mandrake MDKSA-2005:038 2005-02-15
Gentoo 200502-20 2005-02-15
Fedora FEDORA-2005-146 2005-02-14
Fedora FEDORA-2005-145 2005-02-14
Red Hat RHSA-2005:133-01 2005-02-15
Red Hat RHSA-2005:110-01 2005-02-15
Red Hat RHSA-2005:134-01 2005-02-10
Red Hat RHSA-2005:112-01 2005-02-10
Fedora FEDORA-2005-116 2005-02-08
Fedora FEDORA-2005-115 2005-02-08
Debian DSA-671-1 2005-02-08
Debian DSA-670-1 2005-02-08
Ubuntu USN-76-1 2005-02-07

Comments (none posted)

enigmail: information disclosure

Package(s):enigmail CVE #(s):CVE-2005-3256
Created:October 20, 2005 Updated:December 13, 2005
Description: The key selection dialog from the Mozilla Thunderbird enigmail plugin has an information disclosure vulnerability. A key with an empty user id from a user's keyring will be used by default, allowing a message to be decrypted. This can lead to an unauthorized information disclosure.
Alerts:
Mandriva MDKSA-2005:226 2005-12-12
Debian DSA-889-1 2005-11-08
Ubuntu USN-211-1 2005-10-20

Comments (none posted)

enscript: arbitrary code execution

Package(s):enscript CVE #(s):CAN-2004-1184 CAN-2004-1185 CAN-2004-1186
Created:January 21, 2005 Updated:May 27, 2006
Description: Erik Sjölund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. Unsanitized input can cause the execution of arbitrary commands via EPSF pipe support. Due to missing sanitizing of filenames it is possible that a specially crafted filename can cause arbitrary commands to be executed. Multiple buffer overflows can cause the program to crash.
Alerts:
rPath rPSA-2006-0083-1 2006-05-26
Fedora-Legacy FLSA:152892 2005-12-17
Red Hat RHSA-2005:040-01 2005-02-15
Mandrake MDKSA-2005:033 2005-02-10
Gentoo 200502-03 2005-02-02
Red Hat RHSA-2005:039-01 2005-02-01
Fedora FEDORA-2005-096 2005-01-31
Fedora FEDORA-2005-092 2005-01-28
Fedora FEDORA-2005-091 2005-01-28
Fedora FEDORA-2005-016 2005-01-26
Fedora FEDORA-2005-015 2005-01-26
Ubuntu USN-68-1 2005-01-24
Debian DSA-654-1 2005-01-21

Comments (none posted)

ethereal: multiple vulnerabilities

Package(s):ethereal CVE #(s):CVE-2005-3241 CVE-2005-3242 CVE-2005-3243 CVE-2005-3244 CVE-2005-3245 CVE-2005-3246 CVE-2005-3247 CVE-2005-3248 CVE-2005-3249 CVE-2005-3184
Created:October 25, 2005 Updated:January 10, 2006
Description: A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:152922 2006-01-09
Mandriva MDKSA-2005:193-2 2005-10-31
Gentoo 200510-25 2005-10-30
Mandriva MDKSA-2005:193-1 2005-10-26
Mandriva MDKSA-2005:193 2005-10-25
Red Hat RHSA-2005:809-01 2005-10-25

Comments (none posted)

evolution: format string issues

Package(s):evolution CVE #(s):CAN-2005-2549 CAN-2005-2550
Created:August 15, 2005 Updated:March 23, 2006
Description: Evolution has format string issues. SITIC advisory SA05-001 contains more information.
Alerts:
Debian DSA-1016-1 2006-03-23
SuSE SUSE-SA:2005:054 2005-09-16
Red Hat RHSA-2005:267-01 2005-08-29
Gentoo 200508-12 2005-08-23
Mandriva MDKSA-2005:141 2005-08-17
Fedora FEDORA-2005-742 2005-08-11
Fedora FEDORA-2005-743 2005-08-11

Comments (2 posted)

fetchmailconf: insecure file creation

Package(s):fetchmail CVE #(s):CVE-2005-3088
Created:October 26, 2005 Updated:November 22, 2005
Description: The fetchmailconf utility can create files which are world-readable for a brief period. These files may contain passwords, and thus should not be created in this manner.
Alerts:
Debian DSA-900-3 2005-11-22
Debian DSA-900-2 2005-11-21
Debian DSA-900-1 2005-11-18
Mandriva MDKSA-2005:209 2005-11-09
Ubuntu USN-215-1 2005-11-07
Gentoo 200511-06 2005-11-06
Red Hat RHSA-2005:823-01 2005-10-26

Comments (none posted)

firefox: multiple vulnerabilities

Package(s):firefox CVE #(s):CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704 CAN-2005-2705 CAN-2005-2706 CAN-2005-2707 CAN-2005-2968
Created:September 22, 2005 Updated:February 15, 2006
Description: The Firefox browser has multiple vulnerabilities including problems with XBM image file processing, Unicode sequence processing, XMLHttp requests, malicious XBL binding, a JavaScript engine buffer overflow, about: pages, opening of new windows, and command line URL processing.
Alerts:
Slackware SSA:2006-045-02 2006-02-15
Fedora-Legacy FLSA:168375 2006-01-09
Ubuntu USN-200-1 2005-10-11
Ubuntu USN-155-3 2005-10-04
Debian DSA-838-1 2005-10-02
Gentoo GLSA 200509-11:02 2005-09-18
SuSE SUSE-SA:2005:058 2005-09-30
Mandriva MDKSA-2005:170 2005-09-26
Mandriva MDKSA-2005:169 2005-09-26
Slackware SSA:2005-269-01 2005-09-26
Fedora FEDORA-2005-934 2005-09-26
Fedora FEDORA-2005-933 2005-09-26
Fedora FEDORA-2005-932 2005-09-26
Fedora FEDORA-2005-931 2005-09-26
Fedora FEDORA-2005-930 2005-09-26
Fedora FEDORA-2005-929 2005-09-26
Fedora FEDORA-2005-928 2005-09-26
Fedora FEDORA-2005-927 2005-09-26
Fedora FEDORA-2005-926 2005-09-26
Ubuntu USN-186-2 2005-09-25
Ubuntu USN-186-1 2005-09-23
Red Hat RHSA-2005:789-01 2005-09-22
Red Hat RHSA-2005:785-01 2005-09-22

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):foomatic CVE #(s):CAN-2004-0801
Created:September 20, 2004 Updated:May 31, 2006
Description: There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:
SuSE SUSE-SA:2006:026 2006-05-30
Fedora-Legacy FLSA:2076 2004-11-05
Conectiva CLA-2004:880 2004-10-27
Fedora FEDORA-2004-303 2004-09-21
Gentoo 200409-24 2004-09-20

Comments (none posted)

gaim: buffer overflow

Package(s):gaim CVE #(s):CAN-2005-2103
Created:August 10, 2005 Updated:February 27, 2006
Description: Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:158543 2006-02-25
Slackware SSA:2005-242-03 2005-08-31
Fedora FEDORA-2005-751 2005-08-17
Fedora FEDORA-2005-750 2005-08-17
Mandriva MDKSA-2005:139 2005-08-15
Gentoo 200508-06 2005-08-15
Ubuntu USN-168-1 2005-08-12
Red Hat RHSA-2005:589-01 2005-08-09

Comments (none posted)

gdb: multiple vulnerabilities

Package(s):gdb CVE #(s):CAN-2005-1704 CAN-2005-1705
Created:May 20, 2005 Updated:August 11, 2006
Description: Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer overflow in the BFD library, resulting in a heap overflow. A review also showed that by default, gdb insecurely sources initialization files from the working directory. Successful exploitation would result in the execution of arbitrary code on loading a specially crafted object file or the execution of arbitrary commands.
Alerts:
Red Hat RHSA-2006:0354-01 2006-08-10
Red Hat RHSA-2006:0368-01 2006-07-20
Mandriva MDKSA-2005:215 2005-11-23
Fedora FEDORA-2005-1033 2005-10-27
Fedora FEDORA-2005-1032 2005-10-27
Red Hat RHSA-2005:801-01 2005-10-18
Red Hat RHSA-2005:763-01 2005-10-11
Red Hat RHSA-2005:709-01 2005-10-05
Red Hat RHSA-2005:673-01 2005-10-05
Red Hat RHSA-2005:659-01 2005-09-28
Fedora FEDORA-2005-498 2005-06-29
Fedora FEDORA-2005-497 2005-06-29
Gentoo 200506-01 2005-06-01
Trustix TSLSA-2005-0025 2005-05-31
Mandriva MDKSA-2005:095 2005-05-30
Ubuntu USN-136-2 2005-05-27
Ubuntu USN-136-1 2005-05-27
Ubuntu USN-135-1 2005-05-27
Gentoo 200505-15 2005-05-20

Comments (5 posted)

gtk-pixbuf, gtk2: denial of service

Package(s):gdk-pixbuf gtk2 CVE #(s):CAN-2005-0891
Created:March 30, 2005 Updated:December 19, 2005
Description: The BMP image processing code in gdk-pixbuf and gtk2 contains a denial of service vulnerability exploitable via a specially crafted image file.
Alerts:
Fedora-Legacy FLSA:155510 2005-12-17
Fedora-Legacy FLSA:154272 2005-07-15
SuSE SUSE-SR:2005:010 2005-04-08
Mandrake MDKSA-2005:069 2005-04-07
Mandrake MDKSA-2005:068 2005-04-07
Ubuntu USN-108-1 2005-04-05
Red Hat RHSA-2005:343-01 2005-04-05
Red Hat RHSA-2005:344-01 2005-04-01
Fedora FEDORA-2005-268 2005-03-30
Fedora FEDORA-2005-267 2005-03-30
Fedora FEDORA-2005-266 2005-03-30
Fedora FEDORA-2005-265 2005-03-30

Comments (none posted)

gedit: format string vulnerability

Package(s):gedit CVE #(s):CAN-2005-1686
Created:June 9, 2005 Updated:February 5, 2009
Description: A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.
Alerts:
Fedora FEDORA-2009-1189 2009-01-29
Fedora FEDORA-2009-1187 2009-01-29
Debian DSA-753-1 2005-07-12
Mandriva MDKSA-2005:102 2005-06-15
Red Hat RHSA-2005:499-01 2005-06-13
Gentoo 200506-09 2005-06-11
Ubuntu USN-138-1 2005-06-09

Comments (1 posted)

gettext: Insecure temporary file handling

Package(s):gettext CVE #(s):CAN-2004-0966
Created:October 11, 2004 Updated:March 1, 2006
Description: gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:
Mandriva MDKSA-2006:051 2006-02-28
Fedora-Legacy FLSA:136323 2006-01-09
Gentoo 200410-10:02 2004-10-10
OpenPKG OpenPKG-SA-2004.055 2004-12-23
Ubuntu USN-5-1 2004-10-27
Gentoo 200410-10 2004-10-10

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):glibc CVE #(s):CAN-2004-0968
Created:October 21, 2004 Updated:November 14, 2005
Description: The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:
Fedora-Legacy FLSA:152848 2005-11-13
Red Hat RHSA-2005:261-01 2005-04-28
Debian DSA-636-1 2005-01-12
Mandrake MDKSA-2004:159 2004-12-29
Red Hat RHSA-2004:586-01 2004-12-20
Fedora FEDORA-2004-356 2004-11-11
Ubuntu USN-4-1 2004-10-27
Gentoo 200410-19 2004-10-21

Comments (none posted)

gpsdrive: format string vulnerability

Package(s):gpsdrive CVE #(s):CVE-2005-3523
Created:November 9, 2005 Updated:November 9, 2005
Description: The gpsdrive navigation system contains a format string vulnerability which could be exploited to execute arbitrary code.
Alerts:
Debian DSA-891-1 2005-11-09

Comments (none posted)

grip: buffer overflow

Package(s):grip CVE #(s):CAN-2005-0706
Created:March 10, 2005 Updated:November 19, 2008
Description: Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:
Fedora FEDORA-2008-9604 2008-11-19
Fedora FEDORA-2008-9521 2008-11-19
Fedora-Legacy FLSA:152919 2005-09-15
Mandriva MDKSA-2005:074 2005-04-20
Mandriva MDKSA-2005:075 2005-04-20
Gentoo 200504-07 2005-04-08
Mandrake MDKSA-2005:066 2005-04-01
Red Hat RHSA-2005:304-01 2005-03-28
Gentoo 200503-21 2005-03-17
Fedora FEDORA-2005-203 2005-03-09
Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

groff: insecure temporary directory

Package(s):groff CVE #(s):CAN-2004-0969
Created:November 1, 2004 Updated:February 9, 2006
Description: Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Mandriva MDKSA-2006:038 2006-02-08
Gentoo 200411-15 2004-11-08
Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gzip: arbitrary command execution

Package(s):gzip CVE #(s):CAN-2005-0758
Created:August 1, 2005 Updated:January 10, 2007
Description: zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names.
Alerts:
OpenPKG OpenPKG-SA-2007.002 2007-01-08
Mandriva MDKSA-2006:027 2006-01-30
Mandriva MDKSA-2006:026 2006-01-30
Fedora-Legacy FLSA:158801 2005-11-14
Fedora-Legacy FLSA:157696 2005-08-10
Ubuntu USN-161-1 2005-08-04
Ubuntu USN-158-1 2005-08-01

Comments (2 posted)

horde3: design error

Package(s):horde3 CVE #(s):CVE-2005-3344
Created:November 7, 2005 Updated:November 9, 2005
Description: Mike O'Connor discovered that the default installation of Horde3 on Debian includes an administrator account without a password. Already configured installations will not be altered by this update.
Alerts:
Debian DSA-884-1 2005-11-07

Comments (none posted)

htdig: cross site scripting

Package(s):htdig CVE #(s):CAN-2005-0085
Created:February 14, 2005 Updated:January 10, 2006
Description: Michael Krax discovered that ht://Dig fails to validate the 'config' parameter before displaying an error message containing the parameter. This flaw could allow an attacker to conduct cross-site scripting attacks.
Alerts:
Fedora-Legacy FLSA:152907 2006-01-09
Mandrake MDKSA-2005:063 2005-03-31
Red Hat RHSA-2005:090-01 2005-02-15
Debian DSA-680-1 2005-02-14
Gentoo 200502-16 2005-02-13

Comments (none posted)

imap: buffer overflow in c-client

Package(s):imap CVE #(s):CAN-2003-0297
Created:February 18, 2005 Updated:April 10, 2006
Description: A buffer overflow flaw was found in the c-client IMAP client. An attacker could create a malicious IMAP server that if connected to by a victim could execute arbitrary code on the client machine.
Alerts:
Fedora-Legacy FLSA:184074 2006-04-04
Fedora-Legacy FLSA:152912 2005-05-12
Red Hat RHSA-2005:114-01 2005-02-18

Comments (none posted)

kdebase: local root vulnerability

Package(s):kdebase CVE #(s):CAN-2005-2494
Created:September 7, 2005 Updated:August 11, 2006
Description: The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details.
Alerts:
Red Hat RHSA-2006:0582-01 2006-08-10
Debian DSA-815-1 2005-09-16
Slackware SSA:2005-251-01 2005-09-09
Ubuntu USN-176-1 2005-09-07
Mandriva MDKSA-2005:160 2005-09-06

Comments (none posted)

kdelibs: kate backup file permission leak

Package(s):kdelibs kate kwrite CVE #(s):CAN-2005-1920
Created:July 19, 2005 Updated:September 21, 2010
Description: Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information.
Alerts:
Gentoo 200611-21 2006-11-27
Debian DSA-804-2 2005-11-10
Debian DSA-804-1 2005-09-08
Red Hat RHSA-2005:612-01 2005-07-27
Ubuntu USN-150-1 2005-07-21
Mandriva MDKSA-2005:122 2005-07-20
Fedora FEDORA-2005-594 2005-07-19

Comments (1 posted)

kernel: multiple vulnerabilities

Package(s):kernel CVE #(s):CAN-2005-0449 CAN-2005-0209 CAN-2005-0529 CAN-2005-0530 CAN-2005-0532 CAN-2005-0384 CAN-2005-0210 CAN-2005-0504 CAN-2005-0003
Created:March 24, 2005 Updated:May 31, 2006
Description: A number of vulnerabilities have been found in the Linux kernel, including a PPP-related denial of service problem, an integer overflow in the epoll() code, memory corruption in the ELF loader, and exploitable overflows in the ISO9660 code.
Alerts:
Debian DSA-1082-1 2006-05-29
Debian DSA-1069-1 2006-05-20
Debian DSA-1070-1 2006-05-21
Debian DSA-1067-1 2006-05-20
Conectiva CLA-2005:945 2005-03-31
Fedora FEDORA-2005-262 2005-03-28
SuSE SUSE-SA:2005:018 2005-03-24

Comments (none posted)

krb5: double-free flaw

Package(s):krb5 CVE #(s):CAN-2004-0175 CAN-2005-0488 CAN-2005-1175 CAN-2005-1689
Created:July 12, 2005 Updated:December 6, 2005
Description: The krb5 authentication has a double-free flaw which may be initiated by a remote unauthenticated attacker. Also, a single byte heap overflow in the krb5_unparse_name() function can lead to a denial of service and an information disclosure may be caused by a malicious telnet server. See This report for more information.
Alerts:
Ubuntu USN-224-1 2005-12-06
Debian DSA-757-1 2005-07-17
Trustix TSLSA-2005-0036 2005-07-14
Mandriva MDKSA-2005:119 2005-07-13
SuSE SUSE-SR:2005:017 2005-07-13
Gentoo 200507-11 2005-07-12
Fedora FEDORA-2005-553 2005-07-12
Red Hat RHSA-2005:562-01 2005-07-12
Fedora FEDORA-2005-552 2005-07-12
Red Hat RHSA-2005:567-02 2005-07-12

Comments (none posted)

libconvert-uulib-perl: arbitrary code execution

Package(s):libconvert-uulib-perl CVE #(s):CAN-2005-1349
Created:May 20, 2005 Updated:January 27, 2006
Description: Mark Martinec and Robert Lewis discovered a buffer overflow in Convert::UUlib (before 1.051), a Perl interface to the uulib library, which may result in the execution of arbitrary code.
Alerts:
Mandriva MDKSA-2006:022 2006-01-26
Debian DSA-727-1 2005-05-20

Comments (1 posted)

libdbi-perl: insecure temporary file

Package(s):libdbi-perl CVE #(s):CAN-2005-0077
Created:January 25, 2005 Updated:March 2, 2006
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.
Alerts:
Fedora-Legacy FLSA:178989 2006-03-01
Gentoo 200501-38:03 2005-01-26
Red Hat RHSA-2005:072-01 2005-02-15
Mandrake MDKSA-2005:030 2005-02-08
Red Hat RHSA-2005:069-01 2005-02-01
Gentoo 200501-38 2005-01-26
Ubuntu USN-70-1 2005-01-25
Debian DSA-658-1 2005-01-25

Comments (none posted)

libgadu: memory alignment bug

Package(s):libgadu CVE #(s):CAN-2005-2370
Created:July 29, 2005 Updated:June 25, 2007
Description: Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment error in libgadu (from ekg, console Gadu Gadu client, an instant messaging program) which is included in gaim, a multi-protocol instant messaging client, as well. This can not be exploited on the x86 architecture but on others, e.g. on Sparc and lead to a bus error, in other words a denial of service.
Alerts:
Debian DSA-813-1 2005-09-15
Red Hat RHSA-2005:627-01 2005-08-09
Debian DSA-769-1 2005-07-29

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):libgd2 CVE #(s):CAN-2004-0990 CAN-2004-0941
Created:October 29, 2004 Updated:June 28, 2006
Description: Several buffer overflows have been discovered in libgd's PNG handling functions.
If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:
Mandriva MDKSA-2006:114 2006-06-27
Red Hat RHSA-2006:0194-01 2006-02-01
Fedora-Legacy FLSA:152838 2005-07-15
Red Hat RHSA-2004:638-01 2004-12-17
Ubuntu USN-33-1 2004-11-29
Debian DSA-602-1 2004-11-29
Debian DSA-601-1 2004-11-29
Mandrake MDKSA-2004:132 2004-11-15
Ubuntu USN-25-1 2004-11-15
Fedora FEDORA-2004-412 2004-11-11
Fedora FEDORA-2004-411 2004-11-11
Ubuntu USN-21-1 2004-11-09
Debian DSA-591-1 2004-11-09
Debian DSA-589-1 2004-11-09
Gentoo 200411-08 2004-11-03
OpenPKG OpenPKG-SA-2004.049 2004-10-30
Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libgda2: format string vulnerabilities

Package(s):libgda2 CVE #(s):CAN-2005-2958
Created:October 25, 2005 Updated:November 18, 2005
Description: Steve Kemp discovered two format string vulnerabilities in libgda2, the GNOME Data Access library for GNOME2, which may lead to the execution of arbitrary code in programs that use this library.
Alerts:
SuSE SUSE-SR:2005:027 2005-11-11
Fedora FEDORA-2005-1029 2005-11-07
Mandriva MDKSA-2005:203 2005-11-01
Gentoo 200511-01 2005-11-02
Ubuntu USN-212-1 2005-10-28
Debian DSA-871-2 2005-10-25
Debian DSA-871-1 2005-10-25

Comments (none posted)

libnet-ssleay-perl: weakened cryptographic operations

Package(s):libnet-ssleay-perl CVE #(s):CAN-2005-0106
Created:May 3, 2005 Updated:January 27, 2006
Description: Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGD_PATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with known content.
Alerts:
Mandriva MDKSA-2006:023 2006-01-26
Ubuntu USN-113-1 2005-05-03

Comments (none posted)

libpam-ldap: authentication bypass

Package(s):libpam-ldap CVE #(s):CAN-2005-2641
Created:August 25, 2005 Updated:October 6, 2006
Description: libpam-ldap, the PAM LDAP interface, has a vulnerability in which it fails to authenticate with an LDAP server which is not configured properly, allowing an authentication bypass.
Alerts:
rPath rPSA-2006-0183-1 2006-10-05
Mandriva MDKSA-2005:190 2005-10-20
Gentoo 200508-22 2005-08-31
Debian DSA-785-1 2005-08-25

Comments (none posted)

libTIFF: buffer overflow

Package(s):libtiff CVE #(s):CAN-2005-1544
Created:May 10, 2005 Updated:February 18, 2006
Description: Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a stack based buffer overflow in the libTIFF library when reading a TIFF image with a malformed BitsPerSample tag. Successful exploitation would require the victim to open a specially crafted TIFF image, resulting in the execution of arbitrary code.
Alerts:
Mandriva MDKSA-2006:042 2006-02-17
Debian DSA-755-1 2005-07-13
Ubuntu USN-130-1 2005-05-19
Gentoo 200505-07 2005-05-10

Comments (1 posted)

libungif: memory corruption

Package(s):libungif CVE #(s):CAN-2005-2974
Created:November 3, 2005 Updated:March 20, 2006
Description: The libungif library has a vulnerability in the GIF file colormap handling code. A maliciously crafted GIF file can cause out of bounds memory writing and register corruption.
Alerts:
Fedora-Legacy FLSA:174479 2006-03-16
SuSE SUSE-SR:2005:026 2005-11-11
Mandriva MDKSA-2005:207 2005-11-09
Debian DSA-890-1 2005-11-09
Ubuntu USN-214-1 2005-11-07
Gentoo 200511-03 2005-11-04
Red Hat RHSA-2005:828-01 2005-11-03
Fedora FEDORA-2005-1046 2005-11-03
Fedora FEDORA-2005-1045 2005-11-03

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libXpm: new buffer overflows

Package(s):libXpm CVE #(s):CAN-2005-0605
Created:March 4, 2005 Updated:March 8, 2006
Description: A new vulnerability has been discovered in libXpm, which is included in OpenMotif and LessTif, that can potentially lead to remote code execution.
Alerts:
Fedora-Legacy FLSA:168264 2006-03-07
Fedora-Legacy FLSA:152803 2006-01-09
Fedora FEDORA-2005-815 2005-08-26
Fedora FEDORA-2005-808 2005-08-25
Red Hat RHSA-2005:198-01 2005-06-08
Red Hat RHSA-2005:473-01 2005-05-24
Red Hat RHSA-2005:412-01 2005-05-11
Debian DSA-723-1 2005-05-09
Mandriva MDKSA-2005:081 2005-05-05
Mandriva MDKSA-2005:080 2005-04-28
Red Hat RHSA-2005:044-01 2005-04-06
Red Hat RHSA-2005:331-01 2005-03-30
Fedora FEDORA-2005-273 2005-03-29
Fedora FEDORA-2005-272 2005-03-29
Ubuntu USN-97-1 2005-03-16
Gentoo 200503-15 2005-03-12
Ubuntu USN-92-1 2005-03-07
Gentoo 200503-08 2005-03-04

Comments (none posted)

lm-sensors: insecure temp files

Package(s):lm-sensors CVE #(s):CAN-2005-2672
Created:August 23, 2005 Updated:November 10, 2005
Description: Javier Fernández-Sanguino Peña noticed that the pwmconfig script created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with full root privileges since pwmconfig is usually executed by root.
Alerts:
Red Hat RHSA-2005:825-01 2005-11-10
Fedora FEDORA-2005-1054 2005-11-07
Fedora FEDORA-2005-1053 2005-11-07
Debian-Testing DTSA-17-1 2005-09-15
Debian DSA-814-1 2005-09-15
Gentoo 200508-19 2005-08-30
Mandriva MDKSA-2005:149 2005-08-25
Ubuntu USN-172-1 2005-08-23

Comments (1 posted)

Mantis: multiple vulnerabilities

Package(s):mantisbt CVE #(s):CVE-2005-3091 CVE-2005-3335 CVE-2005-3336 CVE-2005-3338 CVE-2005-3339
Created:October 28, 2005 Updated:December 22, 2005
Description: Mantis contains several vulnerabilities, including a remote file inclusion vulnerability, an SQL injection vulnerability, multiple cross site scripting vulnerabilities and multiple information disclosure vulnerabilities.
Alerts:
Gentoo 200512-12 2005-12-22
Debian DSA-905-1 2005-11-22
Gentoo 200510-24 2005-10-28

Comments (none posted)

mod_python: remote access vulnerability

Package(s):mod_python CVE #(s):CAN-2005-0088
Created:February 10, 2005 Updated:April 10, 2006
Description: mod_python has a vulnerability in the publisher handler that may allow a remote user to use a specially crafted URL to allow access to objects that should be protected. An information leak can result.
Alerts:
Fedora-Legacy FLSA:152896 2006-04-04
Conectiva CLA-2005:926 2005-03-02
Debian DSA-689-1 2005-02-23
Red Hat RHSA-2005:100-01 2005-02-15
Gentoo 200502-14 2005-02-13
Trustix TSLSA-2005-0003 2005-02-11
Ubuntu USN-80-1 2005-02-11
Red Hat RHSA-2005:104-01 2005-02-10
Fedora FEDORA-2005-140 2005-02-10
Fedora FEDORA-2005-139 2005-02-10

Comments (none posted)

mysql: buffer overflow

Package(s):mysql CVE #(s):CAN-2005-2558
Created:September 12, 2005 Updated:January 12, 2006
Description: The mysql CREATE FUNCTION can be used to create a buffer overflow. A specially crafted long function name can be used by a local attacker to crash the server or execute arbitrary code with the privileges of the server.
Alerts:
Fedora-Legacy FLSA:167803 2006-01-10
Ubuntu USN-180-2 2005-12-05
OpenPKG OpenPKG-SA-2005.024 2005-12-03
Debian DSA-833-2 2005-10-04
Debian DSA-833-1 2005-10-01
Debian DSA-831-1 2005-09-30
Debian DSA-829-1 2005-09-30
Mandriva MDKSA-2005:163 2005-09-12
Ubuntu USN-180-1 2005-09-12

Comments (none posted)

mysql: low-impact security fix

Package(s):mysql CVE #(s):CAN-2005-1636
Created:July 20, 2005 Updated:February 22, 2006
Description: An update to MySQL version 4.1.12 fixes a low-impact security problem (bz#158689).
Alerts:
Mandriva MDKSA-2006:045 2006-02-21
Red Hat RHSA-2005:685-01 2005-10-05
Debian DSA-783-1 2005-08-24
Fedora FEDORA-2005-557 2005-07-20

Comments (1 posted)

ncpfs: multiple vulnerabilities

Package(s):ncpfs CVE #(s):CAN-2005-0013 CAN-2005-0014
Created:January 31, 2005 Updated:May 15, 2006
Description: Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).
Alerts:
Fedora-Legacy FLSA:152904 2006-05-12
Fedora FEDORA-2005-435 2005-08-16
Red Hat RHSA-2005:371-01 2005-05-17
Mandrake MDKSA-2005:028 2005-02-01
Gentoo 200501-44 2005-01-30

Comments (none posted)

nfs-utils: arbitrary code execution

Package(s):nfs-utils CVE #(s):CAN-2004-0946
Created:January 11, 2005 Updated:February 27, 2006
Description: Arjan van de Ven discovered a buffer overflow in rquotad on 64bit architectures; an improper integer conversion could lead to a buffer overflow. An attacker with access to an NFS share could send a specially crafted request which could then lead to the execution of arbitrary code.
Alerts:
Fedora-Legacy FLSA:138098 2006-02-25
Red Hat RHSA-2005:014-01 2005-01-12
Mandrake MDKSA-2005:005 2005-01-11

Comments (none posted)

ntp: uses wrong gid

Package(s):ntp CVE #(s):CAN-2005-2496
Created:August 26, 2005 Updated:August 11, 2006
Description: When starting xntpd with the -u option and specifying the group by using a string not a numeric gid the daemon uses the gid of the user not the group. This problem is now fixed by this update.
Alerts:
Red Hat RHSA-2006:0393-01 2006-08-10
Mandriva MDKSA-2005:156 2005-09-06
Debian DSA-801-1 2005-09-05
Ubuntu USN-175-1 2005-09-01
Fedora FEDORA-2005-812 2005-08-26

Comments (none posted)

openssh: GSSAPI credential disclosure

Package(s):openssh CVE #(s):CAN-2005-2798
Created:September 7, 2005 Updated:February 3, 2006
Description: OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
Alerts:
SuSE SUSE-SR:2006:003 2006-02-03
Ubuntu USN-209-1 2005-10-17
Mandriva MDKSA-2005:172 2005-10-06
Red Hat RHSA-2005:527-01 2005-10-05
Fedora FEDORA-2005-860 2005-09-12
Trustix TSLSA-2005-0047 2005-09-09
Fedora FEDORA-2005-858 2005-09-07

Comments (none posted)

openssl: protocol rollback

Package(s):openssl CVE #(s):CAN-2005-2969
Created:October 12, 2005 Updated:December 19, 2005
Description: OpenSSL prior to version 0.9.7h or 0.9.8a contains a vulnerability which could enable an attacker to force the use of the older, less secure SSL 2.0 protocol. See this advisory for details or this analysis for even more details.
Alerts:
Fedora-Legacy FLSA:166939 2005-12-17
Debian DSA-888-1 2005-11-07
Debian DSA-882-1 2005-11-04
Debian DSA-881-1 2005-11-04
Debian DSA-875-1 2005-10-27
SuSE SUSE-SA:2005:061 2005-10-19
OpenPKG OpenPKG-SA-2005.022 2005-10-17
Fedora FEDORA-2005-986 2005-10-13
Fedora FEDORA-2005-985 2005-10-13
Ubuntu USN-204-1 2005-10-14
Slackware SSA:2005-286-01 2005-10-14
Mandriva MDKSA-2005:179 2005-10-11
Gentoo 200510-11 2005-10-12
Red Hat RHSA-2005:800-01 2005-10-11

Comments (1 posted)

openvpn: format string vulnerability

Package(s):openvpn CVE #(s):CVE-2005-3393 CVE-2005-3409
Created:November 2, 2005 Updated:December 12, 2005
Description: OpenVPN 2.0.x contains a format string vulnerability which can be exploited by a hostile server; see this advisory for details.
Alerts:
Mandriva MDKSA-2005:206-1 2005-12-09
Mandriva MDKSA-2005:206 2005-11-08
Debian DSA-885-1 2005-11-07
Gentoo 200511-07 2005-11-06
SuSE SUSE-SR:2005:025 2005-11-04
OpenPKG OpenPKG-SA-2005.023 2005-11-02

Comments (none posted)

pcre3: arbitrary code execution

Package(s):pcre3 CVE #(s):CAN-2005-2491
Created:August 23, 2005 Updated:March 10, 2006
Description: A buffer overflow has been discovered in the PCRE, a widely used library that provides Perl compatible regular expressions. Specially crafted regular expressions triggered a buffer overflow. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library.
Alerts:
Red Hat RHSA-2006:0197-01 2006-03-09
Fedora-Legacy FLSA:168516 2006-03-07
Debian DSA-821-1 2005-09-28
Debian DSA-819-1 2005-09-23
Debian DSA-817-1 2005-09-22
Gentoo 200509-08 2005-09-12
Red Hat RHSA-2005:358-01 2005-09-08
Red Hat RHSA-2005:761-02 2005-09-08
Trustix TSLSA-2005-0045 2005-08-26
OpenPKG OpenPKG-SA-2005.018 2005-09-05
SuSE SUSE-SA:2005:051 2005-09-05
Gentoo 200509-02 2005-09-03
Debian DSA-800-1 2005-09-02
Ubuntu USN-173-4 2005-08-31
Slackware SSA:2005-242-01 2005-08-31
SuSE SUSE-SA:2005:049 2005-08-30
SuSE SUSE-SA:2005:048 2005-08-30
Ubuntu USN-173-3 2005-08-30
Mandriva MDKSA-2005:155 2005-08-29
Mandriva MDKSA-2005:154 2005-08-26
Mandriva MDKSA-2005:153 2005-08-26
Mandriva MDKSA-2005:151 2005-08-25
Mandriva MDKSA-2005:152 2005-08-25
Gentoo 200508-17 2005-08-25
Ubuntu USN-173-2 2005-08-24
Fedora FEDORA-2005-803 2005-08-24
Fedora FEDORA-2005-802 2005-08-24
Ubuntu USN-173-1 2005-08-23

Comments (none posted)

perl: setuid vulnerabilities

Package(s):perl CVE #(s):CAN-2005-0155 CAN-2005-0156
Created:February 2, 2005 Updated:August 11, 2006
Description: There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access.
Alerts:
Red Hat RHSA-2006:0605-01 2006-08-10
Fedora FEDORA-2005-353 2005-05-02
Red Hat RHSA-2005:103-01 2005-02-15
Gentoo 200502-13 2005-02-11
SuSE SUSE-SR:2005:004 2005-02-11
Mandrake MDKSA-2005:031 2005-02-08
Red Hat RHSA-2005:105-01 2005-02-07
Ubuntu USN-72-1 2005-02-02

Comments (none posted)

perl: symlink vulnerability

Package(s):perl CVE #(s):CAN-2005-0448
Created:March 9, 2005 Updated:January 30, 2006
Description: The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries.
Alerts:
Fedora-Legacy FLSA:152845 2006-01-24
Red Hat RHSA-2005:674-01 2005-10-05
Fedora FEDORA-2005-600 2005-07-22
Mandriva MDKSA-2005:079 2005-04-28
Debian DSA-696-1 2005-03-22
Ubuntu USN-94-1 2005-03-09

Comments (none posted)

php: multiple vulnerabilities

Package(s):php CVE #(s):CVE-2005-3390 CVE-2005-3389 CVE-2005-3388 CVE-2005-3353
Created:November 8, 2005 Updated:December 23, 2005
Description: There are multiple vulnerabilities in PHP, including malicious requests may overwrite the GLOBALS array, the parse_str() function may enable the register_globals setting, cross-site scripting bugs in phpinfo() and a bug in EXIF image parsing that may crash the process.
Alerts:
Ubuntu USN-232-1 2005-12-23
SuSE SUSE-SA:2005:069 2005-12-14
SuSE SUSE-SR:2005:029 2005-12-09
OpenPKG OpenPKG-SA-2005.027 2005-12-03
Fedora-Legacy FLSA:166943 2005-11-28
Mandriva MDKSA-2005:213 2005-11-16
Gentoo 200511-08 2005-11-13
Red Hat RHSA-2005:838-01 2005-11-10
Red Hat RHSA-2005:831-01 2005-11-10
Fedora FEDORA-2005-1061 2005-11-08
Fedora FEDORA-2005-1062 2005-11-08

Comments (none posted)

phpMyAdmin: local file inclusion and XSS

Package(s):phpmyadmin CVE #(s):CVE-2005-2869 CVE-2005-3300 CVE-2005-3301
Created:October 25, 2005 Updated:November 18, 2005
Description: Stefan Esser discovered that by calling certain PHP files directly, it was possible to workaround the grab_globals.lib.php security model and overwrite the $cfg configuration array. Systems running PHP in safe mode are not affected. Futhermore, Tobias Klein reported several cross-site-scripting issues resulting from insufficient user input sanitizing. A local attacker may exploit this vulnerability by sending malicious requests, causing the execution of arbitrary code with the rights of the user running the web server. Furthermore, the cross-site scripting issues give a remote attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim's browser.
Alerts:
SuSE SUSE-SA:2005:066 2005-11-18
Slackware SSA:2005-310-05 2005-11-07
Debian DSA-880-1 2005-11-02
Gentoo 200510-21 2005-10-25

Comments (none posted)

phpsysinfo: cross-site-scripting

Package(s):phpsysinfo CVE #(s):CAN-2005-0870
Created:May 18, 2005 Updated:November 15, 2005
Description: The phpsysinfo program contains several cross-site scripting vulnerabilities.
Alerts:
Debian DSA-724-1 2005-05-18

Comments (none posted)

postgresql: database initialization errors

Package(s):postgresql CVE #(s):CAN-2005-1409 CAN-2005-1410
Created:May 4, 2005 Updated:February 28, 2006
Description: PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
Alerts:
Fedora-Legacy FLSA:157366 2006-02-27
Mandriva MDKSA-2005:093 2005-05-26
Red Hat RHSA-2005:433-01 2005-06-01
Gentoo 200505-12 2005-05-15
Fedora FEDORA-2005-368 2005-05-10
Ubuntu USN-118-1 2005-05-04

Comments (none posted)

Pound: buffer overflow

Package(s):pound CVE #(s):CVE-2005-1391
Created:May 2, 2005 Updated:January 10, 2006
Description: Steven Van Acker has discovered a buffer overflow vulnerability in the "add_port()" function in Pound 1.8.2+. A remote attacker could send a request for an overly long hostname parameter, which could lead to the remote execution of arbitrary code with the rights of the Pound daemon process.
Alerts:
Gentoo 200504-29 2005-04-30

Comments (none posted)

pstotext: remote execution of arbitrary code

Package(s):pstotext netpbm CVE #(s):CAN-2005-2471
Created:August 1, 2005 Updated:March 28, 2006
Description: Max Vozeler reported that pstotext calls the GhostScript interpreter on untrusted PostScript files without specifying the -dSAFER option. An attacker could craft a malicious PostScript file and entice a user to run pstotext on it, resulting in the execution of arbitrary commands with the permissions of the user running pstotext. See this Secunia advisory for more information.
Alerts:
Debian DSA-1021-1 2006-03-28
Debian DSA-792-1 2005-08-31
Red Hat RHSA-2005:743-01 2005-08-22
Fedora FEDORA-2005-728 2005-08-17
Fedora FEDORA-2005-727 2005-08-17
Ubuntu USN-164-1 2005-08-11
Mandriva MDKSA-2005:133 2005-08-09
Gentoo 200508-04 2005-08-05
Gentoo 200507-29 2005-07-31

Comments (2 posted)

pwdutils: privilege escalation

Package(s):pwdutils shadow CVE #(s):
Created:November 4, 2005 Updated:November 9, 2005
Description: Thomas Gerisch found that the setuid 'chfn' program contained in the pwdutils suite insufficiently checks it's arguments when changing the GECOS field. This bug leads to a trivially exploitable local privilege escalation that allows users to gain root access.
Alerts:
SuSE SUSE-SA:2005:064 2005-11-04

Comments (none posted)

Py2Play: remote execution of arbitrary Python code

Package(s):Py2Play CVE #(s):CAN-2005-2875
Created:September 19, 2005 Updated:September 6, 2006
Description: Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send malicious Python pickles, resulting in the execution of arbitrary Python code on the targeted game client.
Alerts:
Gentoo 200509-09:02 2005-09-17
Debian DSA-856-1 2005-10-10
Gentoo 200509-09 2005-09-17

Comments (none posted)

rp-pppoe, pppoe: missing privilege dropping

Package(s):rp-pppoe, pppoe CVE #(s):CAN-2004-0564
Created:October 4, 2004 Updated:November 15, 2005
Description: Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver from Roaring Penguin. When the program is running setuid root (which is not the case in a default Debian installation), an attacker could overwrite any file on the file system.
Alerts:
Fedora-Legacy FLSA:152794 2005-11-14
Mandrake MDKSA-2004:145 2004-12-06
Debian DSA-557-1 2004-10-04

Comments (none posted)

smb4k: temporary file vulnerability

Package(s):smb4k CVE #(s):CVE-2005-2851
Created:September 7, 2005 Updated:December 7, 2005
Description: Smb4K has a temporary file vulnerability which can allow an unprivileged user to read certain files which would otherwise be inaccessible.
Alerts:
Debian-Testing DTSA-25-1 2005-12-05
Gentoo 200511-15 2005-11-18
Mandriva MDKSA-2005:157 2005-09-06

Comments (none posted)

spamassassin: denial of service

Package(s):spamassassin CVE #(s):CVE-2005-3351
Created:November 9, 2005 Updated:March 7, 2006
Description: Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field.
Alerts:
Red Hat RHSA-2006:0129-01 2006-03-07
Mandriva MDKSA-2005:221 2005-12-02
Fedora FEDORA-2005-1066 2005-11-09
Fedora FEDORA-2005-1065 2005-11-09

Comments (none posted)

squid: authentication handling

Package(s):squid CVE #(s):CAN-2005-2917
Created:September 30, 2005 Updated:March 15, 2006
Description: Upstream developers of squid, the popular WWW proxy cache, have discovered that changes in the authentication scheme are not handled properly when given certain request sequences while NTLM authentication is in place, which may cause the daemon to restart.
Alerts:
Red Hat RHSA-2006:0045-01 2006-03-15
Red Hat RHSA-2006:0052-01 2006-03-07
Fedora-Legacy FLSA:152809 2006-02-18
Mandriva MDKSA-2005:181 2005-10-11
Ubuntu USN-192-1 2005-09-30
Debian DSA-828-1 2005-09-30

Comments (none posted)

sudo: missing input sanitizing

Package(s):sudo CVE #(s):CVE-2005-2959
Created:October 25, 2005 Updated:February 19, 2006
Description: Tavis Ormandy noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. The SHELLOPTS and PS4 variables are dangerous and are still passed through to the program running as privileged user. This can result in the execution of arbitrary commands as privileged user when a bash script is executed. These vulnerabilities can only be exploited by users who have been granted limited super user privileges.
Alerts:
OpenPKG OpenPKG-SA-2006.002 2006-02-18
Trustix TSLSA-2005-0062 2005-11-04
Ubuntu USN-213-1 2005-10-28
Mandriva MDKSA-2005:201 2005-10-27
Debian DSA-870-1 2005-10-25

Comments (none posted)

sudo: race condition

Package(s):sudo CVE #(s):CAN-2005-1993
Created:June 21, 2005 Updated:February 24, 2006
Description: Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command "ALL", that user could execute arbitrary commands with sudo by creating symbolic links at a certain time.
Alerts:
Fedora-Legacy FLSA:162750 2006-02-23
Debian DSA-735-2 2005-07-07
Debian DSA 735-1 2005-07-01
Red Hat RHSA-2005:535-04 2005-06-29
SuSE SUSE-SA:2005:036 2005-06-24
OpenPKG OpenPKG-SA-2005.012 2005-06-23
Gentoo 200506-22 2005-06-23
Slackware SSA:2005-172-01 2005-06-22
Mandriva MDKSA-2005:103 2005-06-21
Fedora FEDORA-2005-473 2005-06-21
Fedora FEDORA-2005-472 2005-06-21
Ubuntu USN-142-1 2005-06-21

Comments (none posted)

sylpheed: buffer overflow

Package(s):sylpheed CVE #(s):CVE-2005-3354
Created:November 9, 2005 Updated:January 6, 2006
Description: The sylpheed mail client, prior to versions 1.0.6 and 2.0.4, contains a buffer overflow in the LDIF address book import code.
Alerts:
Debian DSA-908-1 2005-11-23
Debian DSA-906-1 2005-11-22
Gentoo 200511-13 2005-11-15
Fedora FEDORA-2005-1063 2005-11-09

Comments (none posted)

sysreport: insecure temporary file

Package(s):sysreport CVE #(s):CAN-2005-2104
Created:August 9, 2005 Updated:November 11, 2005
Description: Bill Stearns discovered a bug in the way sysreport creates temporary files. It is possible that a local attacker could obtain sensitive information about the system when sysreport is run.
Alerts:
Fedora FEDORA-2005-1072 2005-11-10
Fedora FEDORA-2005-1071 2005-11-10
Red Hat RHSA-2005:598-01 2005-08-09

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: multiple DoS issues

Package(s):tcpdump CVE #(s):CAN-2005-1280 CAN-2005-1279 CAN-2005-1278
Created:May 2, 2005 Updated:April 10, 2006
Description: The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4. (CAN-2005-1280)

tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet, which is not properly handled by RT_ROUTING_INFO, or LDP packet, which is not properly handled by the ldp_print function. (CAN-2005-1279)

The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length, as demonstrated using a GRE packet. (CAN-2005-1278)

Alerts:
Fedora-Legacy FLSA:156139 2006-04-04
Debian DSA-850-1 2005-10-09
Mandriva MDKSA-2005:087 2005-05-11
Red Hat RHSA-2005:417-02 2005-05-11
Red Hat RHSA-2005:421-02 2005-05-11
Gentoo 200505-06 2005-05-09
Ubuntu USN-119-1 2005-05-06
Fedora FEDORA-2005-351 2005-05-02

Comments (none posted)

texinfo: temporary file vulnerability

Package(s):texinfo CVE #(s):CAN-2005-3011
Created:October 5, 2005 Updated:November 9, 2006
Description: Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability.
Alerts:
Ubuntu USN-194-2 2006-01-09
Fedora FEDORA-2005-991 2005-10-14
Fedora FEDORA-2005-990 2005-10-14
Mandriva MDKSA-2005:175 2005-10-06
Ubuntu USN-194-1 2005-10-06
Gentoo 200510-04 2005-10-05

Comments (none posted)

thttpd: insecure temp file

Package(s):thttpd CVE #(s):CVE-2005-3124
Created:November 4, 2005 Updated:November 9, 2005
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit team discovered that the syslogtocern script from thttpd, a tiny webserver, uses a temporary file insecurely, allowing a local attacker to craft a symlink attack to overwrite arbitrary files.
Alerts:
Debian DSA-883-1 2005-11-04

Comments (none posted)

ucd-snmp: denial of service

Package(s):ucd-snmp CVE #(s):CAN-2005-2177
Created:August 9, 2005 Updated:January 27, 2006
Description: A denial of service bug was found in the way ucd-snmp uses network stream protocols. A remote attacker could send a ucd-snmp agent a specially crafted packet which will cause the agent to crash.
Alerts:
Mandriva MDKSA-2006:025 2006-01-26
Ubuntu USN-190-2 2005-11-21
Debian DSA-873-1 2005-10-26
Red Hat RHSA-2005:395-01 2005-10-05
Ubuntu USN-190-1 2005-09-29
Red Hat RHSA-2005:373-01 2005-09-28
Mandriva MDKSA-2005:137 2005-08-11
Red Hat RHSA-2005:720-01 2005-08-09

Comments (none posted)

uim: privilege escalation

Package(s):uim CVE #(s):CVE-2005-3149
Created:October 4, 2005 Updated:December 7, 2005
Description: Masanari Yamamoto discovered that Uim uses environment variables incorrectly. This bug causes a privilege escalation if setuid/setgid applications are linked to libuim. This bug only affects immodule-enabled Qt (if you build Qt 3.3.2 or later versions with USE="immqt" or USE="immqt-bc").
Alerts:
Debian-Testing DTSA-22-1 2005-12-05
Debian DSA-895-1 2005-11-14
Mandriva MDKSA-2005:198 2005-10-26
Gentoo 200510-03 2005-10-04

Comments (none posted)

unzip: race condition

Package(s):unzip CVE #(s):CAN-2005-2475
Created:September 29, 2005 Updated:January 12, 2006
Description: Unzip has a race condition vulnerability in the handling of output files. During file unpacking, a local attacker can modify the permissions of arbitrary files in the victim's directory.
Alerts:
Debian DSA-903-2 2006-01-12
Debian DSA-903-1 2005-11-21
Mandriva MDKSA-2005:197 2005-10-26
Trustix TSLSA-2005-0053 2005-09-30
Ubuntu USN-191-1 2005-09-29

Comments (none posted)

up-imapproxy: format string vulnerabilities

Package(s):up-imapproxy CVE #(s):CAN-2005-2661
Created:October 10, 2005 Updated:March 7, 2006
Description: up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
Alerts:
Gentoo 200603-04 2006-03-06
Debian DSA-852-1 2005-10-09

Comments (none posted)

util-linux: unintentional grant of privileges by umount

Package(s):util-linux CVE #(s):CAN-2005-2876
Created:September 13, 2005 Updated:December 19, 2005
Description: Linux umount command as provided in the util-linux package in versions 2.8 to 2.12q, 2.13-pre1 and 2.13-pre2 grants root privileges. See this BugTraq post for more information.
Alerts:
Fedora-Legacy FLSA:168326 2005-12-18
Red Hat RHSA-2005:782-01 2005-10-11
SuSE SUSE-SR:2005:021 2005-09-30
Debian DSA-825-1 2005-09-29
Debian DSA-823-1 2005-09-29
Mandriva MDKSA-2005:167 2005-09-20
Gentoo 200509-15 2005-09-20
Ubuntu USN-184-1 2005-09-19
Fedora FEDORA-2005-886 2005-09-14
Fedora FEDORA-2005-887 2005-09-14
Slackware SSA:2005-255-02 2005-09-13

Comments (none posted)

uw-imap: buffer overflow

Package(s):uw-imap CVE #(s):CAN-2005-2933
Created:October 11, 2005 Updated:April 10, 2006
Description: "infamous41md" discovered a buffer overflow in uw-imap, the University of Washington's IMAP Server that allows attackers to execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:184098 2006-04-04
Fedora-Legacy FLSA:170411 2006-04-04
Fedora FEDORA-2005-1112 2005-12-08
Fedora FEDORA-2005-1115 2005-12-08
Red Hat RHSA-2005:850-01 2005-12-06
Red Hat RHSA-2005:848-01 2005-12-06
Mandriva MDKSA-2005:194 2005-10-26
Trustix TSLSA-2005-0055 2005-10-07
Mandriva MDKSA-2005:189 2005-10-20
SuSE SUSE-SR:2005:023 2005-10-14
Gentoo 200510-10 2005-10-11
Debian DSA-861-1 2005-10-11

Comments (none posted)

vixie-cron: crontab allows any user to read another users crontabs

Package(s):vixie-cron CVE #(s):CAN-2005-1038
Created:April 15, 2005 Updated:March 15, 2006
Description: crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235. See also this Security Focus report.
Alerts:
Red Hat RHSA-2006:0117-01 2006-03-15
Red Hat RHSA-2005:361-01 2005-10-05
Fedora FEDORA-2005-320 2005-04-15

Comments (none posted)

w3c-libwww: possible stack overflow

Package(s):w3c-libwww CVE #(s):CVE-2005-3183
Created:October 14, 2005 Updated:May 2, 2007
Description: xtensive testing of libwww's handling of multipart/byteranges content from HTTP/1.1 servers revealed multiple logical flaws and bugs in Library/src/HTBound.c
Alerts:
Red Hat RHSA-2007:0208-02 2007-05-01
Ubuntu USN-220-1 2005-12-01
Mandriva MDKSA-2005:210 2005-11-09
Fedora FEDORA-2005-953 2005-10-07
Fedora FEDORA-2005-952 2005-10-07

Comments (1 posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):xchat CVE #(s):CAN-2004-0409
Created:April 19, 2004 Updated:November 15, 2005
Description: XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:
Fedora-Legacy FLSA:123013 2005-11-14
Red Hat RHSA-2004:585-01 2004-10-27
Netwosix NW-2004-0014 2004-05-01
Red Hat RHSA-2004:177-01 2004-04-30
Mandrake MDKSA-2004:036 2004-04-21
Debian DSA-493-1 2004-04-21
Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-lib: buffer overflows

Package(s):xine-lib CVE #(s):CAN-2004-1379
Created:September 22, 2004 Updated:April 10, 2006
Description: xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:
Fedora-Legacy FLSA:152873 2006-04-04
Debian DSA-657-1 2005-01-25
Mandrake MDKSA-2004:105 2004-10-06
Slackware SSA:2004-266-04 2004-09-22
Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):xine-ui CVE #(s):CAN-2004-0372
Created:April 6, 2004 Updated:April 27, 2006
Description: Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:
Gentoo 200404-20 2004-04-27
Slackware SSA:2004-111-01 2004-04-20
Mandrake MDKSA-2004:033 2004-04-19
Debian DSA-477-1 2004-04-06

Comments (none posted)

xloadimage: buffer overflows

Package(s):xloadimage CVE #(s):CAN-2005-3178
Created:October 10, 2005 Updated:May 15, 2006
Description: Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:152923 2006-05-12
Gentoo 200510-26 2005-10-30
Mandriva MDKSA-2005:192 2005-10-20
Red Hat RHSA-2005:802-01 2005-10-18
Debian DSA-859-1 2005-10-10
Debian DSA-858-1 2005-10-10
Fedora FEDORA-2005-981 2005-10-10

Comments (none posted)

xorg-x11: heap overflow

Package(s):xorg-x11 CVE #(s):CAN-2005-2495
Created:September 12, 2005 Updated:March 8, 2006
Description: The pixmap memory allocation code in the X.Org X window system is vulnerable to an integer overflow, a local user can use this to execute arbitrary code with elevated privileges.
Alerts:
Fedora-Legacy FLSA:168264-2 2006-03-07
Slackware SSA:2005-269-02 2005-09-26
SuSE SUSE-SA:2005:056 2005-09-26
Debian DSA-816-1 2005-09-19
Fedora FEDORA-2005-894 2005-09-16
Fedora FEDORA-2005-893 2005-09-16
Trustix TSLSA-2005-0049 2005-09-16
Red Hat RHSA-2005:501-01 2005-09-15
Mandriva MDKSA-2005:164 2005-09-13
Red Hat RHSA-2005:396-01 2005-09-13
Red Hat RHSA-2005:329-01 2005-09-12
Ubuntu USN-182-1 2005-09-12
Gentoo 200509-07 2005-09-12

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2005-0064
Created:January 19, 2005 Updated:March 15, 2007
Description: iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:
Fedora FEDORA-2007-1219 2007-03-14
Gentoo 200506-06 2005-06-09
Red Hat RHSA-2005:026-01 2005-03-16
Red Hat RHSA-2005:066-01 2005-02-15
Red Hat RHSA-2005:057-01 2005-02-15
Red Hat RHSA-2005:053-01 2005-02-15
Red Hat RHSA-2005:034-01 2005-02-15
Fedora-Legacy FLSA:2353 2005-02-10
Fedora-Legacy FLSA:2352 2005-02-10
Gentoo 200502-10 2005-02-09
Red Hat RHSA-2005:049-01 2005-02-01
SuSE SUSE-SR:2005:002 2005-01-26
Red Hat RHSA-2005:059-01 2005-01-26
Mandrake MDKSA-2005:020 2005-01-25
Mandrake MDKSA-2005:019 2005-01-25
Mandrake MDKSA-2005:016 2005-01-25
Mandrake MDKSA-2005:021 2005-01-25
Mandrake MDKSA-2005:018 2005-01-25
Mandrake MDKSA-2005:017 2005-01-25
Fedora FEDORA-2005-061 2005-01-25
Fedora FEDORA-2005-062 2005-01-25
Fedora FEDORA-2005-059 2005-01-25
Fedora FEDORA-2005-060 2005-01-25
Conectiva CLA-2005:921 2005-01-25
Fedora FEDORA-2004-049 2005-01-24
Fedora FEDORA-2004-048 2005-01-24
Gentoo 200501-32 2005-01-23
Gentoo 200501-31 2005-01-23
Gentoo 200501-30 2005-01-22
Gentoo 200501-28 2005-01-21
Fedora FEDORA-2005-052 2005-01-20
Fedora FEDORA-2005-051 2005-01-20
Ubuntu USN-64-1 2005-01-19
Debian DSA-645-1 2005-01-19
Debian DSA-648-1 2005-01-19

Comments (1 posted)

xpdf: denial of service

Package(s):xpdf kpdf CVE #(s):CAN-2005-2097
Created:August 9, 2005 Updated:August 2, 2006
Description: A flaw was discovered in Xpdf in that could allow an attacker to construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened.
Alerts:
Debian DSA-1136-1 2006-08-02
Mandriva MDKSA-2005:138-1 2005-09-19
Debian DSA-780-1 2005-08-22
SuSE SUSE-SR:2005:019 2005-08-19
Fedora FEDORA-2005-732 2005-08-17
Fedora FEDORA-2005-733 2005-08-17
Gentoo 200508-08 2005-08-16
Fedora FEDORA-2005-730 2005-08-15
Fedora FEDORA-2005-729 2005-08-15
Mandriva MDKSA-2005:136 2005-08-11
Mandriva MDKSA-2005:135 2005-08-11
Mandriva MDKSA-2005:134 2005-08-11
Mandriva MDKSA-2005:138 2005-08-11
Red Hat RHSA-2005:708-01 2005-08-10
Red Hat RHSA-2005:706-01 2005-08-09
Red Hat RHSA-2005:671-01 2005-08-09
Red Hat RHSA-2005:670-01 2005-08-09
Ubuntu USN-163-1 2005-08-09

Comments (none posted)

zlib: buffer overflow

Package(s):zlib CVE #(s):CAN-2005-1849
Created:July 21, 2005 Updated:April 11, 2006
Description: zlib has a vulnerability that can cause code that executes it to crash if a corrupted file is opened.
Alerts:
Mandriva MDKSA-2006:070 2006-04-10
Debian DSA-1026-1 2006-04-06
Gentoo 200603-18 2006-03-21
Ubuntu USN-151-4 2005-11-09
Ubuntu USN-151-3 2005-10-28
Fedora-Legacy FLSA:162680 2005-09-14
Debian DSA-797-1 2005-09-01
Gentoo 200508-01 2005-08-01
Gentoo 200507-28 2005-07-30
SuSE SUSE-SA:2005:043 2005-07-28
OpenPKG OpenPKG-SA-2005.014 2005-07-28
Mandriva MDKSA-2005:124 2005-07-22
Slackware SSA:2005-203-03 2005-07-23
Ubuntu USN-151-2 2005-07-22
Fedora FEDORA-2005-626 2005-07-22
Fedora FEDORA-2005-625 2005-07-22
Gentoo 200507-19 2005-07-22
Red Hat RHSA-2005:584-01 2005-07-21
Ubuntu USN-151-1 2005-07-21
Debian DSA-763-1 2005-07-20

Comments (none posted)

Resources

Plash 1.14 released

Plash 1.14 is out. Plash is:

...is a secure, restricted execution environment for running Linux programs with the minimum necessary privileges. It is similar to using chroot jails, but is more lightweight and flexible. You can use Plash to grant a process read-only or read-write access to specific files and directories, which can be mapped at any point in its private filesystem namespace.

This release includes a new "file powerbox" capability which can allow a user to grant access to specific files to an application on the fly.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current stable 2.6 kernel is 2.6.14.2, released on November 10. 2.6.14.2 contains about a dozen fixes, including one for the zero-length datagram bug. It does not contain a fix for the file lease denial of service bug yet, however.

The current 2.6 prepatch is 2.6.15-rc1, announced by Linus on November 11. Says Linus:

It's hard to go through in any great detail, because even the shortlog is actually almost five thousand lines and about 200kB in size, and would thus run afoul of the mailing list limits so I can't include it here. The same is true of the diffstat, only even more so. The unidiff is about a million lines in size, just the diffstat is 300+kB.

The changes are really pretty much all over the place, with over four thousand commits merged in the two weeks since 2.6.14...

The changes in 2.6.15 have been listed in detail here last week and the week before. Significant changes merged since last week's article, but before 2.6.15-rc1, include a new, simpler, type-safe netlink API, a new netfilter connection tracking implementation (which understands IPv6 and will eventually replace the current code), the removal of some SCSI subsystem typedefs (Scsi_Device, Scsi_Pointer, and Scsi_Host_Template), the removal of the owner field from struct pci_driver, and a new "platform driver" interface.

For those who are just tuning in: some of the more significant changes in 2.6.15 will include device model changes, basic hotplug memory support, a reworked NTFS implementation with improved write behavior, a big CIFS update, a number of block improvements (and a reorganization of the block layer into its own top-level directory), the Open-iSCSI initiator, InfiniBand SCSI RDMA, RapidIO support, a number of scheduler tweaks, the shared subtrees patch, four-level page tables for the ia-64 architecture, and much more. See the short log for a long list of changes, or the long-format changelog for the details.

2.6.15-rc1 marks the closing of the window for new features, so Linus's git repository contains mostly fixes. It does, however, also include a generic cmpxchg implementation for i386, new Omnikey Cardman 4000 and 4040 drivers, and a new DMA32 zone for the x86-64 architecture.

The current -mm tree is 2.6.14-mm2. Recent changes to -mm include some relayfs enhancements, some scheduler tweaks, and various fixes.

The current 2.4 kernel is 2.4.32, released by Marcelo on November 16. 2.4 is in deep maintenance mode, so there's not a whole lot of new features in 2.4.32.

Comments (1 posted)

Kernel development news

HOWTO do Linux kernel development

Greg Kroah-Hartman has gotten tired of answering the same questions about Linux kernel development. So he has put together a HOWTO document to get people started. The goals are ambitious: "This is the be-all, end-all document on this topic. It contains instructions on how to become a Linux kernel developer and how to learn to work with the Linux kernel development community." Now people just have to read it...

Comments (6 posted)

4K stacks - again

The question of whether the i386 architecture should move to using 4K kernel stacks by default has been raised a few times; LWN last covered the 4K stack issue in September. Adrian Bunk has started the discussion anew with this proposal that the -mm tree go to 4K stacks (only) now, with an eye toward changing the mainline for 2.6.16.

Most of the technical issues have not changed since September, so those arguments will not be repeated here. It is worth noting that layered block devices and filesystems have mostly been fixed. In past kernels, highly stacked devices (think of a combination of RAID, encryption, and network filesystems) could end up with very long call chains in the kernel, and, as a result, overflow the kernel stack. Most of these calls have since been serialized, so block-layer stacking should not be a problem.

The issue that remains is NDISwrapper, the glue layer which allows Windows NDIS drivers to be loaded into a Linux kernel. Windows runs with a much larger kernel stack size, so NDIS driver writers have no reason to be as careful about stack usage. And, of course, these drivers cannot be fixed to work properly with Linux. Some have argued that breaking NDISwrapper is not a possibility, since many users rely upon it to make their wireless network adapters work. But patience with this line of thought is running thin, as can be seen in this outburst from Dave Jones:

If we continue down this path, we'll have no native wireless drivers for Linux. The answer is not to complain to linux-kernel for breaking ndiswrapper, but complain to the vendors for not releasing specifications for native drivers to be written.

The good news is that the wireless situation is not as bad as one might think. There is documentation for Broadcom chips available now, and a Broadcom driver is in the works. There is also an Atheros driver which is "nearly done." Once these drivers are complete and joined with the Intel drivers already in the mainline, Linux will have much better support for wireless devices, and far fewer systems will have any reason to use NDISwrapper.

There are a number of reasons for going with the 4K stack mode, including better performance and higher reliability. Some distributions (e.g. Fedora Core and RHEL) have been shipping 4K kernels for a while now. So, while nobody has committed to moving the mainline (or -mm) toward 4K-only yet, chances are improving that it will happen sometime in the not-too-distant future.

Comments (15 posted)

VM followup: page migration and fragmentation avoidance

Page migration is the act of moving a process's pages from one part of the system to another. Often, the motivation is moving pages between NUMA nodes in the hope of improving performance. When this page last looked at the page migration patch set, it worked by forcing target pages out to the swap device. When the owning process later faults them in, these pages will end up on the desired node. This technique works, but it is not optimal: it would be nicer to avoid having to write the pages to disk and read them back in.

Christoph Lameter has now followed up with the direct migration patch set, which does away with the side-trip to the swap device. A look at the patch shows why things were not done this way in the first place; direct page migration involves rather more than simply copying the data over. The first step, after choosing a target page, is to lock that page so that nobody else will mess with it. There might currently be I/O active which involves that page, so the kernel must wait for any such I/O to complete. Only then can the real migration work begin.

The kernel must establish a swap cache entry for the page, even though it intends to avoid writing the page to swap. This entry will cause the right thing to happen if a process faults on the page while it is being moved. Then all references to the page (page table entries) are unmapped. With luck, all references will go away; if references remain for any reason, the page cannot be moved.

Actually moving the page involves copying a subset of the page status bits over, copying the page data itself, then copying the rest of the status bits. The old page is cleared out and freed. If any writeback has been queued up for the new page, it is set in motion. Then it's just a matter of cleaning up, and the page has been successfully moved.

If the kernel runs out of free pages on the target node, it will fall back to the swap-based mechanism. So that stage of this patch's evolution remains useful.

With this code in place, the kernel has the support it needs to try to keep a process's pages in local memory. The migration code might also prove useful for hotplug memory uses, where all pages must be vacated from a given region. Indeed, some of this code was originally written for hotplug applications. But, at this point, the migration is done on a best-effort basis. For NUMA systems, failure to move a page results in worse performance, but nothing particularly severe. For hotplug memory, instead, this sort of failure will block a memory remove operation altogether. Moving all pages in a region with 100% certainty remains a difficult problem without a complete solution at this time.

One of the pieces of such a solution might be active memory defragmentation which, among other things, works to keep non-movable memory allocations out of memory regions which might be removed. When we looked at active defragmentation last week, that patch set looked like it was in trouble. The overhead of the defragmentation code seemed to be too high, and a number of developers (Linus included) felt that this sort of functionality should be implemented using the kernel's zone system, rather then with a new layer in the memory allocator.

Defragmentation hacker Mel Gorman doesn't give up that easily, however. He has posted a new, "light" version of the defragmentation patch which, he hopes, will be better received. As he describes it:

This is a much simplified anti-defragmentation approach that simply tries to keep kernel allocations in groups of 2^(MAX_ORDER-1) and easily reclaimed allocations in groups of 2^(MAX_ORDER-1). It uses no balancing, tunables special reserves and it introduces no new branches in the main path. For small memory systems, it can be disabled via a config option. In total, it adds 275 new lines of code with minimum changes made to the main path.

In this version of the patch, a new GFP flag (__GFP_EASYRCLM) is added; its presence indicates an allocation which the kernel can easily get back should the need arise. It is used for user-space pages (which can usually be forced out to backing store) and in a few other situations, such as for some kernel buffers. The buddy allocator already keeps track of memory in large chunks; the new code simply steers reclaimable allocations toward some chunks, while keeping the non-reclaimable allocations in others. In this way, it is hoped, there will be no situations where one non-movable page blocks the freeing of the large, contiguous region in which it is located.

The patch works by creating a "usemap" array tracking which kind of allocation is being done from each large chunk of memory. Mel also had to split the per-CPU free lists which are used to perform fast single-page allocations; now there are two such lists, one for each allocation type. From there, it is just a matter of taking allocations from the proper pile, depending on the __GFP_EASYRCLM flag.

This version certainly reduces the footprint and overhead of the defragmentation patches. It is still not the zone-based approach that others were pushing for, however. So it remains to be seen whether "active defragmentation lite" is, in the end, better received than its predecessors.

Comments (4 posted)

The end of isa_readb() and friends

The kernel has long had a series of functions which read and write memory locations in the legacy ISA memory range. These functions, with names like isa_readb(), require no special preparation to use, and they only work in the ISA hole. They also have been obsolete and deprecated for quite some time.

Recently, there has been an effort to finally get rid of isa_readb() and friends. To that end, Al Viro has posted a set of "isaectomy" patches which fix up the remaining callers (they are made to use ioremap() and the not quite as obsolete readb() family of functions) so that the old stuff can be deleted. One would think that this work would be uncontroversial, but Linus, it turns out, is unconvinced:

Hmm.. I actually believe that the isa_read() functions are more portable and easier to use than ioremap().

The reason? A platform will always know where any legacy ISA bus resides, while the "ioremap()" thing will depend on platform PCI code to have set the right offsets (and thus the resource addresses) for whatever bus the PCI device is on.

The fact is, however, that very little in-tree code still uses these functions. They are a deprecated interface to a very old and obsolete hardware standard, and they have few defenders. So anybody maintaining out-of-tree which still uses these functions might want to take warning: they probably will not stay around for much longer.

Comments (1 posted)

A software suspend decision point

The relative calm which has settled around the software suspend subsystem may be about to come to an end. This part of the kernel, which has never worked to everybody's satisfaction, remains subject to different ideas of how the problem should be solved.

Pavel Machek's user-space software suspend patch was covered here in September. Pavel has now posted a new version of the patch with a request that it be merged for 2.6.16. The user-space approach is, clearly, the way Pavel thinks that software suspend should go. Beyond getting some code out of the kernel, this approach makes a number of add-on features, such as graphical displays, image compression, image encryption, network-based suspend, etc., easier to implement. If you want to hang a big pile of features onto the suspend mechanism, you eventually have to get into user space.

One of the first responses came from Dave Jones, who said:

Just for info: If this goes in, Red Hat/Fedora kernels will fork swsusp development, as this method just will not work there.

The main issue is the fact that the user-space approach uses /dev/kmem to repopulate memory at resume time. Red Hat and Fedora kernels do not allow memory to be overwritten in this way; there are no other applications which need that capability, with the exception of rootkits. Allowing user space to overwrite arbitrary physical pages is, to Dave, not worth it, no matter how many software suspend features it enables. Says Dave: "I'll take 'rootkit doesnt work' over 'bells and whistles'."

Nigel Cunningham, the author of the Suspend2 patches, also has some thoughts on the matter. He has been busily cleaning up the suspend2 patches with an eye toward making them more palatable for merging into the mainline. It turns out that Nigel has a set of 225 patches which he will soon make available. Since few people have seen the new patch set, it's not clear what sort of reception it will get. It can be said, though, that 225 patches is a large pile of code. Anybody trying to get a patch set of that size merged needs to have some fairly convincing arguments in hand.

At some point, Nigel's code mountain will become available, and some sort of decision will have to be made. Software suspend could be transformed into suspend2, or moved partially to user space. Or it could be left more-or-less as it is now. These are three very distinct choices - especially as nobody wants to see a repeat of the situation where the mainline kernel supported more than one software suspend implementation. With luck, when the dust settles, Linux will have a more featureful and reliable software suspend implementation than it does now. But expect some interesting discussion between now and then.

Comments (5 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

  • dmitry pervushin: SPI. (November 11, 2005)

Documentation

Filesystems and block I/O

Memory management

Architecture-specific

Security-related

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

PC-BSD: FreeBSD For Dummies

November 16, 2005

This article was contributed by Ladislav Bodnar

With all the current attempts to make Linux as user-friendly and easy-to-use as possible, some might wonder why there has been so little effort to do the same with one of the BSDs. After all, FreeBSD has proven itself to be a fast, reliable and extremely stable workhorse, powering many of the world's most popular web servers and search engines. Although support for more exotic hardware in the BSD kernel usually lags behind that in Linux, many commonly used devices work well with any recent FreeBSD release. This, in addition to the availability of thousands of open source software packages (the recently released FreeBSD 6.0 includes over 12,000 ports), should make FreeBSD an ideal operating system for general computing, development work and perhaps even common office tasks.

Unfortunately, FreeBSD is not an easy operating system to set up as a desktop or workstation. It is perhaps even harder than setting up Slackware in the Linux world, as FreeBSD too requires a fair amount of dirty work and expert knowledge to mold it into a usable shape. With the curses-based sysconfig being just about the most user-friendly utility there is in FreeBSD, and where everything, even font anti-aliasing and sound module loading, requires extensive hacking in obscure configuration files, there is little wonder that FreeBSD, or indeed any other *BSD, has not taken over the desktops of ordinary users.

But this is about to change. Some six months ago a project called PC-BSD was born with a clear vision: to turn FreeBSD into a user-friendly and intuitive operating system that anybody can install and use without having to first obtain a computer science degree. Naturally, with so many new distributions launching all the time these days, it is easy to be skeptical about any new project with such lofty claims. Luckily, the response to the initial announcement was nothing short of overwhelming and the developers soon found themselves besieged by hundreds of enthusiastic users as well as experienced developers, translators and documentation writers who quickly set up channels for contributing to the project. Then, last week, they released a feature-complete release candidate which will shortly become the project's first official product - PC-BSD 1.0.

What exactly constitutes the "user-friendliness" of PC-BSD? Firstly, there is the installer. Based on the original FreeBSD live CD by FreeSBIE, the installation CD starts with auto-detecting and auto-configuring the system's video card before presenting the user with an installation interface somewhat resembling Red Hat's Anaconda. After selecting the keyboard layout, hard disk partition and a place to install the boot loader (with sensible defaults), the installer copies all applications from the CD to the hard disk. When done, the user is asked to set the root password and create a user account. That's it. Barring some unforeseen circumstances, a reboot will bring up KDE 3.4.3 with a scenic desktop wallpaper. FreeBSD has never looked so good!

Admittedly, the installation CD contains a rather minimal graphical system that is unlikely to satisfy most users. A quick solution to the problem is to visit pbiDIR, the official repository for .pbi packages or, in other words, a categorized collection of binary applications designed to work with PC-BSD. While not quite "click-n-run", the installation of .pbi files is fairly straightforward: after saving a .pbi package on the hard disk, a double-click will launch a package installation dialog (root password is required). This will guide the user through the process of installing the package and to make a couple of simple decisions, such as whether or not to place the application's icons in the KDE menu and/or on the desktop. All installed programs can be removed later from a graphical utility called "PC-BSD Package Manager". Although the number of .pbi software packages in the repository is fairly limited, the developers do provide instructions for creating these packages, so anybody can build and submit their preferred applications.

Since PC-BSD is essentially a dressed-up FreeBSD, the options of compiling applications from ports or installing binary ones with pkg_add are also available. In fact, the developers have created a graphical interface for downloading and installing the entire FreeBSD ports tree, although those who will want to take advantage of it will still need to reach for the command line. Likewise, downloading the FreeBSD kernel and userland sources is also just a mouse click away. Complementing the PC-BSD "System" utility is an option to switch to an SMP kernel, to enable or disable SSH, NFS, Samba and CUPS services, and to generate a diagnostic sheet - all from the comfort of a graphical user interface. Several Qt-based graphical tools for setting up monitor, network, users, printing, etc. are also available, while a custom "Online Update" utility will upgrade the installed system to a new version without the need to re-install.

I spent a couple of days examining the RC1 of PC-BSD 1.0 on a spare Pentium 4 computer with a Matrox graphics card, Sound Blaster Live! sound card and a Realtek 8139too network card. All of the hardware was detected and set up correctly during installation (except for the screen resolution which needed a quick adjustment). I also installed and removed a number of .pbi packages and even compiled a few ports from source - all without the slightest hitch. The system felt fast and responsive and the boot and shutdown times were noticeably shorter than those of most Linux distributions. The project has a well-designed web site with good basic installation documentation and highly active user forums frequented by many obvious beginners to BSD. Perhaps the only real drawback of PC-BSD, from the point of view of a novice user, is the relatively low number of easily-installable .pbi packages, but this can only improve with time.

PC-BSD is currently the best attempt at developing a desktop FreeBSD operating system with "a human face", and certainly the easiest way to get a FreeBSD desktop up and running without any toiling on the command line. Despite the project's young age, it has already achieved most of the early goals of producing a usable desktop FreeBSD for non-technical users where system installation and essential configuration can be effected with a mouse. More unexpectedly, there seems to be plenty of momentum and excitement about the project. It will be interesting to see whether PC-BSD will be able to popularize FreeBSD as an operating system that can be used by ordinary people, not just seasoned UNIX hackers.

Comments (10 posted)

New Releases

Xandros Launches German Desktop Operating System

Xandros has released a German version of its desktop operating system at the Frankfurt LinuxWorld Conference and Expo. "New features in the German package include NoMachine thin client support and OpenOffice.org 2.0 for creating standards-based documents and spreadsheets."

Full Story (comments: none)

Distribution News

How Delegation Works, in 10 Easy Steps

Debian Project Leader Branden Robinson looks at delegation of responsibilities. "The Constitution of the Debian Project specifies a decision making process known as "delegation", which the Debian Project Leader can use to spread decision-making authority throughout the Project. Historically, this power has been underused (including by myself), particularly in areas of infrastructural administration. This turns out not to be due to past (or present) Project Leaders' lack of motivation or desire to do so."

Full Story (comments: none)

Debian Installer etch beta 1 released

The Debian installer is getting an update for the etch release. The first beta is out, with lots of improvements. Click below for a list of new features.

Full Story (comments: none)

Debian library renaming due to changed libstdc++ configuration

Another round of package renamings of some libraries written in C++ is needed. Click below to find out more.

Full Story (comments: none)

New (experimental) Debtags package search page

Enrico Zini has announced (click below) a a new kind of package search. "It's an experimental new way of searching Debian packages: you start with a normal text search, and then you work with categories."

Full Story (comments: none)

Ubuntu Dapper

This announcement covers changes in Dapper's menu system.

Dapper has a new 2.6.15-2.2 (2.6.15-rc1 based) kernel available for AMD64 and x86. The PowerPC kernel was not available at the time of the writing, but it should be available soon.

Comments (none posted)

fedora-netdev kernel repository

John W. Linville has announced the availability of a new Fedora-based kernel repository. The kernels available there are based upon the standard Fedora kernels, with the addition of current upstream networking patches which are more recent than the Fedora kernel's upstream base. Click below for the announcement or find out more here.

Full Story (comments: none)

Debian miniconf@LCA2006: call for presentations

The LCA Debian miniconf is set for January 23-24, 2006 in Dunedin, New Zealand. As usual, the Debian miniconf precedes the annual Geek migration to the warmer climes of the southern hemisphere known as linux.conf.au.

Full Story (comments: none)

Mandriva Linux : Worldwide install-party

Mandriva Linux is planning on an international install party on Saturday, November 19, 2005. "Following the release of Mandriva Linux 2006, Mandriva is mobilizing its network of Linux User Groups (LUGs). Free community installation sessions will take place around the world. Major participating locations include the United States, Brazil, Canada, China, Moroco, and the island of Reunion. More than 60 cities are involved, including a dozen in China and 15 and Brazil."

Full Story (comments: 2)

New Distributions

Bent Linux

Bent Linux is a compact Linux distribution, inspired by Linux From Scratch. It uses Busybox, uClibc, and static linking to keep the size down. "It's particularly suited to building dedicated servers, initrds for custom installers and rescue disks, and systems with a nice crisp mid-1980s mouthfeel to satisfy the mid-life crises of crusty curmudgeons." (Thanks to Wladimir Mutel, who is running Bent on an AM386 test box with 8 MB of RAM.)

Comments (none posted)

G-ZyX

G-ZyX is a Fedora based distribution with a collection of open source software that runs from a single CD/DVD. Optional configurationless installation (smart caching) to available hard disk or flash based storage is supported. G-ZyX is the flagship manifestation of the ViROS distribution generation platform. ViROS leverages popular open and free RPM based *nix distributions to generate custom purpose live-CDs. G-ZyX's predecessor cousin TVOS is suited for home theater applications, while G-ZyX is suited for general purpose computing and development. An alpha release of G-ZyX is currently available.

Comments (none posted)

Distribution Newsletters

Debian Weekly News

The November 15 Debian Weekly News is out. This week's topics include the big-endian ARM port, the first beta of the Etch installer, the debate over Debconf licensing, and more.

Full Story (comments: none)

Fedora Weekly News

The Fedora Weekly News, issue #22, looks at the Linux Worm Lupii, the new Fedora Logo, a logo lesson, Fedora International community websites, FOSS India 2005 Fedora slides, and several other topics.

Comments (none posted)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of November 14, 2005 is out. This week's edition notes the switch to stage3 as the default installation method, an interview with Douglas Robertson about his video jukeboxes on Gentoo, Gentoo at the LWE and DevCon in the Frankfurt/Main area, and more.

Comments (none posted)

DistroWatch Weekly, Issue 126

The DistroWatch Weekly for November 14, 2005 is out. "The controversy over Nexenta's use of GPL software in its OpenSolaris-based distribution and the never-ending GNOME vs KDE flame wars dominated the headlines last week. We will briefly look at the above stories before examining other interesting events and releases of the week. We also feature an exclusive interview with Barry Kauler, the founder and lead developer of the increasingly popular Puppy Linux. And to prove that a new distribution is born just about every day, we have added seven new ones to the waiting list last week - including a controversial one called "Open Windows", developed by -- wait for this -- a law firm!"

Comments (none posted)

Package updates

Fedora updates

Fedora Core 4 updates: kernel-2.6.14-1.1637_FC4 (rebases to 2.6.14.1 and includes several patches), net-tools (bug fixes), mc (bug fixes, update to the 4.6.1a branch), kdenetwork (rebuild against new wireless-tools), kdebindings (3.4.2-0.fc4.2), chkconfig-1.3.22-0.4 (bug fixes), gaim (bug fixes), chkconfig-1.3.23-0.4 (more bug fixes), xterm (upgrade to upstream version 205), pkgconfig (update to 0.20.0), ghostscript (fix lips4v driver), shadow-utils (fix useradd segfaults), mc (new slang support).

Fedora Core 3 updates: gaim (bug fixes), mc (new slang support).

Comments (none posted)

Mandriva updates

Updates for 2006.0: scim-qtimm (fix for 2006/x86_64), e2fsprogs (fix segfault in mklost+found), ldetect-lst (bug fix), drakxtools (multiple bug fixes), autofs (bug fix), acpid (bug fixes).

Comments (none posted)

Newsletters and articles of interest

The Perfect Xen Setup For Debian And Ubuntu (HowtoForge)

HowtoForge has a tutorial on setting up Xen on a Debian Sarge box. "This tutorial provides step-by-step instructions on how to install Xen (version 2) on a Debian Sarge (3.1) system. It should apply to Ubuntu systems with little or no modifications. Xen lets you create guest operating systems (*nix operating systems like Linux and FreeBSD), so called "virtual machines" or domUs, under a host operating system (dom0). Using Xen you can separate your applications into different virtual machines that are totally independent from each other (e.g. a virtual machine for a mail server, a virtual machine for a high-traffic web site, another virtual machine that serves your customers' web sites, a virtual machine for DNS, etc.), but still use the same hardware."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Asterisk - the Open-Source PBX

November is shaping up to be a month of important Linux Telephony releases. Two weeks ago, we examined the GNU Bayonne 2 Telephony Application Server. This week, we look at Asterisk, an open-source PBX (Private Branch eXchange).

[Asterisk] The Asterisk description states:

Asterisk is a complete PBX in software. It runs on Linux, BSD and MacOSX and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in many protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware.

Version 1.2 of Asterisk was released at the IP.4.IT Conference this week: "Asterisk 1.2 is the first major revision to Asterisk since the release of Asterisk 1.0 in September 2004, and includes over 3,000 feature additions and improvements to the overall performance and efficiency of memory usage."

The original author of Asterisk is Mark Spencer, president of Digium, Inc. Digium is a supplier of PC telephony cards and telephony systems, and is sponsoring Asterisk development. The company also sells Asterisk Business Edition, a commercial version of the software. The software is being developed by a wide variety of programmers, using the standard open-source development model. Asterisk has been licensed under version 2 of the GNU General Public License (GPL).

Asterisk's feature set and list of supported protocols is lengthy. A few highlights include:

  • Architected as a central PBX core with loadable module APIs.
  • Works as a traditional PBX on standard telephone lines.
  • Supports Voice over IP (VoIP).
  • No special hardware is required for VoIP use.
  • Supports switching between all of the supported interfaces.
  • Supports connection to other Asterisk PBX instances for scalability.
  • Supports both U.S. and European standard signaling protocols.
  • Runs on Linux, OpenBSD, FreeBSD, and Mac OS X.
  • Works with a wide variety of telephony hardware.
  • Has free and commercial customer support options.
Asterisk looks like a fun and active open-source project, those with needs for both simple and complex PBX systems would be advised to give it a try. The code is available for download here.

Comments (4 posted)

System Applications

Database Software

PostgreSQL Weekly News

The November 13, 2005 edition of the PostgreSQL Weekly News is out with the latest PostgreSQL articles.

Full Story (comments: 1)

Interoperability

Samba 3.0.21rc1 Available for Download

Version 3.0.21rc1 of Samba has been announced. "This is a release candidate of the 3.0.21 code base and is provided for testing purposes only. While close to the final stable release, this snapshot is *not* intended for production servers."

Full Story (comments: none)

Networking Tools

Shorewall 3.0.0 released

Version 3.0.0 of Shorewall, an iptables based firewall with flexible configuration, is out with several new features.

Full Story (comments: none)

Printing

How To Assign Printing Administration Capabilities To Users (CUPS)

A new CUPS printing system tutorial is available: "If you want certain users to have access to administer printers and nothing else, you need to create a group."

Comments (none posted)

Miscellaneous

Bootchart 0.9 Released (SourceForge)

Version 0.9 of Bootchart, is a tool for performance analysis and visualization of the GNU/Linux boot process, is available. "Version 0.9 introduces application monitoring, alternative init invocation (e.g. initng) and offers better FHS compliance."

Comments (none posted)

Desktop Applications

Audio Applications

LDAS 0.1.1 Released

Version 0.1.1 of LDAS, the Low Delay Audio Streamer, is out with code improvements. Here's the change notice: "More correct use of the memory mapped access to the sound card when copying data from the queue to the sound card. The code should now be more generic, and work for more sound cards."

Full Story (comments: none)

Business Applications

WyattERP version 0.30.1 Released (SourceForge)

Version 0.30.1 of WyattERP, an enterprise resource and management application, has been released. "WyattERP is a set of tools to create customized, integrated ERP modules for small businesses. It has been developed and tested with the assistance of Action Target, Inc. This new release features Wylib and Wyseman as separate entities. Wylib enables the creation of tcl/tk ERP modules that closely tie into the database model created and managed by Wyseman."

Comments (none posted)

Desktop Environments

GNOME 2.13.2 Released

GNOME 2.13.2 has been announced. "This is our second development release on our road towards GNOME 2.14.0, which will be released in March 2006."

Full Story (comments: 1)

First weekly status report on GNOME Dictionary

Emmanuele Bassi has announced the first GNOME Dictionary status report. "In order to let others know how's the status of GNOME Dictionary Breaking is progressing (and in order to force myself hacking on it regularly ;-)), I'm sending the Not So Weekly Status Report on GNOME Dictionary Containing the status of the review-slash-breaking-slash-rewrite process of the GNOME Dictionary application and applet."

Full Story (comments: none)

Clearlooks Gtk-engine cairo patch (GnomeDesktop)

If you like animated controls on your desktop, take a look at the Clearlooks gtk-engine patch. "tirpse (aka SchAmane) made an Clearlooks gtk-engine patch to get animated progressbar and checkboxes using cairo. Just download latest clearlooks gtk-engine CVS, patch and compile."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced this week: You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

Announcing KDE 3.5 Release Candidate

KDE 3.5 is about to be finished, and the first release candidate is now available for testing. "Because of the short timeframe for the release candidates we don't give the distributors a head start of one week for binary packages..."

Full Story (comments: none)

Oxygen Icons Website Launched (KDE.News)

KDE.News notes the launch of the Oxygen web site. Oxygen is the look and feel of the upcoming (someday) KDE4 desktop, so the site gives some hints of what KDE users can expect to be working with in the future.

Comments (11 posted)

OpenSync and KDE Cooperate on Unified Data Syncing (KDE.News)

KDE.News covers a collaboration between OpenSync and KDE. "The OpenSync and KDE teams have joined forces to create a unified library to synchronize data from mobile devices with the data on the desktop. OpenSync, the successor to the MultiSync project, provides a modular desktop-independent synchronization platform. It can be extended by plugins to support additional devices and data types. Plugins for the most commonly used devices and applications such as Kontact, Palm, Windows CE, mobile phones and more are already available or under development. KDE has now adopted OpenSync as the base for its future synchronization tools."

Comments (1 posted)

KDE Software Announcements

The following new KDE software has been announced this week: You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

X11R6.9/X11R7 Release Candidate 2 ready for testing

Release Candidate 2 of the X11R6.9/X11R7 window system is out. "This RC includes many bug fixes and updates since the first RC. We have tagged both the monolithic and modular trees and have prepared tarballs for you to test."

Full Story (comments: 2)

Xfce 4.2.3.1 released

Version 4.2.3.1 of the Xfce lightweight desktop environment is out. "A new bug fix release of Xfce is finally available, after almost 6 months!" See the change log file for details.

Comments (none posted)

Electronics

LEDLoad hardware/software project

The LEDLoad project has been launched. "LEDLoad is a CPU load display using a single dual color LED. It is designed to use a free internal USB port of any modern PC and replace the power LED in the case with something more interesting. A host driver kernel module is available for Linux."

Comments (none posted)

XCircuit 3.4.9 released

Version 3.4.9 of XCircuit, an electronic schematic drawing package, is available. This release features a number of bug fixes.

Comments (none posted)

Graphics

ShadeVis 1.00 Released (SourceForge)

Version 1.00 of ShadeVis has been announced. "The ShadeVis tool computes a simple static, but much more correct, per-vertex ambient term. This effect, commonly known as ambient occlusion, is aimed to provide more faithful shading for realtime rendering. In practice rather than considering the ambient lighting to exist uniformally throughout a scene, this approach determines the ambient brightness of each part of a surface to be proportional to the extent to which the surface has "its outward view of its environment" free i.e. ''occluded'', by other surfaces of the object. Inner part will therefore appear darker."

Comments (none posted)

GUI Packages

PyQt 3.15.1 announced

Version 3.15.1 of PyQt, a comprehensive set of Python bindings for the Qt GUI toolkit, has been announced, it features minor bug fixes.

Comments (none posted)

Interoperability

Wine 0.9.1 released

Version 0.9.1 of Wine ("a free implementation of Windows on Unix") is out. Here are the changes: "Support for Find function in regedit, Winelib app to eject a CD, Many MSI improvements, Better support for running text-mode apps without X, Improved support for various code obfuscation tools, and Lots of bug fixes."

Comments (none posted)

Mail Clients

bogofilter 0.96.6 Released

Version 0.96.6 of bogofilter, a Bayesian email filter, is out with bug fixes.

Full Story (comments: none)

Medical Applications

ClearHealth Version 1.0 RC2 Update (LinuxMedNews)

Version 1.0 RC2 of ClearHealth, an open-source medical suite, has been announced. "After a long testing and packaging cycle RC2 is finally available. This release includes numerous fixes, enhancements and entirely new features. Some of these highlights include comprehensive billing support (CA Medicare and CA Medicaid tested/certified), graphical installer and performance improvements."

Comments (none posted)

OpenEMR 2.8.0 Released (LinuxMedNews)

Version 2.8.0 of the OpenEMR electronic medical record system has been announced, it includes a long list of new features. "Today OpenEMR version 2.8.0 is released for download at the project's SourceForge site. Concurrently, a companion FreeB release 0.11 is available."

Comments (none posted)

Open Healthcare Framework - Eclipse (LinuxMedNews)

LinuxMedNews looks at an Open Healthcare Framework extension to the Eclipse development framework. "eclipse.org states: 'The goal of the Open Healthcare Framework (OHF) is to extend the Eclipse Platform to create an open-source framework for building interoperable, extensible healthcare systems.'"

Comments (none posted)

Office Applications

HylaFAX 4.2.3 Released

Version 4.2.3 of Hylafax, a fax modem application, has been announced. Changes include a security update, bug fixes, and new capabilities.

Comments (none posted)

Office Suites

Korn: Massachusetts, Open Document, and Accessibility

Peter Korn, an accessibility architect at Sun, has posted a detailed look at accessibility issues involving OpenOffice and the OpenDocument format. "The accessibility issues affecting people with disabilities in the applications that read and write Open Document Format are real. While some users with some disabilities should have no difficulty with ODF (and in fact in some specific cases an improved experience), for others a move to Open Document capable applications today would have significant impacts on their productivity and efficiency. However, the first significant Open Document deployment affecting people with disabilities - in the State of Massachusetts - is still nearly 14 months away."

Comments (none posted)

Science

Release 1.0 of StrBio Java classes (SourceForge)

The 1.0 release of the StrBio Java classes have been announced, the code has just been released under the LGPL license. "The StrBio library is a set of Java classes useful for development of software for computational structural biology research. These classes are the basis for software in several published research projects, including the Pred2ary secondary structure prediction software, the JThread fold prediction algorithm, and parts of the ASTRAL Compendium for Sequence and Structure Analysis (http://astral.berkeley.edu)."

Comments (none posted)

Video Applications

CinePaint 0.20 Released (SourceForge)

Version 0.20 of CinePaint has been released. "CinePaint version 0.20 is a major release of the popular motion picture deep colour paint and retouching program. Thanks to Kai-Uwe Behrmann for creating this release. This release is the latest Film Gimp (GTK) version of CinePaint. CinePaint developers continue to maintain this legacy architecture until the future Glasgow architecture is complete (in 2006)."

Comments (none posted)

DVDStyler v1.5 beta 2 Released

Version 1.5 beta 2 of DVDStyler, a cross-platform DVD (movie) authoring system, is available. Changes include bug fixes, translation work, and more.

Comments (none posted)

Web Browsers

Mozilla Firefox 1.5 Release Candidate 2 Available (MozillaZine)

MozillaZine has announced the second release candidate of Mozilla Firefox 1.5. "Like the first release candidate, Mozilla Firefox 1.5 Release Candidate 2 is intended to allow testers to ensure that there are no last-minute problems with the Firefox 1.5 code."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The November 8-15, 2005 edition of the Caml Weekly News is out with the latest Caml language articles.

Full Story (comments: none)

Java

Jericho HTML Parser 2.0 released (SourceForge)

Version 2.0 of Jericho HTML Parser, a Java library which supports the manipulation of HTML documents, has been announced. "Version 2.0 is a complete rewrite of previous versions, including the core parser and caching mechanism. The major new feature in 2.0, in addition to the HTML form manipulation features added in 1.5-dev, is the ability to easily define new tag types for recognition by the parser. Performance is also greatly improved and the documentation has been expanded significantly."

Comments (none posted)

Lisp

ECL 0.9h released

Version 0.9h of Embeddable Common-Lisp has been announced. "This version reduces memory usage, improves the FFI, includes new build scripts, now runs also on OpenBSD, and fixes a few bugs."

Full Story (comments: none)

PHP

XOAD 0.6.0.0 released (SourceForge)

Version 0.6.0.0 of XOAD is out with several new features. "XOAD is a PHP based AJAX/XAP object oriented framework that allows you to create richer web applications. Formerly known as NAJAX, XOAD has many benefits: it uses JSON, supports server / client side events, HTML manipulation, Caching and many more."

Comments (none posted)

PostScript

AFPL Ghostscript 8.53

Release 8.53 of AFPL Ghostscript has been released. "Artifex Software, Inc. and artofcode LLC are pleased to announce the release of AFPL Ghostscript 8.53. This is a maintenance release in the stable 8.5x series." Changes include bug fixes, performance improvements, and more.

Comments (none posted)

Prolog

JLog 1.3.4 Released (SourceForge)

Version 1.3.4 of JLog, a Prolog interpreter written in Java, is available. "Version 1.3.4 includes a substantial number of improvements and refinements, introduced throughout the development cycle of the 1.3.0-1.3.3 Developer Preview versions."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The November 16, 2005 edition of Dr. Dobb's Python-URL! is online with a new collection of Python article links.

Full Story (comments: none)

PySizer 0.1 announced

The 0.1 release of PySizer has been announced. "I'd like to announce the first release of PySizer, a memory usage profiler for Python code. PySizer was written as part of Google's Summer of Code."

Comments (none posted)

Ruby

Ruby Weekly News

The November 13th, 2005 edition of the Ruby Weekly News looks at the latest discussions from the ruby-talk mailing list.

Comments (none posted)

REXML: Processing XML in Ruby

Koen Vervloesem introduces REXML in an O'Reilly article. "REXML (Ruby Electric XML) is the XML processor of choice for Ruby programmers. It comes bundled with the standard Ruby distribution. It's fast, written in Ruby, and can be used in two ways: tree parsing and stream parsing. In this article, we show some basic constructs on how to use REXML for XML processing. We also introduce the use of Ruby's interactive debugger irb for exploring XML documents with the help of REXML."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The November 15, 2005 edition of Dr. Dobb's Tcl-URL! is available. Take a look for new Tcl/Tk articles and resources.

Full Story (comments: none)

Miscellaneous

aegis 4.21 released

Version 4.21 of aegis, a transaction-based, software configuration management system, is out with lots of new features and bug fixes.

Full Story (comments: none)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

New approaches to Linux package management (Linux.com)

Linux.com looks at package management tools such as Portage and Conary. "Traditional Linux package management systems such as RPM, Debian's dpkg, and Slackware's pkgtool present several problems for users. Users who want optimized packages often have problems finding them, different package repositories have conflicting naming conventions, and binary packages are often not available for packages in a timely fashion. However, for users willing to stray from the beaten path, there are alternatives. Two projects have taken up the challenge of making a package management system that overcomes these shortcomings."

Comments (50 posted)

Saving the Net (Linux Journal)

The Linux Journal is running a lengthy piece by Doc Searls on threats to open networking. "The carriers are going to lobby for the laws and regulations they need, and they're going to do the deals they need to do. The new system will be theirs, not ours. The NEA principle--Nobody owns it, Everybody can use it, Anybody can improve it--so familiar to the Free Software and Open Source communities will prove to be a temporary ideal, a geek conceit. Code is not Law. Culture is not Free. From the Big Boys' perspective, code and culture are stuff nobody cares about. That's us: Nobody."

Comments (14 posted)

Sony Numbers Add Up to Trouble (Wired)

Wired reports on some research done by Dan Kaminsky. He queried DNS servers worldwide to see if they had the addresses of Sony's "mother ship" systems cached. "The results have surprised Kaminsky himself: 568,200 DNS servers knew about the Sony addresses. With no other reason for people to visit them, that points to one or more computers behind those DNS servers that are Sony-compromised. That's one in six DNS servers, across a statistical sampling of one third of the 9 million DNS servers Kaminsky estimates are on the net."

Comments (11 posted)

Trade Shows and Conferences

Cruise Report 3: New Species Discovered at Sea (Linux Journal)

Doc Searls has another report from last month's Geek Cruise. "This is what I learned from Andrew [Morton] and Ted [Ts'o]. After sitting in on their sessions (which ran many hours--the cruise was something of a crash course at sea), I realized that Linux's nature, as a building material, is akin to that of a species."

Comments (none posted)

Open Source Symposium report (NewsForge)

NewsForge has this report from Seneca College's fourth annual Open Source Symposium. "A fourth speaker, Stephen Downes, a senior researcher with the National Research Council of Canada, laid out a challenge to not only open software, but open content. He spoke of the different business models and different approaches of commercial/proprietary vs. open source. Part of the distinction is the different distribution models for not only the software, but the content, he said. The current World Wide Web is somewhere between closed and open, what he called "never never land, neither here nor there.""

Comments (none posted)

Autumn Symposium Rakes Over Copyright and Patent Law (O'ReillyNet)

Andy Oram reports on the recent Symposium on Intellectual Property, Creativity, and the Innovation Process. "The glow of this conference lingers on in the shape of a new center that has just been announced by the law school at the University of North Carolina at Chapel Hill, a conference sponsor. Conference organizer David Harrison says of the center that "Leading researchers and practitioners in all areas that depend upon innovation and creativity will work together to achieve real change through practical applications. The center is intended to provide applied solutions to preserving and promoting the creative incentives necessary for social, cultural, and economic growth." My hope is it will lead to more conferences of this nature and ultimately, new policy."

Comments (none posted)

Companies

Musical chairs continues at Novell (DesktopLinux.com)

DesktopLinux.com covers the resignation of Hubert Mantel from Novell Inc. "In the latest bit of personnel-related news from beleaguered Linux software/services provider Novell Inc., Nuremburg, Germany-based SUSE Linux founder Hubert Mantel announced his resignation Tuesday via email to friends and business associates on one of the SUSE mailing lists. Mantel, chief maintainer of the SUSE Linux kernel, simply said in the brief letter that he could no longer work for the company any longer."

Comments (6 posted)

Sleepycat - a blue ribbon example of open source financial success (IT Manager's Journal)

IT Manager's Journal looks at the successful business model used by Sleepycat software, the company that produces the Berkeley DB database. "What originally piqued my interest in Sleepycat was the question of why a company that claimed to be as successful as Sleepycat was still private and, to the best of my knowledge, did not have a single venture capitalist on its board of directors, nor is it beholden to one or more venture capital (VC) groups. To find out the answers, I got in touch with Rex Wang, vice president of marketing for Sleepycat. Wang confirmed that Sleepycat is an extremely profitable concern. Sleepycat employs about 30 people, and is looking to add to that workforce as it expands the company. Moreover, Sleepycat has not just refrained from using venture capital, the company does not even borrow money to finance its development. The company funds itself entirely from the profits it receives from its license fees."

Comments (11 posted)

Linux Adoption

New Linux phone standards effort in the works (ZDNet)

ZDNet reports on the creation of another Linux-based phone standards effort. "The Linux Phone Standard (Lips) Forum wants to standardize Linux interfaces so that higher-level software won't have to be customized for each variation of the open-source operating system appearing in different cell phone models. If successful, the allies believe they'll make Linux a better competitor the fast-growing market."

Comments (5 posted)

Dutch Record Shop Chain Migrates 1000 PCs to Linux (KDE.News)

KDE.News presents a translated article from Automatiseringsgids magazine about the use of KDE and Linux at a Dutch record store chain. "At first glance, a shop is not a place where you would expect to find KDE in the workplace. Yet the Dutch Free Record Shop is deploying it on a large scale as the operating system for their point of sale systems. According to the supplier Novell, it is one of the application areas where simple and restricted functionality is required, leading to a breakthrough for GNU/Linux on the PC."

Comments (none posted)

Linux at Work

Linux continues supercomputer domination (NewsForge)

NewsForge looks at Linux in supercomputing. "The last few Top500 Supercomputer Site lists left little doubt that Linux is the operating system of choice for these bleeding edge systems, but the latest list highlights the popularity of Linux in supercomputing and cites it as the OS of choice for 78% of the world's fastest machines. 391 of the systems rely on Linux of one flavor or another -- far more than Unix (yesterday's supercomputing king), Mac OS X, Solaris, or any others. Microsoft Windows didn't even turn up on the list."

Comments (3 posted)

Resources

Avoid Common Pitfalls in Greasemonkey (O'ReillyNet)

O'ReillyNet looks at security concerns and scripting pitfalls in Greasemonkey. "Once upon a time, there was a security hole. (This is not your standard fairy tale. Stay with me.) Greasemonkey's architecture has changed substantially since it was first written. Version 0.3, the first version to gain wide popularity, had a fundamental security flaw: it trusted the remote page too much when it injected and executed user scripts."

Comments (none posted)

CLI Magic: netcat (Linux.com)

Linux.com introduces netcat. "In the simplest terms, netcat is a utility that reads and writes data across the network. As you probably know already, you can write to a file or read from a file on your local machine using the cat utility. By running cat filename > filename2 , you can write the contents of a file to another file. By using cat > filename , you can write directly to a file from standard input."

Comments (3 posted)

Using Perl in PostgreSQL (O'ReillyNet)

O'ReillyNet uses Perl to write server-side extensions to PostgreSQL. "In fact, PostgreSQL lets you create server-side routines in quite a few languages, including one called PL/PGSQL that is all its own, and is somewhat similar to Oracle's PL/SQL. The PostgreSQL core distribution supports and maintains three other procedural language interfaces to third-party interpreters: Perl, Python, and Tcl (the first procedural language that PostgreSQL supported). There are also other languages maintained outside of the core distribution for various reasons, including PL/Java (or an alternative flavor, PL/J), Pl/R, PL/Ruby, PL/PHP, and a vastly better PL/Python. If you, like me, are at home in Perl, you will probably want to write your server-side functions in Perl, too."

Comments (none posted)

At the Sounding Edge: Music Notation Software for Linux, Part 2 (Linux Journal)

Dave Phillips covers music notation software for Linux, on Linux Journal. "CMN is a powerful music notation specification language. Although it lacks a mouse-driven graphical interface, the language elements will be immediately familiar to users who know the naming conventions for common, and some not so common, music notation symbols. CMN is capable of handling almost any scoring requirement, including many 20th century additions to the standard notation symbol palette."

Comments (none posted)

Reviews

Enhancing kernel security with grsecurity (Linux.com)

Linux.com has takes a look at grsecurity. "If the prospect of configuring 30+ options seems daunting, relax. You can choose from predefined low, medium, and high settings. In fact, it's a good idea to start with the low setting and see how things go. After rebooting into the grsecurity-enhanced kernel, check that all of your services are still running. If everything goes okay, try bumping the security level up to medium and then up to high. There is also a custom setting that allows you to mix and match options."

Comments (none posted)

Inside a Luxury Synth (O'Reilly)

O'Reilly's digital media site has a review of the Korg OASYS, a high-end digital synthesizer. "In fact, Linux's greatest success on the OASYS project may be that it's almost entirely invisible, letting Korg's designers focus on their proprietary sound engine. That was a big part of the appeal to Korg. 'You can change things easily in Linux,' says Phillips. 'There's more granularity when you compile the kernel.'"

Comments (none posted)

PunBB: A simple, speedy bulletin board (NewsForge)

Joe 'Zonker' Brockmeier reviews PunBB on NewsForge. "For some time now, I've been looking for a good, open source bulletin board package to run a discussion board on my Web site. After a lot of searching, I've settled on PunBB because it offers the features that I want, and is available under the GNU General Public License (GPL). PunBB is extremely easy to set up and configure. The requirements are minimal, and the entire procedure should take only a few minutes for users who are moderately familiar with Linux."

Comments (3 posted)

Project management with Trac (NewsForge)

NewsForge looks at managing projects with Trac. "Trac integrates a capable wiki engine with a number of project management features. In particular, Trac provides a Web-based interface to a Subversion source code repository, a job/bug ticketing system, and basic scheduling features. Each of these is integrated with the wiki engine. Trac can be readily adapted to nearly any project management style."

Comments (none posted)

Miscellaneous

Linux backers form patent-sharing firm (ZDNet)

ZDNet covers the launch of the Open Inventions Network. "Patents owned by OIN will be available without payment of royalties to any company, institution or individual that agrees not to assert its patents against others who have signed a license with OIN, when using certain Linux-related software." This company has been formed by IBM, Sony, Royal Philips Electronics, Red Hat, and Novell.

Comments (2 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Public Patent Foundation challenges JPEG patent

The Public Patent Foundation has announced that it has filed a formal challenge to the image compression patent currently being used by Forgent in its shakedown attempts. The full request for reexamination is available in PDF format.

Comments (5 posted)

Sony's rootkit EULA

One might think that Sony's rootkit-installing CD was bad enough as it was. But the EFF read the accompanying license agreement and found that it gets worse. "Sony-BMG can install and use backdoors in the copy protection software or media player to 'enforce their rights' against you, at any time, without notice. And Sony-BMG disclaims any liability if this 'self help' crashes your computer, exposes you to security risks, or any other harm."

Comments (10 posted)

Commercial announcements

Cell Broadband Engine Software Development Kit Version 1.0

IBM has released version 1.0 of the Cell Broadband Engine Software Development Kit "The Cell Broadband Engine (CBE) is a breakthrough microprocessor with unique capabilities for applications requiring video, 3D graphics, or high-performance computation for imaging, security, visualization, healthcare, surveillance and more. Based on the Power ArchitectureTM, a choreographed high-bandwidth memory architecture, and multicore technology, the Cell BE has been shown to accelerate some algorithms to many times the speed of a traditional microprocessor. Cell Broadband Engine (CBE) Software Development Kit Version 1.0 provides everything Cell software developers need to create, build, simulate, and test Cell applications. The SDK enables a cross development environment which is hosted on fedora 4/x86 platforms."

Comments (17 posted)

IBM Teams Up With Net Integration

IBM and Net Integration Technologies have announced a partnership. "Net Integration's Nitix for application servers has obtained "Ready for IBM DB2 Software for Linux" designation. With IBM DB2 universal database on Net Integrations Nitix technology, SME's can benefit from affordable autonomic features such as Linux reliability, affordability, intelligent and quick installation, and automatic back up of application program files and data."

Full Story (comments: none)

Mercury and Terra Soft Offer Linux for Cell-based Products

Mercury Computer Systems, Inc. has announced its collaboration with Terra Soft Solutions to deliver a complete Linux distribution for the Mercury Dual Cell-Based Blade. The Dual Cell-Based Blade is Mercury's first product based on the IBM(R) Cell BE (Broadband Engine) processor.

Full Story (comments: none)

Here comes another Microsoft-funded report

It seems we were due for yet another Microsoft-funded study showing what an expensive pain Linux is. "To compare reliability and manageability differences between Microsoft Windows- and Linux-based solutions, SI delved into the true extent that maintenance, patch application and system failures contribute to IT pain and cost as business requirements evolve over time. Simulating a real-world enterprise e-commerce environment over the course of a year, SI compared two teams of experienced IT administrators as they maintained and enhanced on Windows Server 2000 and Novell SUSE Enterprise Linux 8, then upgraded to Windows Server 2003 and Novell SUSE Enterprise Linux 9, respectively." Reading the results, one might wonder how people manage to operate Linux systems at all.

Comments (18 posted)

OpenMFG Launches Development Partner Program

OpenMFG, LLC has announced an expansion of its OpenMFG Partner Program. "The new program will significantly expand the opportunities for developers and systems integrators to build software solutions on the OpenMFG platform. OpenMFG's flagship product is an advanced Enterprise Resource Planning (ERP) software solution built with open source components, such as the Linux operating system, the PostgreSQL database, and the OpenRPT report writer."

Comments (none posted)

PalmSource Joins Linux Phone Standards (LiPS) Forum

PalmSource, Inc. has announced its membership in the the Linux Phone Standards (LiPS) Forum. "The LiPS Forum, a consortium of leading companies, has come together to accelerate the adoption of Linux in fixed, mobile and converged devices by standardizing Linux-based services and APIs that most directly influence the development, deployment and interoperability of applications and user-level services. Alongside PalmSource, the founding members include France Telecom/Orange, FSM Labs, Huawei, Jaluna, MontaVista Software, MIZI Research, Open Plug, Arm, Cellon and Esmertec."

Comments (none posted)

Pentek Releases Software Radio Development Platform Compliance

Pentek has announced their Software Radio Development Platform with SCA Compliance. "Pentek, Inc., the industry pioneer of VME board-level technology, today released a development platform containing all hardware and tools required for software-defined radio development compliant with the Software Communication Architecture (SCA) mandated for all future U.S. military radios."

Full Story (comments: none)

Rocketcalc Announces New Opteron Personal Clusters

Rocketcalc has announced a new line of personal clusters that use Dual-Core AMD Opteron Processors and run SuSE Linux. "Rocketcalc announced today the Saturn 270 HE personal cluster with sixteen AMD Opteron(TM) processor cores. Available with up to 64 GB total RAM and 8 Gbps total network bandwidth, Saturn brings serious 64-bit cluster computing power to your desk in a compact, quiet and affordable package."

Full Story (comments: none)

Safe Snaps announces photo archive service

Safesnaps has launched an online photo archive service. "Unix kernel veterans recently launched a new digital photo archive service for individuals and commercial clients who need to know their snapshots are secure. Safe Snaps (www.safesnaps.com) stores pictures, allows for easy retrieval by subscribers and can backup work on demand."

Full Story (comments: none)

New Super Computing Hardware

SGI, Linux Networx and Penguin Computing have announced new hardware at SuperComputing 2005 (November 12 - 18, in Seattle, Washington). Here is a press release from SGI on the new Altix 4000 platform. eWeek looks at new releases from Linux Networx and Penguin Computing.

Comments (none posted)

Terra Soft Launches Bioinformatics Package for Linux

Terra Soft Solutions has launched its Y-Bio Bioinformatics Package for Linux. "Built upon the RPM Linux standard for package management, Y-Bio offers industry standards NCBI BLAST, EMBOSS, Glimmer, ClustalW, HMMER, Wise, and FastA -- tools which help bioinformatics researchers conduct genetic sequence analysis."

Full Story (comments: none)

Linux Emporium comes to Brum

Thyme Software Ltd has acquired the Linux Emporium. "Steve Whitehouse, who has been running the well known Linux Emporium for the past two years has transferred the business to Thyme Software Ltd, in a seamless move facilitated by Steve's involvement in training the people at Thyme. John Pinner, Managing Director of Thyme Software: “At Thyme we have great plans for expanding the repertoire of the Linux Emporium, adding appropriate hardware and applications to its list offerings, plus a lot of other great stuff besides, to build on its role as the one-stop buy-on-line shop for everything Linux.”"

Full Story (comments: none)

New Books

IBM Press Publishes "Apache Derby--Off to the Races"

IBM Press has published the book Apache Derby--Off to the Races by Paul Zikopoulos, Dan Scott, and George Baklarz.

Full Story (comments: none)

Create Websites that Draw Traffic--O'Reilly's Latest Release

O'Reilly has published the book Creating Web Sites: The Missing Manual by Matthew MacDonald.

Full Story (comments: none)

Charles River Media publishes Digital Design From Gates to Intelligent Machines

Charles River Media has published the book Digital Design From Gates to Intelligent Machines by Bruce F. Katz.

Full Story (comments: none)

PHP in a Nutshell - O'Reilly's Newest Release

O'Reilly has published the book PHP in a Nutshell by Paul Hudson.

Full Story (comments: none)

Unix in a Nutshell, Fourth Edition - O'Reilly's Latest Release

O'Reilly has published the book Unix in a Nutshell, Fourth Edition by Arnold Robbins.

Full Story (comments: none)

No Starch Press releases "Wicked Cool Java"

No Starch Press has published the book Wicked Cool Java by Brian D. Eubanks.

Full Story (comments: none)

Resources

Moodle Newsletter #1 is now available

The first edition of the Moodle Newsletter is available as a PDF download. Moodle is: "a course management system (CMS) - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities. You can download and use it on any computer you have handy (including webhosts), yet it can scale from a single-teacher site to a 40,000-student University."

Comments (none posted)

"Why OSS/FS? Look at the Numbers!" - updated

David A. Wheeler has announced an updated publication of his document Why OSS/FS? Look at the Numbers!. "The big change is that a much shorter, simpler version of the report is available as a presentation, in both PDF and OpenDocument formats. Currently only English is available, but the author hopes that many will translate it into a variety of languages."

Full Story (comments: none)

Event Reports

Linux news from SC2005

The U.S. Department of Energy's (DOE) National Nuclear Security Administration (NNSA) and Silicon Graphics (SGI) have announced that an open-source version of the SGI SpeedShop performance analysis tool is now available to developers.

HPCwire Publisher Tom Tabor presented four 2005 HPCwire Innovation Awards to SGI's Graphics Prism.

Penguin Computing has released the Penguin Application-Ready Cluster Portfolio, a new line of integrated hardware/software Linux-based cluster systems.

Platform Computing has announced that Platform Rocks Standard Edition (SE) will be available as a cluster management solution for the HP Cluster Platform 3000.

PathScale has announced the release of version 1.1 of its InfiniPath software. This latest InfiniPath software release fully supports the OpenIB Gen 2 software stack and is designed to maximize application scaling and performance on InfiniBand-based Linux clusters.

Comments (none posted)

Gelato Spotlights Linux Itanium at Brazil Meeting

The Gelato Federation has published a press release that covers a recent Gelato Federation meeting. "Ninety scientists, developers, and engineers convened from all around the globe for the October 2005 meeting of the Gelato Federation, an international technical organization dedicated to advancing Linux on the Intel® Itanium® processor. In attendance were delegates from more than 25 research and enterprise institutions, including Gelato members and sponsors, HP, Intel, and SGI. The event was hosted by the Pontifical Catholic University of Rio Grande do Sul (PUCRS) at their campus in Porto Alegre, Brazil."

Full Story (comments: none)

Upcoming Events

Linux.Conf.Au Program Published

The conference program for Linux.Conf.Au is online. The event takes place in Dunedin, New Zealand on January 23-28, 2005.

Full Story (comments: none)

linux.conf.au 2006 Early bird registrations close soon

Early bird registrations for linux.conf.au 2006 are available until November 18. "Hi folks, Just a quick reminder that early bird registrations for linux.conf.au 2006 close in just over three days, at midnight on Friday the 18th of November. Please be aware that this date and time is in NZDT, which is currently equivalent to UTC +1300."

Full Story (comments: none)

4th seminar of Medical Open Source Software Council in Japan (LinuxMedNews)

LinuxMedNews has an announcement for the fourth seminar of Medical Open Source Software Council in Japan. The event will take place in Kobayashi, Kyushu, Japan on November 26, 2005.

Comments (none posted)

PyCon 2006 Call for Tutorials

A Call for Tutorials has gone out for PyCon 2006. "Enjoy teaching classes or tutorials? PyCon 2006 is looking for proposals for a pre-conference tutorials day. PyCon 2006 will be held February 24-26 in Addison, Texas (near Dallas). Tutorials will be held on February 23, at the same location."

Full Story (comments: none)

PyPy sprint announcement

The next PyPy sprint (Python-in-Python) has been announced. "The next PyPy sprint is scheduled to be in December 2005 in Gothenborg, Sweden. Its main focus is heading towards phase 2, which means JIT work, alternate threading models and logic programming (but there are also other possible topics). We'll give newcomer-friendly introductions."

Comments (none posted)

Events: November 17, 2005 - January 12, 2006

Date Event Location
November 17 - 18, 2005Embedded Technology 2005(ET2005)Yokohama, Japan
November 17, 2005LinuxWorld GermanyFrankfurt, Germany
November 17 - 18, 2005SC|05(Washington State Convention and Trade Center)Seattle, WA
November 18, 2005European Gentoo developer meetingSchloss Kransberg, Germany
November 20 - 23, 20055tas Jornadas Regionales de Software LibreRosario, Santa Fe, Argentina
November 29 - December 2, 2005FOSS.IN/2005(Bangalore Palace)Bangalore, India
December 4 - 9, 2005Large Installation System Administration Conf.(LISA)San Diego, CA
December 5 - 7, 2005Open Source Developers' Conference(OSDC)(Monash University's Caulfield campus)Melbourne, Australia
December 10 - 14, 2005ApacheCon 2005(Sheraton San Diego Hotel and Marina)San Diego, CA
December 27 - 30, 200522nd Chaos Communication CongressBerlin, Germany

Comments (none posted)

Web sites

OSDL launches patent commons reference library

OSDL has announced the creation of an online "patent commons reference library," found at patentcommons.org. "The Patent Commons website will catalogue existing patent commitments from companies and individuals who wish to retain ownership of their patents, and will provide information about different types of pledges and covenants and how they work. In the coming months, the site will expand to include other legal solutions that benefit the open source community, including open source licenses, indemnification programs and information for organizations and individuals who wish to contribute to the commons."

Comments (none posted)

Miscellaneous

Today's fun patent: space drive

For the sheer fun of it: if you were thinking of heading off to the stars, be careful you don't infringe on patent #6,960,975, being for a "space vehicle propelled by the pressure of inflationary vacuum state." "A cooled hollow superconductive shield is energized by an electromagnetic field resulting in the quantized vortices of lattice ions projecting a gravitomagnetic field that forms a spacetime curvature anomaly outside the space vehicle. The spacetime curvature imbalance, the spacetime curvature being the same as gravity, provides for the space vehicle's propulsion."

Comments (19 posted)

Page editor: Forrest Cook

Letters to the editor

Linux boots fast?

From:  Sebastien Loisel <sloisel-AT-gmail.com>
To:  letters-AT-lwn.net
Subject:  Linux boots fast?
Date:  Thu, 10 Nov 2005 22:05:34 +0100

>
> ...one of the fastest Linux distributions available today. Can you imagine
> a complete Linux OS booting into text console in 22 seconds and into full
> KDE in 45 seconds?


You call that fast?

45 seconds on a 2GHz cpu is 90,000,000,000 clock cycles. In each clock
cycle, you can execute one meaningful instruction. In 5,000 clock cycles,
you can completely rewrite the text screen. In a 100 clock cycle, you can
set up a DMA transfer, read or write a short message on the PCI bus, change
the video mode, etc...

You could do a million such thing and still not have used 1 billion clock
cycles, half a second. Or, you could write your kernel in python, which is
200 times slower than C, and you could still do 10,000 such things in a
second.

Where is it all going? Can you imagine waiting 25 hours for a commodore 64
to boot? Because that's how long it takes a commodore 64 to run through 90
billion cycles. And yet the commodore 64 boots in about one second, one
million cycles. So by my count, modern computers should boot in half a
millisecond.

One could argue that reading off the disk takes a long time. However, I just
now copied a 238MB file from one directory to another on the same disk
(which is a lot harder than reading 238MB, which the kernel and windowing
environment should under no circumstance ever get close to reading) and that
took less than 15 seconds. 15 seconds of I/O, plus half a second of
computing is 15.5 seconds and 1 billion cycles. What else could you need?

Before someone argues that some real work is going on, I say bullocks. I
know you don't need 45 seconds to boot a computer because my Windows laptop
can wake up in about 10 seconds after I hibernate it, most of which is
probably I/O. In that time, I have my complete desktop, and Matlab, Lyx,
Maple, Word, Excel, Firefox, Thunderbird, Cygwin and Adobe Illustrator are
all up and running and ready to use. Another half second and the network is
up too (which is also an outrage: electrons don't need half a second to
travel to the ethernet.)

Hell, the linuxbios people boot so fast the hdd hasn't even spun up yet.

The time it takes to shut down is equally inexcusable. The people
responsible should be given a spreadsheet with 90 billion lines and required
to document in detail how each cycle is being used, one cycle per line.

Sébastien Loisel


Comments (32 posted)

Page editor: Jonathan Corbet

Copyright © 2005, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds