LWN.net Logo

LWN.net Weekly Edition for January 19, 2006

GPLv3: a first look

The Free Software Foundation has, at last, made a draft version of version 3 of the General Public License available for comments. Your editor, having read it five minutes ago, is now ready to comment. What follows is a quick overview of the changes which have been made to the GPL; anybody wanting more information should certainly read the accompanying rationale document, which describes the changes - and their motivations - in detail.

The GPL is an important license. It is the most popular of free software licenses, and it covers many important components of a Linux system. It is a codification of the FSF's view of how free software should work, and it imposes some real obligations on those who redistribute GPL-licensed software. It is a core piece of our legal source code. So a major revision of the GPL requires a great deal of thought. In your editor's opinion, the FSF has put in that thought, and has put forward a revised license which meets current challenges while remaining true to the spirit of previous versions.

Digital restrictions management

Many of the changes in GPLv3 have to do with DRM schemes. The license makes the FSF's position on DRM quite clear, and does its best to ensure that GPL-licensed code will stay as far away from DRM as possible.

To start, the license makes its intent with regard to DRM clear:

As a free software license, this License intrinsically disfavors technical attempts to restrict users' freedom to copy, modify, and share copyrighted works. Each of its provisions shall be interpreted in light of this specific declaration of the licensor's intent. Regardless of any other provision of this License, no permission is given to distribute covered works that illegally invade users' privacy, nor for modes of distribution that deny users that run covered works the full exercise of the legal rights granted by this License.

The purpose here is to help ensure that, in any future court case, all of the terms of the GPL will be interpreted with an anti-DRM bias.

An interesting clause can be found in section 3:

No covered work constitutes part of an effective technological protection measure: that is to say, distribution of a covered work as part of a system to generate or access certain data constitutes general permission at least for development, distribution and use, under this License, of other software capable of accessing the same data.

This provision is clearly targeted at anti-circumvention laws. If it stands up, it says users can bypass any restrictions encoded in GPL-licensed software without circumventing "technological protection measures," since no GPL-licensed program can be part of such a measure.

Another key provision can be found in the revised definition of "source code":

Complete Corresponding Source Code also includes any encryption or authorization codes necessary to install and/or execute the source code of the work, perhaps modified by you, in the recommended or principal context of use, such that its functioning in all circumstances is identical to that of the work, except as altered by your modifications. It also includes any decryption codes necessary to access or unseal the work's output.

In other words, "trusted computing" mechanisms designed to keep people from replacing the software on their gadgets cannot be used with GPLv3-licensed software. This is a large and important change - though its effect will be somewhat limited for as long as the Linux kernel remains licensed under version 2 of the GPL.

Software patents

As expected, the new version of the GPL addresses software patents in a much more comprehensive manner. One fundamental change is that anybody who redistributes software covered by the GPLv3 is explicitly granting all patent licenses needed to use the software. This grant covers "all versions of the covered work," and would seem to override the "field of use" restrictions imposed by some patent owners.

Here's an interesting addition in v3:

This License gives unlimited permission to privately modify and run the Program, provided you do not bring suit for patent infringement against anyone for making, using or distributing their own works based on the Program.

It is, of course, a patent retaliation clause. If you launch a patent suit against somebody using a specific program, you cannot make any further use of that program. It's a big departure from GPLv2; the previous version of the license imposed no restrictions on individual use of the software at all. With GPLv3, the right to use the software - not just to redistribute it - can go away as a result of filing a patent suit.

There are no other patent retaliation clauses in the GPL itself; the FSF is not entirely comfortable with this concept in general. From the rationale document:

Several other free software licenses include significantly broader patent retaliation provisions. In our view, too little is known about the consequences of these forms of patent retaliation.

There is, however, a subsection which allows the incorporation of additional, limited patent retaliation terms. Terms which take away use of the software for filing a wider range software patent lawsuits can be added:

They may impose software patent retaliation, which means permission for use of your added parts terminates or may be terminated, wholly or partially, under stated conditions, for users closely related to any party that has filed a software patent lawsuit (i.e., a lawsuit alleging that some software infringes a patent). The conditions must limit retaliation to a subset of these two cases: 1. Lawsuits that lack the justification of retaliating against other software patent lawsuits that lack such justification. 2. Lawsuits that target part of this work, or other code that was elsewhere released together with the parts you added, the whole being under the terms used here for those parts.

So the GPLv3 does not include full-scale patent retaliation, but there should be enough there to get the attention of some types of patent holders.

Additional terms

A few other types of additional restrictions are allowed in GPLv3. These include limits on trademark use or the use of contributors' names for publicity purposes. The idea here was to try to make the GPL compatible with a wider range of free software licenses.

The much-discussed "web services loophole" is also addressed by way of an optional restriction:

They may require that the work contain functioning facilities that allow users to immediately obtain copies of its Complete Corresponding Source Code.

Beyond that, version 3, like its predecessors, explicitly disallows the imposition of additional restrictions.

Other changes

Under version 2, termination of the license was automatic if its terms were violated. In theory, one who had gone against the GPL would have to go and explicitly beg forgiveness before being able to distribute the relevant software again. Back in 2000, Richard Stallman told the KDE developers that they had to ask forgiveness in this way. Version 3 changes the terms to put the onus on copyright holders to terminate a license. Any copyright holder can do so if the terms are violated, but a violator who mends his ways need not ask forgiveness from any copyright holder who has not exercised that right.

Version 2 contains a clause saying that, if a program cannot be distributed in a way which complies with both the GPL and any other restrictions (patent licenses in particular), it cannot be distributed at all. There has been some disagreement over just how strong that restriction is. GPLv3 makes it clear that a strong interpretation is expected; this section is now titled "Liberty or Death for the Program."

The geographical restrictions clause, which allows terms disallowing the distribution of code in certain countries due to legal problems there, has been retained in GPLv3. The rationale document states, however, that the FSF knows of no actual use of that clause, and they suggest it could be removed during the comment period.

There are many other changes, mostly aimed at clarifying intent and ensuring that the license is enforceable worldwide. Again, interested parties are urged to read the license itself and the rationale document for the full story. They will then be prepared to take part in the comment and revision process, which is expected to last for about one year. If all goes well, the FSF hopes to adopt GPLv3 in January, 2007.

Comments (110 posted)

The .NET API patent, mono, and GNOME

January 18, 2006

This article was contributed by Mitch Skinner

The Mono project pushes a lot of buttons in the free software community. Patents, Microsoft, language choice, and platform choice all generate lots of heat individually, and Mono has them all. In spite of all the debate, there are still some issues that remain unresolved. There are undoubtedly some people who have been avoiding Mono just because Red Hat was; now that Fedora has it (while RHEL is still apparently up in the air) it's tough to know if Mono is safe to use or not.

I'm not a lawyer, but since everyone who has gotten advice from one (or who is one) is being tight-lipped about it, the rest of us apparently have to figure things out the best we can. I asked Red Hat Deputy General Counsel Mark Webbink about the decision to include Mono, and he replied:

I think you can understand that I cannot discuss Red Hat's internal IP policy. I would point out that the decision to include Mono with Fedora was made by the Fedora Foundation and its project folks. I feel confident the determination was made with an understanding of various patent concerns that have previously been posed to Novell but also with an understanding that there are protections available to open source developers, vendors, etc.

"...protections available to open source developers, vendors, etc."--sounds like the patent pools that are intended to create a mutually-assured-destruction sort of scenario for anyone wanting to sue open source projects for patent infringement. These pools have been derided as PR gimmicks, but Webbink's note makes it sound like some people are willing to actually put some trust in them.

This message also makes it sound like the Fedora decision-making mechanisms are finally starting to become separate from Red Hat's. I sent a message to Greg DeKoenigsberg of the Fedora Foundation, and I got the one-sentence official line in return:

"Business considerations that prevented certain Mono components from being included in Fedora previously have now been resolved."

Greg also suggested that more information may be forthcoming soon.

One of the really interesting aspects of the timing is the fact that the main patent application that has been discussed in the media (the API patent application) appears close to being automatically abandoned. The API patent, if it were granted, would be a big blow to the Mono project. Many patents on various aspects of the implementation could have been worked around, but the API implementation not only makes up a significant portion of the Mono codebase (making it a big project to re-do), but is also what all software written for Mono/.NET uses. If the API becomes unusable, you can't hide a work-around in the Mono internals, because the API forms the connection between Mono and the rest of the world.

In October of last year, the patent office issued a "Non-Final Rejection" to the patent application, meaning that Microsoft can try to fix the application. Indeed, if you read the non-final rejection, there are several suggestions the patent examiner makes about how to fix problematic issues. However, there is also a big section of the rejection notice that talks about prior art in the form of two already-issued patents. Those could be harder to work around.

The rejection notice says that the deadline for reply is three months from the date of mailing, which was October 21st, 2005. It has now been almost three months, and Microsoft has not yet replied. According to the rejection notice, if there's no reply before the deadline, the application is automatically abandoned.

What does that mean? Well, ask a lawyer, I guess, but it sounds pretty good for Mono. More importantly, maybe, is what it means for GNOME. In the spring of 2004, there was a big discussion on whether to begin using Mono in the GNOME core desktop. For example, see Havoc Pennington's essay on the topic. Clearly, it would be good to start writing core functionality in something nicer than C; however, the GNOME developers are understandably reluctant to open things up too widely and end up with a large number of different languages in the core desktop. The debate didn't reach a conclusion, with Novell going one way, Red Hat going another, and the community left hanging, with little information with which to make a decision.

Since then, several useful GNOME-targeted applications have been written using Mono. With the confusion regarding whether or not Mono would end up in all the major distributions, though, those applications have undoubtedly not gotten as much support and contributors as they could have. There are also non-Mono alternatives to some of them. While competition between projects is certainly healthy and a good thing in general, one of the strengths of free software is the ability to share and cross-pollinate. If different projects use different languages, libraries, and platforms, though, that sharing becomes much more difficult. Hopefully, some clarity on Mono's risks is forthcoming, and then maybe the split can be resolved.

[The author wishes to disclose that he holds stock in Red Hat, Inc.]

Comments (30 posted)

The return of software patents in Europe?

Last July, when the European Parliament killed the software patent directive, few people thought that it would remain dead forever. The sorts of people who push for that sort of expansion of legal monopoly rights tend to be tenacious; they do not give up easily. Still, the recent headlines proclaiming the return of the software patent debate were a bit of a surprise; one would have thought that the pro-patent camp would lie low for a little bit longer.

In fact, what is on the agenda now is not really a return of the software patent directive. It is, instead, the longstanding idea of a "community patent," which would apply across the entire EU. The idea is not entirely nonsensical; patenting an idea across the EU is currently a lengthy and expensive affair. People and companies interested in obtaining patents would really rather go through the process just once; the community patent would make that possible. The text of the proposal [PDF] is available for those who are interested.

An attentive reader will note that there is no mention of software patents in the proposal. Where the trouble comes in is with this clause here:

The European Patent Office will play a central role in the administration of Community Patents and will alone be responsible for examination of applications and the grant of Community Patents.

So, if somebody were to convince the EPO to start granting patents on algorithms, community software patents would be a reality. The unfortunate news here is that the EPO has been happily granting software patents for some time. FFII has put together a list of some of the worst EPO software patents; included therein are patents on JPEG, MP3, tabbed dialog boxes, form processing in web servers, some remote procedure call protocols, electronic shopping carts, and more. Such patents have no Europe-wide significance now, but, if they were issued as community patents, the situation would then be different. At that point, the only hope would be a court battle with the objective of getting software patents declared invalid. Not a fun process. Besides, it was in the courts that software patents became enforceable in the U.S.

Before this situation could come about, however, the community patent proposal would have to be adopted. That has not happened, so far, despite years of trying. Still, if there is to be a renewed push to establish a community patent, it would be much better for that patent to come with clear rules about the patentability of software. The current consultation period goes through the end of March; there will be a European Commission hearing on the community patent on June 13, 2006. So there is not a lot of time to push for changes.

Comments (1 posted)

Page editor: Jonathan Corbet

Security

Firefox and the ping attribute

The ping attribute is an HTML extension proposed by the Web Hypertext Application Technology Working Group. This attribute may be applied to anchor ("<A>") tags; its value is a list of URIs. If the user clicks upon the link created by the <A> tag, the browser will, in addition to displaying the destination page, also send a request for each of the given URIs. Essentially, the browser is phoning home - possibly to multiple homes - to report on the user's action.

As it turns out, future Firefox releases will implement the ping attribute; by some accounts, this feature will turn Firefox into spyware. Calling it "spyware" is probably overstating the case a little, but this feature is still worth some thought.

Many sites perform tracking of outbound clicks now. The normal technique is to reformat an external link to point at an internal script; that script logs the click, then returns an HTTP "redirect" response which sends the browser to the true destination. The redirect technique is arguably worse than the ping attribute for a couple of reasons. The first is the fact that redirect-style URLs obscure the true destination. Redirected URLs can be moderately obfuscated, such as this one taken from a News.com story:

  http://dw.com.com/redir?destUrl=http%3A%2F%2Fwww.nationalskillsregistry.in&siteId=3&\
                          oId=2100-1029-6028107&ontId=1009&lop=nl.ex

They can also be completely obscure:

  http://linuxfr.org/redirect/45255.html

(The above URL takes the reader to the Fedora directory server page). Redirected URLs can, in the presence of JavaScript, be imposed entirely by stealth.

The other problem with using redirect in this way is that it requires a conversation with the logging server before the browser wanders on to the place the user actually wanted to be. If the logging server is sufficiently slow or off the net entirely, the destination becomes unreachable.

The ping attribute addresses both of these problems. Destination URLs are not hidden, and the actual phoning home can happen after the destination page has been displayed. The option of ignoring ping attributes can also be presented to the user; there is no such option for links using redirect (though there are some firefox extensions which try hard for specific sites). So, in theory, ping is an improvement over what came before.

Still, it is hard to avoid a sense of discomfort with this feature. Firefox is free software, and free software is written with its users' interests in mind. Free software users have grown accustomed to the idea that, for example, applications will not be quietly phoning home in the background. Certainly, Firefox users have no motivation to leave ping enabled - it potentially compromises their privacy while offering them little in return. People will disable ping, and distributors will have a strong motivation to disable it by default in their packages. The Firefox hackers, by adding this feature, risk appearing to serve a community other than their users, and that appearance could reflect back on the reputation of this fine browser in general.

Comments (30 posted)

Brief items

Felten: CGMS-A + VEIL = SDMI?

Ed Felten is looking at the copy protection technologies mandated by the proposed "analog hole" law in the U.S. "The second technology, VEIL, is a watermark that is inserted into the video itself. VEIL was originally developed as a way for TV shows to send signals to toys. If you pointed the toy at the TV screen, it would detect any VEIL information encoded into the TV program, and react accordingly. Then somebody got the idea of using VEIL as a 'rights signaling' technology. The idea is that whenever CGMS-A is signaling restrictions on copying, a VEIL watermark is put into the video."

Comments (none posted)

New vulnerabilities

albatross: design error

Package(s):albatross CVE #(s):CVE-2006-0044
Created:January 16, 2006 Updated:January 20, 2006
Description: A design error has been discovered in the Albatross web application toolkit that causes user supplied data to be used as part of template execution and hence enables arbitrary code execution.
Alerts:
Debian DSA-942-1 2006-01-16

Comments (none posted)

antiword: insecure temporary file

Package(s):antiword CVE #(s):CVE-2005-3126
Created:January 17, 2006 Updated:January 18, 2006
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit project discovered that two scripts in antiword, utilities to convert Word files to text and Postscript, create a temporary file in an insecure fashion.
Alerts:
Debian DSA-945-1 2006-01-17

Comments (none posted)

ClamAV: arbitrary code execution

Package(s):clamav CVE #(s):CVE-2006-0162
Created:January 13, 2006 Updated:January 25, 2006
Description: A vulnerability in ClamAV v0.80 through 0.87.1, allows remote attackers to execute arbitrary code on vulnerable ClamAV installations. Authentication is not required to exploit this vulnerability.
Alerts:
Debian DSA-947-2 2006-01-25
Debian DSA-947-1 2006-01-21
Mandriva MDKSA-2006:016 2006-01-16
Gentoo 200601-07 2006-01-13

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):kernel CVE #(s):CVE-2005-3356 CVE-2005-4605 CVE-2005-4618 CVE-2005-4639 CVE-2006-0095 CVE-2006-0096
Created:January 18, 2006 Updated:March 7, 2006
Description: The latest set of kernel vulnerabilities includes:

  • A reference counting bug in sys_mq_open(), exploitable by a local user to crash the kernel. (CVE-2005-3356)

  • A misuse of signed data types in /proc, potentially providing read access to random kernel memory. (CVE-2005-4605)

  • An off-by-one error in sysctl(), with the potential for arbitrary code execution. (CVE-2005-4618)

  • A buffer overflow in the TwinHan DST Frontend/Card DVB driver; potential code execution. (CVE-2005-4639)

  • A potential key disclosure in dm-crypt. (CVE-2006-0095)

  • Missing capability check could (maybe) allow arbitrary users to load new firmware into SDLA WAN cards. (CVE-2006-0096)
Alerts:
Red Hat RHSA-2006:0132-01 2006-03-07
Trustix TSLSA-2006-0004 2006-01-27
Ubuntu USN-244-1 2006-01-18

Comments (none posted)

Kolab Server: broken email-signatures or attachments

Package(s):kolab CVE #(s):
Created:January 13, 2006 Updated:January 18, 2006
Description: A problem exists if the Kolab Server transports an email bigger than 8KB and there is a dot (".") character at the wrong place, kolabfilter will double this dot and a modified email will be delivered. This can lead to broken email clear-text signatures or broken attachments.
Alerts:
Mandriva MDKSA-2006:013 2006-01-12

Comments (none posted)

mantis: multiple vulnerabilities

Package(s):mantis CVE #(s):CVE-2005-4238 CVE-2005-4518 CVE-2005-4519 CVE-2005-4520 CVE-2005-4521 CVE-2005-4522 CVE-2005-4523 CVE-2005-4524
Created:January 17, 2006 Updated:January 18, 2006
Description: Several security related problems have been discovered in Mantis, a web-based bug tracking system.
Alerts:
Debian DSA-944-1 2006-01-17

Comments (none posted)

novell-nrm: heap memory corruption

Package(s):novell-nrm CVE #(s):CVE-2005-3655
Created:January 13, 2006 Updated:January 18, 2006
Description: A security problem with the Novell Remote Manager may be triggered by passing a huge or negative size via a HTTP request header to httpstkd. It is possible to corrupt heap memory and so potentially execute code. See this iDefense advisory for more details.
Alerts:
SuSE SUSE-SA:2006:002 2006-01-13

Comments (none posted)

struts: cross-site scripting vulnerability

Package(s):struts CVE #(s):CVE-2005-3745
Created:January 12, 2006 Updated:March 8, 2006
Description: The Struts error display system has a cross-site scripting vulnerability. An attacker may be able to maliciously craft a URL that can trick a user into thinking they are looking at a trusted site when they are not.
Alerts:
Red Hat RHSA-2006:0161-01 2006-03-07
Red Hat RHSA-2006:0157-01 2006-01-11

Comments (none posted)

sun-jdk: applet privilege escalation

Package(s):sun-jdk sun-jre blackdown-jdk CVE #(s):CVE-2005-3905 CVE-2005-3906
Created:January 16, 2006 Updated:January 18, 2006
Description: Adam Gowdiak discovered multiple vulnerabilities in the Java Runtime Environment's Reflection APIs that may allow untrusted applets to elevate privileges. A remote attacker could embed a malicious Java applet in a web page and entice a victim to view it. This applet can then bypass security restrictions and execute any command or access any file with the rights of the user running the web browser.
Alerts:
Gentoo 200601-10 2006-01-16

Comments (none posted)

tuxpaint: insecure temporary file

Package(s):tuxpaint CVE #(s):CVE-2005-3340
Created:January 16, 2006 Updated:January 18, 2006
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit project discovered that a script in tuxpaint, a paint program for young children, creates a temporary files in an insecure fashion.
Alerts:
Ubuntu USN-243-1 2006-01-16
Debian DSA-941-1 2006-01-16

Comments (none posted)

wine: Windows WMF vulnerability

Package(s):wine CVE #(s):CVE-2006-0106
Created:January 13, 2006 Updated:January 25, 2006
Description: H D Moore discovered that Wine implements the insecure-by-design SETABORTPROC GDI Escape function for Windows Metafile (WMF) files.
Alerts:
Debian DSA-954-1 2006-01-25
Gentoo 200601-09:02 2006-01-13
Mandriva MDKSA-2006:014 2006-01-16
Gentoo 200601-09 2006-01-13

Comments (none posted)

Updated vulnerabilities

apache: cross-site scripting

Package(s):apache CVE #(s):CVE-2005-3352
Created:December 14, 2005 Updated:May 10, 2006
Description: Versions 1 and 2 of the apache web server suffer from a cross-site scripting vulnerability in the mod_imap module; see this bugzilla entry for details.
Alerts:
Slackware SSA:2006-129-01 2006-05-10
SuSE SUSE-SR:2006:004 2006-02-24
Fedora-Legacy FLSA:175406 2006-02-18
Gentoo 200602-03 2006-02-06
Fedora FEDORA-2006-052 2006-01-20
Red Hat RHSA-2006:0158-01 2006-01-17
Ubuntu USN-241-1 2006-01-12
Trustix TSLSA-2005-0074 2005-12-23
Mandriva MDKSA-2006:007 2006-01-05
Red Hat RHSA-2006:0159-01 2006-01-05
OpenPKG OpenPKG-SA-2005.029 2005-12-14

Comments (none posted)

auth_ldap: format string vulnerability

Package(s):auth_ldap CVE #(s):CVE-2006-0150
Created:January 10, 2006 Updated:February 28, 2006
Description: The auth_ldap package is an httpd module that allows user authentication against information stored in an LDAP database. A format string flaw was found in the way auth_ldap logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if auth_ldap is used for user authentication.
Alerts:
Fedora-Legacy FLSA:177694 2006-02-27
Debian DSA-952-1 2006-01-23
Mandriva MDKSA-2006:017 2006-01-19
Red Hat RHSA-2006:0179-01 2006-01-10

Comments (none posted)

blender: integer overflow

Package(s):blender CVE #(s):CVE-2005-4470
Created:January 6, 2006 Updated:June 15, 2006
Description: Damian Put discovered that Blender did not properly validate a 'length' value in .blend files. Negative values led to an insufficiently sized memory allocation. By tricking a user into opening a specially crafted .blend file, this could be exploited to execute arbitrary code with the privileges of the Blender user.
Alerts:
Debian-Testing DTSA-29-1 2006-06-15
Debian DSA-1039-1 2006-04-24
Gentoo 200601-08 2006-01-13
Ubuntu USN-238-2 2006-01-06
Ubuntu USN-238-1 2006-01-06

Comments (none posted)

bogofilter: buffer overflow

Package(s):bogofilter CVE #(s):CVE-2005-4591
Created:January 11, 2006 Updated:January 11, 2006
Description: A buffer overflow was found in the UTF-8 handling code in bogofilter; it can be exploited via a malicious email message.
Alerts:
Ubuntu USN-240-1 2006-01-11

Comments (none posted)

bzip2: race condition and infinite loop

Package(s):bzip2 CVE #(s):CAN-2005-0953 CAN-2005-1260
Created:May 17, 2005 Updated:January 10, 2007
Description: A race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. Also specially crafted bzip2 archives may cause an infinite loop in the decompressor.
Alerts:
rPath rPSA-2007-0004-1 2007-01-09
Debian DSA-741-1 2005-07-07
Red Hat RHSA-2005:474-01 2005-06-16
OpenPKG OpenPKG-SA-2005.008 2005-06-10
SuSE SUSE-SR:2005:015 2005-06-07
Debian DSA-730-1 2005-05-27
Mandriva MDKSA-2005:091 2005-05-18
Ubuntu USN-127-1 2005-05-17

Comments (2 posted)

ktools: buffer overflow

Package(s):centericq CVE #(s):CVE-2005-3863
Created:December 7, 2005 Updated:August 29, 2006
Description: From the Debian-Testing alert: Mehdi Oudad "deepfear" and Kevin Fernandez "Siegfried" from the Zone-H Research Team discovered a buffer overflow in kkstrtext.h of the ktools library, which is included in (at least) centericq and motor.
Alerts:
Gentoo 200608-27 2006-08-29
Debian DSA-1088-1 2006-06-03
Debian DSA-1083-1 2006-05-31
Gentoo 200512-11 2005-12-20
Debian-Testing DTSA-23-1 2005-12-05

Comments (none posted)

cpio: arbitrary code execution

Package(s):cpio CVE #(s):CVE-2005-4268
Created:January 2, 2006 Updated:March 17, 2010
Description: Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).
Alerts:
CentOS CESA-2010:0145 2010-03-17
Red Hat RHSA-2010:0145-01 2010-03-15
rPath rPSA-2007-0094-1 2007-05-07
Red Hat RHSA-2007:0245-02 2007-05-01
Ubuntu USN-234-1 2006-01-02

Comments (none posted)

curl: buffer overflow

Package(s):curl CVE #(s):CVE-2005-4077
Created:December 8, 2005 Updated:March 27, 2006
Description: The curl file transfer utility has a buffer overflow vulnerability in the URL authentication code. If an overly long URL is used, a buffer overflow can result, allowing for local unauthorized access.
Alerts:
Gentoo 200603-25 2006-03-27
Debian DSA-919-2 2006-03-10
Trustix TSLSA-2005-0072 2005-12-16
Red Hat RHSA-2005:875-01 2005-12-20
Gentoo 200512-09 2005-12-16
Ubuntu USN-228-1 2005-12-12
Fedora FEDORA-2005-1137 2005-12-12
Fedora FEDORA-2005-1136 2005-12-12
Debian DSA-919-1 2005-12-12
OpenPKG OpenPKG-SA-2005.028 2005-12-10
Mandriva MDKSA-2005:224 2005-12-08
Fedora FEDORA-2005-1129 2005-12-08
Fedora FEDORA-2005-1130 2005-12-08

Comments (none posted)

cyrus-imapd: buffer overflows

Package(s):cyrus-imapd CVE #(s):CAN-2005-0546
Created:February 23, 2005 Updated:April 10, 2006
Description: Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system.
Alerts:
Fedora-Legacy FLSA:156290 2006-04-04
Red Hat RHSA-2005:408-01 2005-05-17
Fedora FEDORA-2005-339 2005-04-27
OpenPKG OpenPKG-SA-2005.005 2005-04-05
Conectiva CLA-2005:937 2005-03-17
Mandrake MDKSA-2005:051 2005-03-04
Ubuntu USN-87-1 2005-02-28
SuSE SUSE-SA:2005:009 2005-02-24
Gentoo 200502-29 2005-02-23

Comments (none posted)

dia: missing input sanitizing

Package(s):dia CVE #(s):CAN-2005-2966
Created:October 4, 2005 Updated:April 6, 2006
Description: Joxean Koret discovered that the SVG import plugin did not properly sanitize data read from an SVG file. By tricking an user into opening a specially crafted SVG file, an attacker could exploit this to execute arbitrary code with the privileges of the user.
Alerts:
Debian DSA-1025-1 2006-04-06
Mandriva MDKSA-2005:187 2005-10-20
Gentoo 200510-06 2005-10-06
Debian DSA-847-1 2005-10-08
SuSE SUSE-SR:2005:022 2005-10-07
Ubuntu USN-193-1 2005-10-04

Comments (none posted)

emacs21: format string vulnerability in "movemail"

Package(s):emacs21 CVE #(s):CAN-2005-0100
Created:February 7, 2005 Updated:May 15, 2006
Description: Max Vozeler discovered a format string vulnerability in the "movemail" utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the user and the "mail" group.
Alerts:
Fedora-Legacy FLSA:152898 2006-05-12
Debian DSA-685-1 2005-02-17
Mandrake MDKSA-2005:038 2005-02-15
Gentoo 200502-20 2005-02-15
Fedora FEDORA-2005-146 2005-02-14
Fedora FEDORA-2005-145 2005-02-14
Red Hat RHSA-2005:133-01 2005-02-15
Red Hat RHSA-2005:110-01 2005-02-15
Red Hat RHSA-2005:134-01 2005-02-10
Red Hat RHSA-2005:112-01 2005-02-10
Fedora FEDORA-2005-116 2005-02-08
Fedora FEDORA-2005-115 2005-02-08
Debian DSA-671-1 2005-02-08
Debian DSA-670-1 2005-02-08
Ubuntu USN-76-1 2005-02-07

Comments (none posted)

enscript: arbitrary code execution

Package(s):enscript CVE #(s):CAN-2004-1184 CAN-2004-1185 CAN-2004-1186
Created:January 21, 2005 Updated:May 27, 2006
Description: Erik Sjölund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. Unsanitized input can cause the execution of arbitrary commands via EPSF pipe support. Due to missing sanitizing of filenames it is possible that a specially crafted filename can cause arbitrary commands to be executed. Multiple buffer overflows can cause the program to crash.
Alerts:
rPath rPSA-2006-0083-1 2006-05-26
Fedora-Legacy FLSA:152892 2005-12-17
Red Hat RHSA-2005:040-01 2005-02-15
Mandrake MDKSA-2005:033 2005-02-10
Gentoo 200502-03 2005-02-02
Red Hat RHSA-2005:039-01 2005-02-01
Fedora FEDORA-2005-096 2005-01-31
Fedora FEDORA-2005-092 2005-01-28
Fedora FEDORA-2005-091 2005-01-28
Fedora FEDORA-2005-016 2005-01-26
Fedora FEDORA-2005-015 2005-01-26
Ubuntu USN-68-1 2005-01-24
Debian DSA-654-1 2005-01-21

Comments (none posted)

ethereal: denial of service

Package(s):ethereal CVE #(s):CVE-2005-3313
Created:January 5, 2006 Updated:January 11, 2006
Description: Ethereal, a network traffic monitor has an IRC protocol dissector vulnerability, remote attackers can cause a denial of service by creating an infinite loop.
Alerts:
Red Hat RHSA-2006:0156-01 2006-01-11
Fedora FEDORA-2005-000 2006-01-05

Comments (none posted)

evolution: format string issues

Package(s):evolution CVE #(s):CAN-2005-2549 CAN-2005-2550
Created:August 15, 2005 Updated:March 23, 2006
Description: Evolution has format string issues. SITIC advisory SA05-001 contains more information.
Alerts:
Debian DSA-1016-1 2006-03-23
SuSE SUSE-SA:2005:054 2005-09-16
Red Hat RHSA-2005:267-01 2005-08-29
Gentoo 200508-12 2005-08-23
Mandriva MDKSA-2005:141 2005-08-17
Fedora FEDORA-2005-742 2005-08-11
Fedora FEDORA-2005-743 2005-08-11

Comments (2 posted)

fetchmail: multidrop bug

Package(s):fetchmail CVE #(s):CVE-2005-4348
Created:December 20, 2005 Updated:May 27, 2006
Description: Fetchmail contains a bug which allows a malicious mail server to crash the client by sending a message without headers. This occurs when running in multidrop mode.
Alerts:
rPath rPSA-2006-0084-1 2006-05-26
Fedora-Legacy FLSA:164512 2006-05-12
Slackware SSA:2006-045-01 2006-02-15
Debian DSA-939-1 2006-01-13
Ubuntu USN-233-1 2006-01-02
Mandriva MDKSA-2005:236 2005-12-23
Fedora FEDORA-2005-1187 2005-12-20
Fedora FEDORA-2005-1186 2005-12-20

Comments (none posted)

ffmpeg: buffer overflow

Package(s):ffmpeg CVE #(s):CVE-2005-4048
Created:December 15, 2005 Updated:March 17, 2006
Description: The avcodec_default_get_buffer() function of the ffmpeg library has a buffer overflow vulnerability. A user can be tricked into playing a maliciously created PNG movie, allowing the attacker to run arbitrary code with the user's privileges.
Alerts:
Debian DSA-1005-1 2006-03-16
Debian DSA-1004-1 2006-03-16
Debian DSA-992-1 2006-03-10
Gentoo 200603-03 2006-03-04
Gentoo 200602-01 2006-02-05
Gentoo 200601-06 2006-01-10
Ubuntu USN-230-2 2005-12-16
Ubuntu USN-230-1 2005-12-14
Mandriva MDKSA-2005:228 2005-12-14
Mandriva MDKSA-2005:229 2005-12-14
Mandriva MDKSA-2005:232 2005-12-14
Mandriva MDKSA-2005:230 2005-12-14
Mandriva MDKSA-2005:231 2005-12-14

Comments (none posted)

firefox: multiple vulnerabilities

Package(s):firefox CVE #(s):CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704 CAN-2005-2705 CAN-2005-2706 CAN-2005-2707 CAN-2005-2968
Created:September 22, 2005 Updated:February 15, 2006
Description: The Firefox browser has multiple vulnerabilities including problems with XBM image file processing, Unicode sequence processing, XMLHttp requests, malicious XBL binding, a JavaScript engine buffer overflow, about: pages, opening of new windows, and command line URL processing.
Alerts:
Slackware SSA:2006-045-02 2006-02-15
Fedora-Legacy FLSA:168375 2006-01-09
Ubuntu USN-200-1 2005-10-11
Ubuntu USN-155-3 2005-10-04
Debian DSA-838-1 2005-10-02
Gentoo GLSA 200509-11:02 2005-09-18
SuSE SUSE-SA:2005:058 2005-09-30
Mandriva MDKSA-2005:170 2005-09-26
Mandriva MDKSA-2005:169 2005-09-26
Slackware SSA:2005-269-01 2005-09-26
Fedora FEDORA-2005-934 2005-09-26
Fedora FEDORA-2005-933 2005-09-26
Fedora FEDORA-2005-932 2005-09-26
Fedora FEDORA-2005-931 2005-09-26
Fedora FEDORA-2005-930 2005-09-26
Fedora FEDORA-2005-929 2005-09-26
Fedora FEDORA-2005-928 2005-09-26
Fedora FEDORA-2005-927 2005-09-26
Fedora FEDORA-2005-926 2005-09-26
Ubuntu USN-186-2 2005-09-25
Ubuntu USN-186-1 2005-09-23
Red Hat RHSA-2005:789-01 2005-09-22
Red Hat RHSA-2005:785-01 2005-09-22

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):foomatic CVE #(s):CAN-2004-0801
Created:September 20, 2004 Updated:May 31, 2006
Description: There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:
SuSE SUSE-SA:2006:026 2006-05-30
Fedora-Legacy FLSA:2076 2004-11-05
Conectiva CLA-2004:880 2004-10-27
Fedora FEDORA-2004-303 2004-09-21
Gentoo 200409-24 2004-09-20

Comments (none posted)

FUSE: mtab corruption through fusermount

Package(s):fuse CVE #(s):CVE-2005-3531
Created:November 22, 2005 Updated:January 24, 2006
Description: Thomas Biege discovered that fusermount fails to securely handle special characters specified in mount points. A local attacker could corrupt the contents of the /etc/mtab file by mounting over a maliciously-named directory using fusermount, potentially allowing the attacker to set unauthorized mount options.
Alerts:
Debian-Testing DTSA-27-1 2006-01-20
Mandriva MDKSA-2005:216 2005-11-24
Gentoo 200511-17 2005-11-22

Comments (none posted)

gaim: buffer overflow

Package(s):gaim CVE #(s):CAN-2005-2103
Created:August 10, 2005 Updated:February 27, 2006
Description: Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:158543 2006-02-25
Slackware SSA:2005-242-03 2005-08-31
Fedora FEDORA-2005-751 2005-08-17
Fedora FEDORA-2005-750 2005-08-17
Mandriva MDKSA-2005:139 2005-08-15
Gentoo 200508-06 2005-08-15
Ubuntu USN-168-1 2005-08-12
Red Hat RHSA-2005:589-01 2005-08-09

Comments (none posted)

gdb: multiple vulnerabilities

Package(s):gdb CVE #(s):CAN-2005-1704 CAN-2005-1705
Created:May 20, 2005 Updated:August 11, 2006
Description: Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer overflow in the BFD library, resulting in a heap overflow. A review also showed that by default, gdb insecurely sources initialization files from the working directory. Successful exploitation would result in the execution of arbitrary code on loading a specially crafted object file or the execution of arbitrary commands.
Alerts:
Red Hat RHSA-2006:0354-01 2006-08-10
Red Hat RHSA-2006:0368-01 2006-07-20
Mandriva MDKSA-2005:215 2005-11-23
Fedora FEDORA-2005-1033 2005-10-27
Fedora FEDORA-2005-1032 2005-10-27
Red Hat RHSA-2005:801-01 2005-10-18
Red Hat RHSA-2005:763-01 2005-10-11
Red Hat RHSA-2005:709-01 2005-10-05
Red Hat RHSA-2005:673-01 2005-10-05
Red Hat RHSA-2005:659-01 2005-09-28
Fedora FEDORA-2005-498 2005-06-29
Fedora FEDORA-2005-497 2005-06-29
Gentoo 200506-01 2005-06-01
Trustix TSLSA-2005-0025 2005-05-31
Mandriva MDKSA-2005:095 2005-05-30
Ubuntu USN-136-2 2005-05-27
Ubuntu USN-136-1 2005-05-27
Ubuntu USN-135-1 2005-05-27
Gentoo 200505-15 2005-05-20

Comments (5 posted)

gdk-pixbuf: multiple vulnerabilities

Package(s):gdk-pixbuf gtk2 CVE #(s):CVE-2005-3186 CVE-2005-2976 CVE-2005-2975
Created:November 15, 2005 Updated:March 20, 2006
Description: The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code when the file was opened by a victim.

Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code or crash when the file was opened by a victim.

Ludwig Nussel also discovered an infinite-loop denial of service bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to stop responding when the file was opened by a victim.

Alerts:
Fedora-Legacy FLSA:173274 2006-03-16
Debian DSA-913-1 2005-12-01
Debian DSA-911-1 2005-11-29
Trustix TSLSA-2005-0066 2005-11-18
Mandriva MDKSA-2005:214 2005-11-18
Ubuntu USN-216-1 2005-11-16
SuSE SUSE-SA:2005:065 2005-11-16
Gentoo 200511-14 2005-11-16
Fedora FEDORA-2005-1088 2005-11-15
Fedora FEDORA-2005-1087 2005-11-15
Fedora FEDORA-2005-1086 2005-11-15
Fedora FEDORA-2005-1085 2005-11-15
Red Hat RHSA-2005:811-01 2005-11-15
Red Hat RHSA-2005:810-01 2005-11-15

Comments (none posted)

gedit: format string vulnerability

Package(s):gedit CVE #(s):CAN-2005-1686
Created:June 9, 2005 Updated:February 5, 2009
Description: A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.
Alerts:
Fedora FEDORA-2009-1189 2009-01-29
Fedora FEDORA-2009-1187 2009-01-29
Debian DSA-753-1 2005-07-12
Mandriva MDKSA-2005:102 2005-06-15
Red Hat RHSA-2005:499-01 2005-06-13
Gentoo 200506-09 2005-06-11
Ubuntu USN-138-1 2005-06-09

Comments (1 posted)

gettext: Insecure temporary file handling

Package(s):gettext CVE #(s):CAN-2004-0966
Created:October 11, 2004 Updated:March 1, 2006
Description: gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:
Mandriva MDKSA-2006:051 2006-02-28
Fedora-Legacy FLSA:136323 2006-01-09
Gentoo 200410-10:02 2004-10-10
OpenPKG OpenPKG-SA-2004.055 2004-12-23
Ubuntu USN-5-1 2004-10-27
Gentoo 200410-10 2004-10-10

Comments (1 posted)

grip: buffer overflow

Package(s):grip CVE #(s):CAN-2005-0706
Created:March 10, 2005 Updated:November 19, 2008
Description: Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:
Fedora FEDORA-2008-9604 2008-11-19
Fedora FEDORA-2008-9521 2008-11-19
Fedora-Legacy FLSA:152919 2005-09-15
Mandriva MDKSA-2005:074 2005-04-20
Mandriva MDKSA-2005:075 2005-04-20
Gentoo 200504-07 2005-04-08
Mandrake MDKSA-2005:066 2005-04-01
Red Hat RHSA-2005:304-01 2005-03-28
Gentoo 200503-21 2005-03-17
Fedora FEDORA-2005-203 2005-03-09
Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

groff: insecure temporary directory

Package(s):groff CVE #(s):CAN-2004-0969
Created:November 1, 2004 Updated:February 9, 2006
Description: Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:
Mandriva MDKSA-2006:038 2006-02-08
Gentoo 200411-15 2004-11-08
Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gzip: arbitrary command execution

Package(s):gzip CVE #(s):CAN-2005-0758
Created:August 1, 2005 Updated:January 10, 2007
Description: zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names.
Alerts:
OpenPKG OpenPKG-SA-2007.002 2007-01-08
Mandriva MDKSA-2006:027 2006-01-30
Mandriva MDKSA-2006:026 2006-01-30
Fedora-Legacy FLSA:158801 2005-11-14
Fedora-Legacy FLSA:157696 2005-08-10
Ubuntu USN-161-1 2005-08-04
Ubuntu USN-158-1 2005-08-01

Comments (2 posted)

HylaFAX: input validation vulnerability

Package(s):hylafax CVE #(s):CVE-2005-3538 CVE-2005-3539
Created:January 6, 2006 Updated:January 17, 2006
Description: The HylaFAX 4.2.4 release corrects issues with previous versions. HylaFAX runs the notify script on untrusted user input. Furthermore, users can log in without a password when HylaFAX is installed with the pam USE-flag disabled.
Alerts:
Mandriva MDKSA-2006:015 2006-01-16
Debian DSA-933-1 2006-01-09
Gentoo 200601-03 2006-01-06

Comments (none posted)

imap: buffer overflow in c-client

Package(s):imap CVE #(s):CAN-2003-0297
Created:February 18, 2005 Updated:April 10, 2006
Description: A buffer overflow flaw was found in the c-client IMAP client. An attacker could create a malicious IMAP server that if connected to by a victim could execute arbitrary code on the client machine.
Alerts:
Fedora-Legacy FLSA:184074 2006-04-04
Fedora-Legacy FLSA:152912 2005-05-12
Red Hat RHSA-2005:114-01 2005-02-18

Comments (none posted)

ipsec-tools: denial of service

Package(s):ipsec-tools CVE #(s):CVE-2005-3732
Created:December 1, 2005 Updated:June 8, 2006
Description: ipsec-tools has a remote denial of service vulnerability in the racoon daemon. If racoon is running in aggressive mode, it fails to check all peer payloads during When the daemon the IKE negotiation phase, allowing a malicious peer to crash the daemon. One should always be careful around aggressive racoons.
Alerts:
Fedora-Legacy FLSA:190941 2006-06-06
Red Hat RHSA-2006:0267-01 2006-04-25
Debian DSA-965-1 2006-02-06
Mandriva MDKSA-2006:020 2006-01-25
SuSE SUSE-SA:2005:070 2005-12-20
Gentoo 200512-04 2005-12-12
Ubuntu USN-221-1 2005-12-01

Comments (none posted)

kdebase: local root vulnerability

Package(s):kdebase CVE #(s):CAN-2005-2494
Created:September 7, 2005 Updated:August 11, 2006
Description: The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details.
Alerts:
Red Hat RHSA-2006:0582-01 2006-08-10
Debian DSA-815-1 2005-09-16
Slackware SSA:2005-251-01 2005-09-09
Ubuntu USN-176-1 2005-09-07
Mandriva MDKSA-2005:160 2005-09-06

Comments (none posted)

kdelibs: kate backup file permission leak

Package(s):kdelibs kate kwrite CVE #(s):CAN-2005-1920
Created:July 19, 2005 Updated:September 21, 2010
Description: Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information.
Alerts:
Gentoo 200611-21 2006-11-27
Debian DSA-804-2 2005-11-10
Debian DSA-804-1 2005-09-08
Red Hat RHSA-2005:612-01 2005-07-27
Ubuntu USN-150-1 2005-07-21
Mandriva MDKSA-2005:122 2005-07-20
Fedora FEDORA-2005-594 2005-07-19

Comments (1 posted)

kernel: multiple vulnerabilities

Package(s):kernel CVE #(s):CAN-2005-0449 CAN-2005-0209 CAN-2005-0529 CAN-2005-0530 CAN-2005-0532 CAN-2005-0384 CAN-2005-0210 CAN-2005-0504 CAN-2005-0003
Created:March 24, 2005 Updated:May 31, 2006
Description: A number of vulnerabilities have been found in the Linux kernel, including a PPP-related denial of service problem, an integer overflow in the epoll() code, memory corruption in the ELF loader, and exploitable overflows in the ISO9660 code.
Alerts:
Debian DSA-1082-1 2006-05-29
Debian DSA-1069-1 2006-05-20
Debian DSA-1070-1 2006-05-21
Debian DSA-1067-1 2006-05-20
Conectiva CLA-2005:945 2005-03-31
Fedora FEDORA-2005-262 2005-03-28
SuSE SUSE-SA:2005:018 2005-03-24

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):kernel CVE #(s):CVE-2005-2709 CVE-2005-2973 CVE-2005-3055 CVE-2005-3180 CVE-2005-3271 CVE-2005-3272 CVE-2005-3273 CVE-2005-3274 CVE-2005-3275 CVE-2005-3276
Created:November 22, 2005 Updated:March 15, 2006
Description: Al Viro discovered a race condition in the /proc file handler of network devices. A local attacker could exploit this by opening any file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that interface was shut down. Under certain circumstances this could lead to a kernel crash or even arbitrary code execution with full kernel privileges. (CVE-2005-2709)

Tetsuo Handa discovered a local Denial of Service vulnerability in the udp_v6_get_port() function. On computers which use IPv6, a local attacker could exploit this to trigger an infinite loop in the kernel. (CVE-2005-2973)

Harald Welte discovered a Denial of Service vulnerability in the USB devio driver. A local attacker could exploit this by sending an "USB Request Block" (URB) and terminating the sending process before the arrival of the answer, which left an invalid pointer and caused a kernel crash. (CVE-2005-3055)

Pavel Roskin discovered an information leak in the Orinoco wireless card driver. When increasing the buffer length for storing data, the buffer was not padded with zeros, which exposed a random part of the system memory to the user. (CVE-2005-3180)

A resource leak has been discovered in the handling of POSIX timers in the exec() function. This could be exploited to a Denial of Service attack by a group of local users. (CVE-2005-3271)

Stephen Hemminger discovered a weakness in the network bridge driver. Packets which had already been dropped by the packet filter could poison the forwarding table, which could be exploited to make the bridge forward spoofed packages. (CVE-2005-3272)

David S. Miller discovered a buffer overflow in the rose_rt_ioctl() function. By calling the function with a large "ngidis" argument, a local attacker could cause a kernel crash. (CVE-2005-3273)

Neil Horman discovered a race condition in the connection timer handling. This allowed a local attacker to set up an expiration handler which modified the connection list while the list still being traversed, which could result in a kernel crash. This vulnerability only affects multiprocessor (SMP) systems. (CVE-2005-3274)

Patrick McHardy noticed a logic error in the network address translation (NAT) connection tracker. A remote attacker could exploit this by causing two packets for the same protocol to be NATed at the same time, which resulted in a kernel crash. (CVE-2005-3275)

Paolo Giarrusso discovered an information leak in the sys_get_thread_area(). The returned structure was not properly cleared, which exposed a small amount of kernel memory to userspace programs. This could possibly expose confidential data. (CVE-2005-3276)

Alerts:
Red Hat RHSA-2006:0144-01 2006-03-15
Red Hat RHSA-2006:0140-01 2006-01-19
Red Hat RHSA-2006:0101-01 2006-01-17
Mandriva MDKSA-2005:235 2005-12-21
Debian DSA-922-1 2005-12-14
Debian DSA-921-1 2005-12-14
SuSE SUSE-SA:2005:068 2005-12-14
SuSE SUSE-SA:2005:067 2005-12-06
Mandriva MDKSA-2005:220 2005-11-30
Mandriva MDKSA-2005:219 2005-11-30
Mandriva MDKSA-2005:218 2005-11-30
Fedora FEDORA-2005-1104 2005-11-28
Trustix TSLSA-2005-0064 2005-11-11
Ubuntu USN-219-1 2005-11-22

Comments (2 posted)

libconvert-uulib-perl: arbitrary code execution

Package(s):libconvert-uulib-perl CVE #(s):CAN-2005-1349
Created:May 20, 2005 Updated:January 27, 2006
Description: Mark Martinec and Robert Lewis discovered a buffer overflow in Convert::UUlib (before 1.051), a Perl interface to the uulib library, which may result in the execution of arbitrary code.
Alerts:
Mandriva MDKSA-2006:022 2006-01-26
Debian DSA-727-1 2005-05-20

Comments (1 posted)

libdbi-perl: insecure temporary file

Package(s):libdbi-perl CVE #(s):CAN-2005-0077
Created:January 25, 2005 Updated:March 2, 2006
Description: Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.
Alerts:
Fedora-Legacy FLSA:178989 2006-03-01
Gentoo 200501-38:03 2005-01-26
Red Hat RHSA-2005:072-01 2005-02-15
Mandrake MDKSA-2005:030 2005-02-08
Red Hat RHSA-2005:069-01 2005-02-01
Gentoo 200501-38 2005-01-26
Ubuntu USN-70-1 2005-01-25
Debian DSA-658-1 2005-01-25

Comments (none posted)

libgadu: memory alignment bug

Package(s):libgadu CVE #(s):CAN-2005-2370
Created:July 29, 2005 Updated:June 25, 2007
Description: Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment error in libgadu (from ekg, console Gadu Gadu client, an instant messaging program) which is included in gaim, a multi-protocol instant messaging client, as well. This can not be exploited on the x86 architecture but on others, e.g. on Sparc and lead to a bus error, in other words a denial of service.
Alerts:
Debian DSA-813-1 2005-09-15
Red Hat RHSA-2005:627-01 2005-08-09
Debian DSA-769-1 2005-07-29

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):libgd2 CVE #(s):CAN-2004-0990 CAN-2004-0941
Created:October 29, 2004 Updated:June 28, 2006
Description: Several buffer overflows have been discovered in libgd's PNG handling functions.
If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:
Mandriva MDKSA-2006:114 2006-06-27
Red Hat RHSA-2006:0194-01 2006-02-01
Fedora-Legacy FLSA:152838 2005-07-15
Red Hat RHSA-2004:638-01 2004-12-17
Ubuntu USN-33-1 2004-11-29
Debian DSA-602-1 2004-11-29
Debian DSA-601-1 2004-11-29
Mandrake MDKSA-2004:132 2004-11-15
Ubuntu USN-25-1 2004-11-15
Fedora FEDORA-2004-412 2004-11-11
Fedora FEDORA-2004-411 2004-11-11
Ubuntu USN-21-1 2004-11-09
Debian DSA-591-1 2004-11-09
Debian DSA-589-1 2004-11-09
Gentoo 200411-08 2004-11-03
OpenPKG OpenPKG-SA-2004.049 2004-10-30
Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libnet-ssleay-perl: weakened cryptographic operations

Package(s):libnet-ssleay-perl CVE #(s):CAN-2005-0106
Created:May 3, 2005 Updated:January 27, 2006
Description: Javier Fernandez-Sanguino Pena discovered that this library used the file /tmp/entropy as a fallback entropy source if a proper source was not set in the environment variable EGD_PATH. This can potentially lead to weakened cryptographic operations if an attacker provides a /tmp/entropy file with known content.
Alerts:
Mandriva MDKSA-2006:023 2006-01-26
Ubuntu USN-113-1 2005-05-03

Comments (none posted)

libpam-ldap: authentication bypass

Package(s):libpam-ldap CVE #(s):CAN-2005-2641
Created:August 25, 2005 Updated:October 6, 2006
Description: libpam-ldap, the PAM LDAP interface, has a vulnerability in which it fails to authenticate with an LDAP server which is not configured properly, allowing an authentication bypass.
Alerts:
rPath rPSA-2006-0183-1 2006-10-05
Mandriva MDKSA-2005:190 2005-10-20
Gentoo 200508-22 2005-08-31
Debian DSA-785-1 2005-08-25

Comments (none posted)

libTIFF: buffer overflow

Package(s):libtiff CVE #(s):CAN-2005-1544
Created:May 10, 2005 Updated:February 18, 2006
Description: Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a stack based buffer overflow in the libTIFF library when reading a TIFF image with a malformed BitsPerSample tag. Successful exploitation would require the victim to open a specially crafted TIFF image, resulting in the execution of arbitrary code.
Alerts:
Mandriva MDKSA-2006:042 2006-02-17
Debian DSA-755-1 2005-07-13
Ubuntu USN-130-1 2005-05-19
Gentoo 200505-07 2005-05-10

Comments (1 posted)

libungif: memory corruption

Package(s):libungif CVE #(s):CAN-2005-2974
Created:November 3, 2005 Updated:March 20, 2006
Description: The libungif library has a vulnerability in the GIF file colormap handling code. A maliciously crafted GIF file can cause out of bounds memory writing and register corruption.
Alerts:
Fedora-Legacy FLSA:174479 2006-03-16
SuSE SUSE-SR:2005:026 2005-11-11
Mandriva MDKSA-2005:207 2005-11-09
Debian DSA-890-1 2005-11-09
Ubuntu USN-214-1 2005-11-07
Gentoo 200511-03 2005-11-04
Red Hat RHSA-2005:828-01 2005-11-03
Fedora FEDORA-2005-1046 2005-11-03
Fedora FEDORA-2005-1045 2005-11-03

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libXpm: new buffer overflows

Package(s):libXpm CVE #(s):CAN-2005-0605
Created:March 4, 2005 Updated:March 8, 2006
Description: A new vulnerability has been discovered in libXpm, which is included in OpenMotif and LessTif, that can potentially lead to remote code execution.
Alerts:
Fedora-Legacy FLSA:168264 2006-03-07
Fedora-Legacy FLSA:152803 2006-01-09
Fedora FEDORA-2005-815 2005-08-26
Fedora FEDORA-2005-808 2005-08-25
Red Hat RHSA-2005:198-01 2005-06-08
Red Hat RHSA-2005:473-01 2005-05-24
Red Hat RHSA-2005:412-01 2005-05-11
Debian DSA-723-1 2005-05-09
Mandriva MDKSA-2005:081 2005-05-05
Mandriva MDKSA-2005:080 2005-04-28
Red Hat RHSA-2005:044-01 2005-04-06
Red Hat RHSA-2005:331-01 2005-03-30
Fedora FEDORA-2005-273 2005-03-29
Fedora FEDORA-2005-272 2005-03-29
Ubuntu USN-97-1 2005-03-16
Gentoo 200503-15 2005-03-12
Ubuntu USN-92-1 2005-03-07
Gentoo 200503-08 2005-03-04

Comments (none posted)

lynx: arbitrary command execution

Package(s):lynx CVE #(s):CVE-2005-2929
Created:November 14, 2005 Updated:September 14, 2009
Description: An arbitrary command execute bug was found in the lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx.
Alerts:
Gentoo 200909-15 2009-09-12
Fedora-Legacy FLSA:152832 2005-12-17
OpenPKG OpenPKG-SA-2005.026 2005-12-03
Fedora FEDORA-2005-1079 2005-11-14
Fedora FEDORA-2005-1078 2005-11-14
Gentoo 200511-09 2005-11-13
Mandriva MDKSA-2005:211 2005-11-12
Red Hat RHSA-2005:839-01 2005-11-11

Comments (none posted)

mailman: denial of service

Package(s):mailman CVE #(s):CVE-2005-3573
Created:December 2, 2005 Updated:March 8, 2006
Description: Scrubber.py in Mailman 2.1.4 - 2.1.6 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service.
Alerts:
Red Hat RHSA-2006:0204-01 2006-03-07
Debian DSA-955-1 2006-01-25
Ubuntu USN-242-1 2006-01-16
Mandriva MDKSA-2005:222 2005-12-02

Comments (none posted)

mod_auth_pgsql: format string flaws

Package(s):mod_auth_pgsql CVE #(s):CVE-2005-3656
Created:January 6, 2006 Updated:February 28, 2006
Description: The mod_auth_pgsql package is an httpd module that allows user authentication against information stored in a PostgreSQL database. Several format string flaws were found in the way mod_auth_pgsql logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if mod_auth_pgsql is used for user authentication.
Alerts:
Fedora-Legacy FLSA:177326 2006-02-27
Gentoo 200601-05 2006-01-10
Debian DSA-935-1 2006-01-10
Mandriva MDKSA-2006:009 2006-01-06
Ubuntu USN-239-1 2006-01-09
Red Hat RHSA-2006:0164-01 2006-01-05

Comments (none posted)

mod_python: remote access vulnerability

Package(s):mod_python CVE #(s):CAN-2005-0088
Created:February 10, 2005 Updated:April 10, 2006
Description: mod_python has a vulnerability in the publisher handler that may allow a remote user to use a specially crafted URL to allow access to objects that should be protected. An information leak can result.
Alerts:
Fedora-Legacy FLSA:152896 2006-04-04
Conectiva CLA-2005:926 2005-03-02
Debian DSA-689-1 2005-02-23
Red Hat RHSA-2005:100-01 2005-02-15
Gentoo 200502-14 2005-02-13
Trustix TSLSA-2005-0003 2005-02-11
Ubuntu USN-80-1 2005-02-11
Red Hat RHSA-2005:104-01 2005-02-10
Fedora FEDORA-2005-140 2005-02-10
Fedora FEDORA-2005-139 2005-02-10

Comments (none posted)

mysql: buffer overflow

Package(s):mysql CVE #(s):CAN-2005-2558
Created:September 12, 2005 Updated:January 12, 2006
Description: The mysql CREATE FUNCTION can be used to create a buffer overflow. A specially crafted long function name can be used by a local attacker to crash the server or execute arbitrary code with the privileges of the server.
Alerts:
Fedora-Legacy FLSA:167803 2006-01-10
Ubuntu USN-180-2 2005-12-05
OpenPKG OpenPKG-SA-2005.024 2005-12-03
Debian DSA-833-2 2005-10-04
Debian DSA-833-1 2005-10-01
Debian DSA-831-1 2005-09-30
Debian DSA-829-1 2005-09-30
Mandriva MDKSA-2005:163 2005-09-12
Ubuntu USN-180-1 2005-09-12

Comments (none posted)

mysql: low-impact security fix

Package(s):mysql CVE #(s):CAN-2005-1636
Created:July 20, 2005 Updated:February 22, 2006
Description: An update to MySQL version 4.1.12 fixes a low-impact security problem (bz#158689).
Alerts:
Mandriva MDKSA-2006:045 2006-02-21
Red Hat RHSA-2005:685-01 2005-10-05
Debian DSA-783-1 2005-08-24
Fedora FEDORA-2005-557 2005-07-20

Comments (1 posted)

nbd: arbitrary code execution

Package(s):nbd CVE #(s):CVE-2005-3534
Created:January 6, 2006 Updated:March 7, 2011
Description: Kurt Fitzner discovered that the NBD (network block device) server did not correctly verify the maximum size of request packets. By sending specially crafted large request packets, a remote attacker who is allowed to access the server could exploit this to execute arbitrary code with root privileges.
Alerts:
SuSE SUSE-SR:2006:001 2006-01-13
Ubuntu USN-237-1 2006-01-06

Comments (none posted)

ncpfs: multiple vulnerabilities

Package(s):ncpfs CVE #(s):CAN-2005-0013 CAN-2005-0014
Created:January 31, 2005 Updated:May 15, 2006
Description: Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).
Alerts:
Fedora-Legacy FLSA:152904 2006-05-12
Fedora FEDORA-2005-435 2005-08-16
Red Hat RHSA-2005:371-01 2005-05-17
Mandrake MDKSA-2005:028 2005-02-01
Gentoo 200501-44 2005-01-30

Comments (none posted)

nfs-utils: arbitrary code execution

Package(s):nfs-utils CVE #(s):CAN-2004-0946
Created:January 11, 2005 Updated:February 27, 2006
Description: Arjan van de Ven discovered a buffer overflow in rquotad on 64bit architectures; an improper integer conversion could lead to a buffer overflow. An attacker with access to an NFS share could send a specially crafted request which could then lead to the execution of arbitrary code.
Alerts:
Fedora-Legacy FLSA:138098 2006-02-25
Red Hat RHSA-2005:014-01 2005-01-12
Mandrake MDKSA-2005:005 2005-01-11

Comments (none posted)

ntp: uses wrong gid

Package(s):ntp CVE #(s):CAN-2005-2496
Created:August 26, 2005 Updated:August 11, 2006
Description: When starting xntpd with the -u option and specifying the group by using a string not a numeric gid the daemon uses the gid of the user not the group. This problem is now fixed by this update.
Alerts:
Red Hat RHSA-2006:0393-01 2006-08-10
Mandriva MDKSA-2005:156 2005-09-06
Debian DSA-801-1 2005-09-05
Ubuntu USN-175-1 2005-09-01
Fedora FEDORA-2005-812 2005-08-26

Comments (none posted)

openmotif: buffer overflows

Package(s):openmotif CVE #(s):CVE-2005-3964
Created:December 29, 2005 Updated:July 27, 2006
Description: The libUil component of the OpenMotif toolkit has a pair of buffer overflow vulnerabilities that can possibly be used for the execution of arbitrary code.
Alerts:
Fedora FEDORA-2006-854 2006-07-26
Red Hat RHSA-2006:0272-01 2006-04-04
Gentoo 200512-16 2005-12-28

Comments (none posted)

openssh: GSSAPI credential disclosure

Package(s):openssh CVE #(s):CAN-2005-2798
Created:September 7, 2005 Updated:February 3, 2006
Description: OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
Alerts:
SuSE SUSE-SR:2006:003 2006-02-03
Ubuntu USN-209-1 2005-10-17
Mandriva MDKSA-2005:172 2005-10-06
Red Hat RHSA-2005:527-01 2005-10-05
Fedora FEDORA-2005-860 2005-09-12
Trustix TSLSA-2005-0047 2005-09-09
Fedora FEDORA-2005-858 2005-09-07

Comments (none posted)

otrs: multiple vulnerabilities

Package(s):otrs CVE #(s):CVE-2005-3893 CVE-2005-3894 CVE-2005-3895
Created:December 16, 2005 Updated:February 15, 2006
Description: Several vulnerabilities were discovered in the CMS system OTRS. Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, multiple cross-site scripting vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, and Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment.
Alerts:
Debian DSA-973-1 2006-02-15
SuSE SUSE-SR:2005:030 2005-12-16

Comments (none posted)

pcre3: arbitrary code execution

Package(s):pcre3 CVE #(s):CAN-2005-2491
Created:August 23, 2005 Updated:March 10, 2006
Description: A buffer overflow has been discovered in the PCRE, a widely used library that provides Perl compatible regular expressions. Specially crafted regular expressions triggered a buffer overflow. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library.
Alerts:
Red Hat RHSA-2006:0197-01 2006-03-09
Fedora-Legacy FLSA:168516 2006-03-07
Debian DSA-821-1 2005-09-28
Debian DSA-819-1 2005-09-23
Debian DSA-817-1 2005-09-22
Gentoo 200509-08 2005-09-12
Red Hat RHSA-2005:358-01 2005-09-08
Red Hat RHSA-2005:761-02 2005-09-08
Trustix TSLSA-2005-0045 2005-08-26
OpenPKG OpenPKG-SA-2005.018 2005-09-05
SuSE SUSE-SA:2005:051 2005-09-05
Gentoo 200509-02 2005-09-03
Debian DSA-800-1 2005-09-02
Ubuntu USN-173-4 2005-08-31
Slackware SSA:2005-242-01 2005-08-31
SuSE SUSE-SA:2005:049 2005-08-30
SuSE SUSE-SA:2005:048 2005-08-30
Ubuntu USN-173-3 2005-08-30
Mandriva MDKSA-2005:155 2005-08-29
Mandriva MDKSA-2005:154 2005-08-26
Mandriva MDKSA-2005:153 2005-08-26
Mandriva MDKSA-2005:151 2005-08-25
Mandriva MDKSA-2005:152 2005-08-25
Gentoo 200508-17 2005-08-25
Ubuntu USN-173-2 2005-08-24
Fedora FEDORA-2005-803 2005-08-24
Fedora FEDORA-2005-802 2005-08-24
Ubuntu USN-173-1 2005-08-23

Comments (none posted)

perl: setuid vulnerabilities

Package(s):perl CVE #(s):CAN-2005-0155 CAN-2005-0156
Created:February 2, 2005 Updated:August 11, 2006
Description: There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access.
Alerts:
Red Hat RHSA-2006:0605-01 2006-08-10
Fedora FEDORA-2005-353 2005-05-02
Red Hat RHSA-2005:103-01 2005-02-15
Gentoo 200502-13 2005-02-11
SuSE SUSE-SR:2005:004 2005-02-11
Mandrake MDKSA-2005:031 2005-02-08
Red Hat RHSA-2005:105-01 2005-02-07
Ubuntu USN-72-1 2005-02-02

Comments (none posted)

perl: symlink vulnerability

Package(s):perl CVE #(s):CAN-2005-0448
Created:March 9, 2005 Updated:January 30, 2006
Description: The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries.
Alerts:
Fedora-Legacy FLSA:152845 2006-01-24
Red Hat RHSA-2005:674-01 2005-10-05
Fedora FEDORA-2005-600 2005-07-22
Mandriva MDKSA-2005:079 2005-04-28
Debian DSA-696-1 2005-03-22
Ubuntu USN-94-1 2005-03-09

Comments (none posted)

perl: integer overflow

Package(s):perl CVE #(s):CVE-2005-3962 CVE-2005-3912
Created:December 1, 2005 Updated:February 27, 2006
Description: Perl has an sprintf integer overflow vulnerability that may be used for a denial of service, remote code execution and information leakage.
Alerts:
Fedora-Legacy FLSA:176731 2006-02-25
Debian DSA-943-1 2006-01-16
Red Hat RHSA-2005:881-01 2005-12-20
Red Hat RHSA-2005:880-01 2005-12-20
SuSE SUSE-SA:2005:071 2005-12-20
Fedora FEDORA-2005-1145 2005-12-14
Fedora FEDORA-2005-1144 2005-12-14
Ubuntu USN-222-2 2005-12-12
Trustix TSLSA-2005-0070 2005-12-09
Mandriva MDKSA-2005:225 2005-12-08
Gentoo 200512-02 2005-12-07
Gentoo 200512-01 2005-12-07
OpenPKG OpenPKG-SA-2005.025 2005-12-03
Mandriva MDKSA-2005:223 2005-12-02
Ubuntu USN-222-1 2005-12-02
Fedora FEDORA-2005-1116 2005-12-01
Fedora FEDORA-2005-1113 2005-12-01

Comments (none posted)

petris: buffer overflow

Package(s):petris CVE #(s):CVE-2005-3540
Created:January 9, 2006 Updated:January 11, 2006
Description: Steve Kemp from the Debian Security Audit project discovered a buffer overflow in petris, a clone of the Tetris game, which may be exploited to execute arbitrary code with group games privileges.
Alerts:
Debian DSA-929-1 2006-01-09

Comments (none posted)

phpbb2: multiple vulnerabilities

Package(s):phpbb2 CVE #(s):CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537
Created:December 22, 2005 Updated:February 11, 2008
Description: The phpbb2 web forum has a number of vulnerabilities including: a web script injection problem, a protection mechanism bypass, a security check bypass, a remote global variable bypass, cross site scripting vulnerabilities, an SQL injection vulnerability, a remote regular expression modification problem, missing input sanitizing, and a missing request validation problem.
Alerts:
Debian DSA-925-1 2005-12-22

Comments (none posted)

phpMyAdmin: multiple vulnerabilities

Package(s):phpmyadmin CVE #(s):CVE-2005-4079 CVE-2005-3665
Created:December 12, 2005 Updated:November 20, 2006
Description: Stefan Esser reported multiple vulnerabilities found in phpMyAdmin. The $GLOBALS variable allows modifying the global variable import_blacklist to open phpMyAdmin to local and remote file inclusion, depending on your PHP version (CVE-2005-4079, PMASA-2005-9). Furthermore, it is also possible to conduct an XSS attack via the $HTTP_HOST variable and a local and remote file inclusion because the contents of the variable are under total control of the attacker (CVE-2005-3665, PMASA-2005-8).
Alerts:
Debian DSA-1207-2 2006-11-19
Debian DSA-1207-1 2006-11-09
SuSE SUSE-SA:2006:004 2006-01-26
Gentoo 200512-03 2005-12-11

Comments (none posted)

poppler: arbitrary code execution

Package(s):poppler CVE #(s):CVE-2005-3191 CAN-2005-3193
Created:December 8, 2005 Updated:January 16, 2006
Description: The poppler PDF rendering library has a heap overflow vulnerability that can be exploited by viewing specially crafted PDF files. An attacker can cause a crash or the execution of arbitrary code. This vulnerability is related to a similar vulnerability with xpdf.
Alerts:
Fedora FEDORA-2005-037 2006-01-16
Red Hat RHSA-2005:878-01 2005-12-20
Red Hat RHSA-2005:868-01 2005-12-20
Fedora FEDORA-2005-1171 2005-12-19
Fedora FEDORA-2005-1132 2005-12-08

Comments (none posted)

postgresql: database initialization errors

Package(s):postgresql CVE #(s):CAN-2005-1409 CAN-2005-1410
Created:May 4, 2005 Updated:February 28, 2006
Description: PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
Alerts:
Fedora-Legacy FLSA:157366 2006-02-27
Mandriva MDKSA-2005:093 2005-05-26
Red Hat RHSA-2005:433-01 2005-06-01
Gentoo 200505-12 2005-05-15
Fedora FEDORA-2005-368 2005-05-10
Ubuntu USN-118-1 2005-05-04

Comments (none posted)

pound: HTTP Request Smuggling Attack

Package(s):pound CVE #(s):CVE-2005-3751
Created:January 10, 2006 Updated:June 8, 2006
Description: HTTP requests with conflicting Content-Length and Transfer-Encoding headers could lead to HTTP Request Smuggling Attack, which can be exploited to bypass packet filters or poison web caches.
Alerts:
Gentoo 200606-05 2006-06-07
Debian DSA-934-1 2006-01-09

Comments (none posted)

pstotext: remote execution of arbitrary code

Package(s):pstotext netpbm CVE #(s):CAN-2005-2471
Created:August 1, 2005 Updated:March 28, 2006
Description: Max Vozeler reported that pstotext calls the GhostScript interpreter on untrusted PostScript files without specifying the -dSAFER option. An attacker could craft a malicious PostScript file and entice a user to run pstotext on it, resulting in the execution of arbitrary commands with the permissions of the user running pstotext. See this Secunia advisory for more information.
Alerts:
Debian DSA-1021-1 2006-03-28
Debian DSA-792-1 2005-08-31
Red Hat RHSA-2005:743-01 2005-08-22
Fedora FEDORA-2005-728 2005-08-17
Fedora FEDORA-2005-727 2005-08-17
Ubuntu USN-164-1 2005-08-11
Mandriva MDKSA-2005:133 2005-08-09
Gentoo 200508-04 2005-08-05
Gentoo 200507-29 2005-07-31

Comments (2 posted)

Py2Play: remote execution of arbitrary Python code

Package(s):Py2Play CVE #(s):CAN-2005-2875
Created:September 19, 2005 Updated:September 6, 2006
Description: Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send malicious Python pickles, resulting in the execution of arbitrary Python code on the targeted game client.
Alerts:
Gentoo 200509-09:02 2005-09-17
Debian DSA-856-1 2005-10-10
Gentoo 200509-09 2005-09-17

Comments (none posted)

scorched3d: multiple vulnerabilities

Package(s):scorched3d CVE #(s):
Created:November 15, 2005 Updated:August 11, 2006
Description: Luigi Auriemma discovered multiple flaws in the Scorched 3D game server, including a format string vulnerability and several buffer overflows. A remote attacker could exploit these vulnerabilities to crash a game server or execute arbitrary code with the rights of the game server user.
Alerts:
Gentoo 200511-12:03 2005-11-15
Gentoo 200511-12 2005-11-15

Comments (none posted)

scponly: privilege escalation

Package(s):scponly CVE #(s):CVE-2005-4532
Created:December 29, 2005 Updated:February 13, 2006
Description: The scponly restricted shell has a privilege escalation vulnerability. Local users can chroot into arbitrary directories, and can gain root privileges if a directory contains hard links to setuid programs. Also, scponly does not properly validate command line parameters to the scp and rsync commands.
Alerts:
Debian DSA-969-1 2006-02-13
Gentoo 200512-17 2005-12-29

Comments (none posted)

smstools: format string attack

Package(s):smstools CVE #(s):CVE-2006-0083
Created:January 9, 2006 Updated:January 11, 2006
Description: Ulf Harnhammar from the Debian Security Audit project discovered a format string attack in the logging code of smstools, which may be exploited to execute arbitrary code with root privileges.
Alerts:
Debian DSA-930-2 2006-01-10
Debian DSA-930-1 2006-01-09

Comments (none posted)

spamassassin: denial of service

Package(s):spamassassin CVE #(s):CVE-2005-3351
Created:November 9, 2005 Updated:March 7, 2006
Description: Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field.
Alerts:
Red Hat RHSA-2006:0129-01 2006-03-07
Mandriva MDKSA-2005:221 2005-12-02
Fedora FEDORA-2005-1066 2005-11-09
Fedora FEDORA-2005-1065 2005-11-09

Comments (none posted)

squid: authentication handling

Package(s):squid CVE #(s):CAN-2005-2917
Created:September 30, 2005 Updated:March 15, 2006
Description: Upstream developers of squid, the popular WWW proxy cache, have discovered that changes in the authentication scheme are not handled properly when given certain request sequences while NTLM authentication is in place, which may cause the daemon to restart.
Alerts:
Red Hat RHSA-2006:0045-01 2006-03-15
Red Hat RHSA-2006:0052-01 2006-03-07
Fedora-Legacy FLSA:152809 2006-02-18
Mandriva MDKSA-2005:181 2005-10-11
Ubuntu USN-192-1 2005-09-30
Debian DSA-828-1 2005-09-30

Comments (none posted)

sudo: vulnerability via scripts

Package(s):sudo CVE #(s):CAN-2005-4158 CVE-2006-0151
Created:December 16, 2005 Updated:September 1, 2006
Description: Perl and Python scripts run via Sudo can be subverted.
Alerts:
Mandriva MDKSA-2006:159 2006-08-31
Debian DSA-946-2 2006-04-08
Slackware SSA:2006-045-08 2006-02-15
SuSE SUSE-SR:2006:002 2006-01-20
Debian DSA-946-1 2006-01-20
Ubuntu USN-235-2 2006-01-09
Ubuntu USN-235-1 2006-01-05
Mandriva MDKSA-2005:234 2005-12-20
Fedora FEDORA-2005-1147 2005-12-16

Comments (none posted)

sudo: missing input sanitizing

Package(s):sudo CVE #(s):CVE-2005-2959
Created:October 25, 2005 Updated:February 19, 2006
Description: Tavis Ormandy noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. The SHELLOPTS and PS4 variables are dangerous and are still passed through to the program running as privileged user. This can result in the execution of arbitrary commands as privileged user when a bash script is executed. These vulnerabilities can only be exploited by users who have been granted limited super user privileges.
Alerts:
OpenPKG OpenPKG-SA-2006.002 2006-02-18
Trustix TSLSA-2005-0062 2005-11-04
Ubuntu USN-213-1 2005-10-28
Mandriva MDKSA-2005:201 2005-10-27
Debian DSA-870-1 2005-10-25

Comments (none posted)

sudo: race condition

Package(s):sudo CVE #(s):CAN-2005-1993
Created:June 21, 2005 Updated:February 24, 2006
Description: Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command "ALL", that user could execute arbitrary commands with sudo by creating symbolic links at a certain time.
Alerts:
Fedora-Legacy FLSA:162750 2006-02-23
Debian DSA-735-2 2005-07-07
Debian DSA 735-1 2005-07-01
Red Hat RHSA-2005:535-04 2005-06-29
SuSE SUSE-SA:2005:036 2005-06-24
OpenPKG OpenPKG-SA-2005.012 2005-06-23
Gentoo 200506-22 2005-06-23
Slackware SSA:2005-172-01 2005-06-22
Mandriva MDKSA-2005:103 2005-06-21
Fedora FEDORA-2005-473 2005-06-21
Fedora FEDORA-2005-472 2005-06-21
Ubuntu USN-142-1 2005-06-21

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: multiple DoS issues

Package(s):tcpdump CVE #(s):CAN-2005-1280 CAN-2005-1279 CAN-2005-1278
Created:May 2, 2005 Updated:April 10, 2006
Description: The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4. (CAN-2005-1280)

tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet, which is not properly handled by RT_ROUTING_INFO, or LDP packet, which is not properly handled by the ldp_print function. (CAN-2005-1279)

The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length, as demonstrated using a GRE packet. (CAN-2005-1278)

Alerts:
Fedora-Legacy FLSA:156139 2006-04-04
Debian DSA-850-1 2005-10-09
Mandriva MDKSA-2005:087 2005-05-11
Red Hat RHSA-2005:417-02 2005-05-11
Red Hat RHSA-2005:421-02 2005-05-11
Gentoo 200505-06 2005-05-09
Ubuntu USN-119-1 2005-05-06
Fedora FEDORA-2005-351 2005-05-02

Comments (none posted)

texinfo: temporary file vulnerability

Package(s):texinfo CVE #(s):CAN-2005-3011
Created:October 5, 2005 Updated:November 9, 2006
Description: Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability.
Alerts:
Ubuntu USN-194-2 2006-01-09
Fedora FEDORA-2005-991 2005-10-14
Fedora FEDORA-2005-990 2005-10-14
Mandriva MDKSA-2005:175 2005-10-06
Ubuntu USN-194-1 2005-10-06
Gentoo 200510-04 2005-10-05

Comments (none posted)

ucd-snmp: denial of service

Package(s):ucd-snmp CVE #(s):CAN-2005-2177
Created:August 9, 2005 Updated:January 27, 2006
Description: A denial of service bug was found in the way ucd-snmp uses network stream protocols. A remote attacker could send a ucd-snmp agent a specially crafted packet which will cause the agent to crash.
Alerts:
Mandriva MDKSA-2006:025 2006-01-26
Ubuntu USN-190-2 2005-11-21
Debian DSA-873-1 2005-10-26
Red Hat RHSA-2005:395-01 2005-10-05
Ubuntu USN-190-1 2005-09-29
Red Hat RHSA-2005:373-01 2005-09-28
Mandriva MDKSA-2005:137 2005-08-11
Red Hat RHSA-2005:720-01 2005-08-09

Comments (none posted)

udev: insecure files in /dev/input

Package(s):udev CVE #(s):CVE-2005-3631
Created:December 20, 2005 Updated:February 28, 2006
Description: Richard Cunningham discovered a flaw in the way udev sets permissions on various files in /dev/input. It may be possible for an authenticated attacker to gather sensitive data entered by a user at the console, such as passwords.
Alerts:
Fedora-Legacy FLSA:175818 2006-02-27
Red Hat RHSA-2005:864-01 2005-12-20

Comments (none posted)

unzip: race condition

Package(s):unzip CVE #(s):CAN-2005-2475
Created:September 29, 2005 Updated:January 12, 2006
Description: Unzip has a race condition vulnerability in the handling of output files. During file unpacking, a local attacker can modify the permissions of arbitrary files in the victim's directory.
Alerts:
Debian DSA-903-2 2006-01-12
Debian DSA-903-1 2005-11-21
Mandriva MDKSA-2005:197 2005-10-26
Trustix TSLSA-2005-0053 2005-09-30
Ubuntu USN-191-1 2005-09-29

Comments (none posted)

up-imapproxy: format string vulnerabilities

Package(s):up-imapproxy CVE #(s):CAN-2005-2661
Created:October 10, 2005 Updated:March 7, 2006
Description: up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
Alerts:
Gentoo 200603-04 2006-03-06
Debian DSA-852-1 2005-10-09

Comments (none posted)

uw-imap: buffer overflow

Package(s):uw-imap CVE #(s):CAN-2005-2933
Created:October 11, 2005 Updated:April 10, 2006
Description: "infamous41md" discovered a buffer overflow in uw-imap, the University of Washington's IMAP Server that allows attackers to execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:184098 2006-04-04
Fedora-Legacy FLSA:170411 2006-04-04
Fedora FEDORA-2005-1112 2005-12-08
Fedora FEDORA-2005-1115 2005-12-08
Red Hat RHSA-2005:850-01 2005-12-06
Red Hat RHSA-2005:848-01 2005-12-06
Mandriva MDKSA-2005:194 2005-10-26
Trustix TSLSA-2005-0055 2005-10-07
Mandriva MDKSA-2005:189 2005-10-20
SuSE SUSE-SR:2005:023 2005-10-14
Gentoo 200510-10 2005-10-11
Debian DSA-861-1 2005-10-11

Comments (none posted)

vixie-cron: crontab allows any user to read another users crontabs

Package(s):vixie-cron CVE #(s):CAN-2005-1038
Created:April 15, 2005 Updated:March 15, 2006
Description: crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235. See also this Security Focus report.
Alerts:
Red Hat RHSA-2006:0117-01 2006-03-15
Red Hat RHSA-2005:361-01 2005-10-05
Fedora FEDORA-2005-320 2005-04-15

Comments (none posted)

VMware: arbitrary code execution

Package(s):vmware CVE #(s):CVE-2005-4459
Created:January 9, 2006 Updated:January 11, 2006
Description: Tim Shelton discovered that vmnet-natd, the host module providing NAT-style networking for VMware guest operating systems, is unable to process incorrect 'EPRT' and 'PORT' FTP requests. Malicious guest operating systems using the NAT networking feature or local VMware Workstation users could exploit this vulnerability to execute arbitrary code on the host system with elevated privileges.
Alerts:
Gentoo 200601-04 2006-01-07

Comments (none posted)

w3c-libwww: possible stack overflow

Package(s):w3c-libwww CVE #(s):CVE-2005-3183
Created:October 14, 2005 Updated:May 2, 2007
Description: xtensive testing of libwww's handling of multipart/byteranges content from HTTP/1.1 servers revealed multiple logical flaws and bugs in Library/src/HTBound.c
Alerts:
Red Hat RHSA-2007:0208-02 2007-05-01
Ubuntu USN-220-1 2005-12-01
Mandriva MDKSA-2005:210 2005-11-09
Fedora FEDORA-2005-953 2005-10-07
Fedora FEDORA-2005-952 2005-10-07

Comments (1 posted)

xine-lib: buffer overflows

Package(s):xine-lib CVE #(s):CAN-2004-1379
Created:September 22, 2004 Updated:April 10, 2006
Description: xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code.
Alerts:
Fedora-Legacy FLSA:152873 2006-04-04
Debian DSA-657-1 2005-01-25
Mandrake MDKSA-2004:105 2004-10-06
Slackware SSA:2004-266-04 2004-09-22
Gentoo 200409-30 2004-09-22

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):xine-ui CVE #(s):CAN-2004-0372
Created:April 6, 2004 Updated:April 27, 2006
Description: Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:
Gentoo 200404-20 2004-04-27
Slackware SSA:2004-111-01 2004-04-20
Mandrake MDKSA-2004:033 2004-04-19
Debian DSA-477-1 2004-04-06

Comments (none posted)

xloadimage: buffer overflows

Package(s):xloadimage CVE #(s):CAN-2005-3178
Created:October 10, 2005 Updated:May 15, 2006
Description: Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code.
Alerts:
Fedora-Legacy FLSA:152923 2006-05-12
Gentoo 200510-26 2005-10-30
Mandriva MDKSA-2005:192 2005-10-20
Red Hat RHSA-2005:802-01 2005-10-18
Debian DSA-859-1 2005-10-10
Debian DSA-858-1 2005-10-10
Fedora FEDORA-2005-981 2005-10-10

Comments (none posted)

xorg-x11: heap overflow

Package(s):xorg-x11 CVE #(s):CAN-2005-2495
Created:September 12, 2005 Updated:March 8, 2006
Description: The pixmap memory allocation code in the X.Org X window system is vulnerable to an integer overflow, a local user can use this to execute arbitrary code with elevated privileges.
Alerts:
Fedora-Legacy FLSA:168264-2 2006-03-07
Slackware SSA:2005-269-02 2005-09-26
SuSE SUSE-SA:2005:056 2005-09-26
Debian DSA-816-1 2005-09-19
Fedora FEDORA-2005-894 2005-09-16
Fedora FEDORA-2005-893 2005-09-16
Trustix TSLSA-2005-0049 2005-09-16
Red Hat RHSA-2005:501-01 2005-09-15
Mandriva MDKSA-2005:164 2005-09-13
Red Hat RHSA-2005:396-01 2005-09-13
Red Hat RHSA-2005:329-01 2005-09-12
Ubuntu USN-182-1 2005-09-12
Gentoo 200509-07 2005-09-12

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2005-0064
Created:January 19, 2005 Updated:March 15, 2007
Description: iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:
Fedora FEDORA-2007-1219 2007-03-14
Gentoo 200506-06 2005-06-09
Red Hat RHSA-2005:026-01 2005-03-16
Red Hat RHSA-2005:066-01 2005-02-15
Red Hat RHSA-2005:057-01 2005-02-15
Red Hat RHSA-2005:053-01 2005-02-15
Red Hat RHSA-2005:034-01 2005-02-15
Fedora-Legacy FLSA:2353 2005-02-10
Fedora-Legacy FLSA:2352 2005-02-10
Gentoo 200502-10 2005-02-09
Red Hat RHSA-2005:049-01 2005-02-01
SuSE SUSE-SR:2005:002 2005-01-26
Red Hat RHSA-2005:059-01 2005-01-26
Mandrake MDKSA-2005:020 2005-01-25
Mandrake MDKSA-2005:019 2005-01-25
Mandrake MDKSA-2005:016 2005-01-25
Mandrake MDKSA-2005:021 2005-01-25
Mandrake MDKSA-2005:018 2005-01-25
Mandrake MDKSA-2005:017 2005-01-25
Fedora FEDORA-2005-061 2005-01-25
Fedora FEDORA-2005-062 2005-01-25
Fedora FEDORA-2005-059 2005-01-25
Fedora FEDORA-2005-060 2005-01-25
Conectiva CLA-2005:921 2005-01-25
Fedora FEDORA-2004-049 2005-01-24
Fedora FEDORA-2004-048 2005-01-24
Gentoo 200501-32 2005-01-23
Gentoo 200501-31 2005-01-23
Gentoo 200501-30 2005-01-22
Gentoo 200501-28 2005-01-21
Fedora FEDORA-2005-052 2005-01-20
Fedora FEDORA-2005-051 2005-01-20
Ubuntu USN-64-1 2005-01-19
Debian DSA-645-1 2005-01-19
Debian DSA-648-1 2005-01-19

Comments (1 posted)

xpdf: arbitrary code execution

Package(s):xpdf CVE #(s):CVE-2005-3193
Created:December 6, 2005 Updated:January 11, 2006
Description: Several flaws were discovered in Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened.
Alerts:
Fedora FEDORA-2005-027 2006-01-11
Gentoo 200601-02 2006-01-04
Red Hat RHSA-2005:840-02 2005-12-20
Red Hat RHSA-2005:867-01 2005-12-20
Fedora FEDORA-2005-1170 2005-12-17
Fedora FEDORA-2005-1169 2005-12-17
Gentoo 200512-08 2005-12-16
Fedora FEDORA-2005-1146 2005-12-14
Fedora FEDORA-2005-1142 2005-12-14
Fedora FEDORA-2005-1141 2005-12-14
Ubuntu USN-227-1 2005-12-12
Fedora FEDORA-2005-1126 2005-12-07
Fedora FEDORA-2005-1127 2005-12-07
Fedora FEDORA-2005-1125 2005-12-07
Fedora FEDORA-2005-1122 2005-12-06
Fedora FEDORA-2005-1121 2005-12-06
Red Hat RHSA-2005:840-01 2005-12-06

Comments (none posted)

xpdf: heap overflows

Package(s):xpdf gpdf kpdf poppler CVE #(s):CVE-2005-3624 CVE-2005-3625 CVE-2005-3626 CVE-2005-3627
Created:January 11, 2006 Updated:March 10, 2006
Description: Xpdf, the associated poppler library, and other applications using that library are susceptible to a new set of buffer overflows discovered by Chris Evans and infamous41md. These overflows could be exploited, via a malicious PDF file, to execute arbitrary code on the target system.
Alerts:
Fedora-Legacy FLSA:176751 2006-03-07
Mandriva MDKSA-2006:030 2006-02-02
Debian DSA-962-1 2006-02-01
Debian DSA-961-1 2006-02-01
Gentoo 200601-17 2006-01-30
Debian-Testing DTSA-28-1 2005-01-25
Debian DSA-950-1 2006-01-23
Trustix TSLSA-2006-0002 2006-01-13
Debian DSA-940-1 2006-01-13
Mandriva MDKSA-2006:012 2006-01-12
Fedora FEDORA-2005-028 2006-01-12
Fedora FEDORA-2005-029 2006-01-12
Debian DSA-938-1 2006-01-12
Debian DSA-937-1 2006-01-12
SuSE SUSE-SA:2006:001 2006-01-11
Red Hat RHSA-2006:0177-01 2006-01-11
Red Hat RHSA-2006:0163-01 2006-01-11
Mandriva MDKSA-2006:011 2006-01-10
Mandriva MDKSA-2006:010 2006-01-10
Debian DSA-936-1 2006-01-11

Comments (none posted)

xpdf: denial of service

Package(s):xpdf kpdf CVE #(s):CAN-2005-2097
Created:August 9, 2005 Updated:August 2, 2006
Description: A flaw was discovered in Xpdf in that could allow an attacker to construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened.
Alerts:
Debian DSA-1136-1 2006-08-02
Mandriva MDKSA-2005:138-1 2005-09-19
Debian DSA-780-1 2005-08-22
SuSE SUSE-SR:2005:019 2005-08-19
Fedora FEDORA-2005-732 2005-08-17
Fedora FEDORA-2005-733 2005-08-17
Gentoo 200508-08 2005-08-16
Fedora FEDORA-2005-730 2005-08-15
Fedora FEDORA-2005-729 2005-08-15
Mandriva MDKSA-2005:136 2005-08-11
Mandriva MDKSA-2005:135 2005-08-11
Mandriva MDKSA-2005:134 2005-08-11
Mandriva MDKSA-2005:138 2005-08-11
Red Hat RHSA-2005:708-01 2005-08-10
Red Hat RHSA-2005:706-01 2005-08-09
Red Hat RHSA-2005:671-01 2005-08-09
Red Hat RHSA-2005:670-01 2005-08-09
Ubuntu USN-163-1 2005-08-09

Comments (none posted)

xpdf: integer overflows

Package(s):xpdf, poppler, cupsys, tetex-bin CVE #(s):CVE-2005-3624 CVE-2005-3625 CVE-2005-3626 CVE-2005-3627
Created:January 5, 2006 Updated:November 30, 2006
Description: xpdf has a number of integer overflows. A remote attacker can trick a user into opening a maliciously crafted pdf file, allowing the attacker to execute code with the privileges of the local user. This also affects the Poppler library, cupsys and tetex-bin.
Alerts:
Fedora FEDORA-2006-1220 2006-11-30
Debian DSA-932-1 2006-01-09
Debian DSA-931-1 2006-01-09
Ubuntu USN-236-2 2006-01-09
Mandriva MDKSA-2006:008 2006-01-06
Mandriva MDKSA-2006:006 2006-01-05
Mandriva MDKSA-2006:005 2006-01-05
Mandriva MDKSA-2006:004 2006-01-05
Mandriva MDKSA-2006:003 2006-01-05
Ubuntu USN-236-1 2006-01-05

Comments (none posted)

zlib: buffer overflow

Package(s):zlib CVE #(s):CAN-2005-1849
Created:July 21, 2005 Updated:April 11, 2006
Description: zlib has a vulnerability that can cause code that executes it to crash if a corrupted file is opened.
Alerts:
Mandriva MDKSA-2006:070 2006-04-10
Debian DSA-1026-1 2006-04-06
Gentoo 200603-18 2006-03-21
Ubuntu USN-151-4 2005-11-09
Ubuntu USN-151-3 2005-10-28
Fedora-Legacy FLSA:162680 2005-09-14
Debian DSA-797-1 2005-09-01
Gentoo 200508-01 2005-08-01
Gentoo 200507-28 2005-07-30
SuSE SUSE-SA:2005:043 2005-07-28
OpenPKG OpenPKG-SA-2005.014 2005-07-28
Mandriva MDKSA-2005:124 2005-07-22
Slackware SSA:2005-203-03 2005-07-23
Ubuntu USN-151-2 2005-07-22
Fedora FEDORA-2005-626 2005-07-22
Fedora FEDORA-2005-625 2005-07-22
Gentoo 200507-19 2005-07-22
Red Hat RHSA-2005:584-01 2005-07-21
Ubuntu USN-151-1 2005-07-21
Debian DSA-763-1 2005-07-20

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current stable 2.6 release is 2.6.15.1, announced on January 14. This one contains a dozen or so patches for kernel crashes and security problems.

The current 2.6 prepatch is 2.6.16-rc1, announced by Linus on January 17. The details of what's in this release can be found in last week's summary and this week's update (see below). In brief: 2.6.16 will include the OCFS2 filesystem, the swap migration patches, various new drivers, the mutex changeover, high-resolution timers, a transparent inter-process communication (TIPC) protocol implementation, a big netfilter update, a new batch-level scheduler class, and more. See the short log file for an overview (note that "short" is relative) or the long-format log for the details.

Linus's post-rc1 git repository contains a pile of network driver updates and a few other fixes. The 2.6.16 merge window has closed, so one would not expect to see a whole lot of new features going in at this point. There will apparently be one exception, however: Andrew Morton intends to merge the openat() series of system calls, along with the pselect() and ppoll() implementation. These new system call were covered here last December.

The current -mm tree is 2.6.16-rc1-mm1. Recent changes to -mm include a bunch of reiser3 work ("Please test with caution, but please test."), several more semaphore-to-mutex conversion patches, multi-column oops stack backtraces for i386, and a new software suspend API intended to help move some of the image save/restore work to user space.

Comments (none posted)

Kernel development news

More changes for 2.6.16

A fair number of patches have been merged since the looking forward to 2.6.16 article was published. In addition to everything listed there, the following patches are part of 2.6.16-rc1, starting with user-visible changes:

  • A big XFS update which should improve performance.

  • A big direct rendering update. The Video4Linux and DVB code have also seen large updates.

  • An implementation of the Transparent Inter-Process Communication (TIPC) protocol. TIPC is used for communication within clusters.

  • Harald Welte's massive "x_tables" patch, which unifies much of the code for various types of tables used in the netfilter code.

  • A big PowerPC update including experimental Mac G5 support. There is also a new virtual "spufs" filesystem providing access to "synergistic processing units" on the Cell architecture.

  • A framework for "serial peripheral interface" (SPI) devices has been added, along with a handful of drivers.

  • A new SCHED_BATCH scheduler class. Processes in this class are scheduled normally, with the exception that they get no "interactivity" bonus when they sleep. Unprivileged processes are allowed to move between SCHED_NORMAL and SCHED_BATCH at will.

  • The tmpfs filesystem has acquired a new set of mount options allowing the system administrator to specify how memory should be allocated across a NUMA system.

Changes visible to kernel developers include:

  • Many parts of the kernel have been converted over to the new mutex type.

  • Old-timers who automatically type "make bzImage" will find that it no longer works; just type "make" instead.

  • The device probe() and remove() methods have been moved from struct device_driver to struct bus_type. The bus-level methods will override any remaining driver methods.

  • When the kernel is configured to be optimized for size, gcc (if it's version 4.x) is given the freedom to decide whether inline functions should really be inlined. The __always_inline attribute now truly forces inlining in all cases. This is an outcome from the discussion on inline functions held a couple of weeks ago.

  • Another outcome from that discussion: many kernel functions have had the inline attribute removed. One of the more significant of these is capable(), which has also been moved to <linux/capability.h>.

  • The old inter_module functions are only built if the one in-kernel user (the MTD drivers) is present; otherwise they are unavailable.

The merge window for 2.6.16 is effectively closed, so there should not be a whole lot more in the way of significant changes being merged in this cycle.

Comments (5 posted)

The high-resolution timer API

Last September, this page featured an article on the ktimers patch by Thomas Gleixner. The new timer abstraction was designed to enable the provision of high-resolution timers in the kernel and to address some of the inefficiencies encountered when the current timer code is used in this mode. Since then, there has been a large amount of discussion, and the code has seen significant work. The end product of that work, now called "hrtimers," was merged for the 2.6.16 release.

At its core, the hrtimer mechanism remains the same. Rather than using the "timer wheel" data structure, hrtimers live on a time-sorted linked list, with the next timer to expire being at the head of the list. A separate red/black tree is also used to enable the insertion and removal of timer events without scanning through the list. But while the core remains the same, just about everything else has changed, at least superficially.

There is a new type, ktime_t, which is used to store a time value in nanoseconds. This type, found in <linux/ktime.h>, is meant to be used as an opaque structure. And, interestingly, its definition changes depending on the underlying architecture. On 64-bit systems, a ktime_t is really just a 64-bit integer value in nanoseconds. On 32-bit machines, however, it is a two-field structure: one 32-bit value holds the number of seconds, and the other holds nanoseconds. The order of the two fields depends on whether the host architecture is big-endian or not; they are always arranged so that the two values can, when needed, be treated as a single, 64-bit value. Doing things this way complicates the header files, but it provides for efficient time value manipulation on all architectures.

A whole set of functions and macros has been provided for working with ktime_t values, starting with the traditional two ways to declare and initialize them:

    DEFINE_KTIME(name);   /* Initialize to zero */

    ktime_t kt;
    kt = ktime_set(long secs, long nanosecs);

Various other functions exist for changing ktime_t values; all of these treat their arguments as read-only and return a ktime_t value as their result:

    ktime_t ktime_add(ktime_t kt1, ktime_t kt2);
    ktime_t ktime_sub(ktime_t kt1, ktime_t kt2);  /* kt1 - kt2 */
    ktime_t ktime_add_ns(ktime_t kt, u64 nanoseconds);

Finally, there are some type conversion functions:

    ktime_t timespec_to_ktime(struct timespec tspec);
    ktime_t timeval_to_ktime(struct timeval tval);
    struct timespec ktime_to_timespec(ktime_t kt);
    struct timeval ktime_to_timeval(ktime_t kt);
    clock_t ktime_to_clock_t(ktime_t kt);
    u64 ktime_to_ns(ktime_t kt);

The interface for hrtimers can be found in <linux/hrtimer.h>. A timer is represented by struct hrtimer, which must be initialized with:

    void hrtimer_init(struct hrtimer *timer, clockid_t which_clock);

Every hrtimer is bound to a specific clock. The system currently supports two clocks, being:

  • CLOCK_MONOTONIC: a clock which is guaranteed always to move forward in time, but which does not reflect "wall clock time" in any specific way. In the current implementation, CLOCK_MONOTONIC resembles the jiffies tick count in that it starts at zero when the system boots and increases monotonically from there.

  • CLOCK_REALTIME which matches the current real-world time.

The difference between the two clocks can be seen when the system time is adjusted, perhaps as a result of administrator action, tweaking by the network time protocol code, or suspending and resuming the system. In any of these situations, CLOCK_MONOTONIC will tick forward as if nothing had happened, while CLOCK_REALTIME may see discontinuous changes. Which clock should be used will depend mainly on whether the timer needs to be tied to time as the rest of the world sees it or not. The call to hrtimer_init() will tie an hrtimer to a specific clock, but that clock can be changed with:

    void hrtimer_rebase(struct hrtimer *timer, clockid_t new_clock);

Most of the hrtimer fields should not be touched. Two of them, however, must be set by the user:

    int  (*function)(void *);
    void *data;

As one might expect, function() will be called when the timer expires, with data as its parameter.

Actually setting a timer is accomplished with:

    int hrtimer_start(struct hrtimer *timer, ktime_t time,
                      enum hrtimer_mode mode);

The mode parameter describes how the time parameter should be interpreted. A mode of HRTIMER_ABS indicates that time is an absolute value, while HRTIMER_REL indicates that time should be interpreted relative to the current time.

Under normal operation, function() will be called after (at least) the requested expiration time. The hrtimer code implements a shortcut for situations where the sole purpose of a timer is to wake up a process on expiration: if function() is NULL, the process whose task structure is pointed to by data will be awakened. In most cases, however, code which uses hrtimers will provide a callback function(). That function has an integer return value, which should be either HRTIMER_NORESTART (for a one-shot timer which should not be started again) or HRTIMER_RESTART for a recurring timer.

In the restart case, the callback must set a new expiration time before returning. Usually, restarting timers are used by kernel subsystems which need a callback at a regular interval. The hrtimer code provides a function for advancing the expiration time to the next such interval:

    unsigned long hrtimer_forward(struct hrtimer *timer, ktime_t interval);

This function will advance the timer's expiration time by the given interval. If necessary, the interval will be added more than once to yield an expiration time in the future. Generally, the need to add the interval more than once means that the system has overrun its timer period, perhaps as a result of high system load. The return value from hrtimer_forward() is the number of missed intervals, allowing code which cares to detect and respond to the situation.

Outstanding timers can be canceled with either of:

    int hrtimer_cancel(struct hrtimer *timer);
    int hrtimer_try_to_cancel(struct hrtimer *timer);

When hrtimer_cancel() returns, the caller can be sure that the timer is no longer active, and that its expiration function is not running anywhere in the system. The return value will be zero if the timer was not active (meaning it had already expired, normally), or one if the timer was successfully canceled. hrtimer_try_to_cancel() does the same, but will not wait if the timer function is running; it will, instead, return -1 in that situation.

A canceled timer can be restarted by passing it to hrtimer_restart().

Finally, there is a small set of query functions. hrtimer_get_remaining() returns the amount of time left before a timer expires. A call to hrtimer_active() returns nonzero if the timer is currently on the queue. And a call to:

    int hrtimer_get_res(clockid_t which_clock, struct timespec *tp);

will return the true resolution of the given clock, in nanoseconds.

Comments (9 posted)

Containers and PID virtualization

The folks at IBM would like to add a "container" capability to the Linux kernel. Containers are a way of walling a group of processes off from the rest of the system; a process within a container will only see its fellow inmate processes and whatever resources are made accessible to that container. This feature has some obvious security-related applications. IBM's plans, evidently, also include the ability to pack up a container and move it to another physical host without disrupting the processes trapped inside.

The patches which have been circulating so far fall short of the final plan, but they already disturb enough code to have attracted some skeptical criticism. In particular, the 34-part PID virtualization patch creates a simple container type, and implements a separate process ID space within containers. But, as we'll see, doing even that much involves some significant kernel changes.

The containers themselves are fairly simple. The patches create a virtual file called /proc/container. If a process writes a string to that file, a new container is created for that process, using the string as its name. The namespace is global, so every container on the system must have a unique name. Any child processes created by the newly-contained process will also be trapped within the container, with no way out.

At this point, being inside a container does not affect a process's life that much. The one thing that does change, however, is that each container has its own process ID (PID) space. Processes within the container can only see others in the same container. There is nothing particularly controversial about that behavior, but the developers have another objective in mind: they want to be able to change the PIDs of contained processes without the processes themselves noticing. In particular, they would like to be able to migrate a container to a different system, which will certainly assign new PIDs to every process within the container. Code written for Unix-like systems does not normally expect its PID to change over time, however; so switching PIDs underneath a process could lead to all kinds of strange behavior. To avoid this problem, the plan is that PIDs remain constant within the container, even if those PIDs change in the real world.

Implementing constant PIDs (from a viewpoint inside the container) is not a straightforward task; it involves adding a whole new virtualization layer inside the kernel. There are two types of PIDs now, "real" PIDs and the virtual PIDs used by contained processes. Any place in the kernel which deals with PID values must become aware of which type of PID it is using, and convert to the other type when necessary. So, as a general rule, any code which exchanges PIDs with user space must use the virtual variety, while PIDs handled within the kernel are real.

The PID logic is complicated by a few little details, like: what happens when containers are nested? A process living within a container has a real PID and a virtual PID associated with the container. If that process creates a container of its own, it will acquire yet another PID associated with the new container. So it is not possible to simply convert a real PID to a virtual PID; such questions require a "context" so that the kernel knows which virtual PID is wanted.

The result of all this is that PID handling within the kernel changes significantly. Code which used to get the current process's PID with current->pid must now use tsk_pid(current) for the real PID, or tsk_vpid(current) for the virtual PID - and it must know which one it wants. In situations where more than one virtual PID might be appropriate, tsk_vpid_ctx() must be used to supply the context. Much of the patch set is concerned simply with making these conversions; for good measure, it also renames the pid field of struct task_struct to catch any code still trying to access it directly.

Behind all of this is a concept called "pidspaces." The patch carves up the global PID space takes the upper 9 bits of the 32-bit PID value and puts the pidspace number there. A virtual PID as seen within a container is turned into a real kernel PID by stuffing the pidspace number in those upper bits. Since the contained processes only see virtual PIDs, they never see the pidspace number, and they will not notice if that number changes.

All of this code seems to work, but there is a certain amount of opposition to merging it. As Alan Cox put it:

This is an obscure, weird piece of functionality for some special case usages most of which are going to be eliminated by Xen. I don't see the kernel side justification for it at all.

The developers answer that the ability to checkpoint and restart process trees, possibly moving them in between, will be highly useful. Some other virtualization projects also require this capability - not everybody wants to use Xen. So the pressure for PID virtualization probably won't just go away.

What might happen is that the hiding of current->pid might be taken out, greatly reducing the size of the patch. Another idea which has been floated is to eliminate, to the greatest degree possible, the use of PIDs within the kernel. Almost any in-kernel use of a PID can be replaced with a direct pointer to the task structure. If a PID eventually is reduced to little more than a process-identifying cookie used for communication with user space, it will be easier to virtualize without complicating large amounts of kernel code.

Comments (8 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

  • Junio C Hamano: GIT 1.1.2. (January 14, 2006)

Device drivers

Documentation

Filesystems and block I/O

Janitorial

Networking

Architecture-specific

Security-related

Page editor: Jonathan Corbet

Distributions

News and Editorials

What's New in Fedora Core 5 Test2

January 18, 2006

This article was contributed by Ladislav Bodnar

After several weeks of delay, the second development release of Fedora Core 5 was finally made available on January 16th. This is a much anticipated version - not only will this be Fedora's first new release after switching to a longer, 9-month release cycle, it is likely that much of the distribution's current core will form the basis of the upcoming release of Red Hat Enterprise Linux (RHEL) 5. As such, Fedora 5 is expected to be well-tested and relatively bug-free, with fewer experimental features, but better stability and reliability. According to Fedora's release schedule, Test2 will be followed by Test3 in about a month's time before the final release on March 15th.

What's new in Fedora Core 5? Users performing a new installation will immediately notice that the Anaconda installer has been given a major interface overhaul. The informational pane on the left of the installation screens has been removed and many of the installation dialogs have been simplified, with more advanced options hidden behind an extra click. The screens providing partitioning and package selection dialogs have also been modified, while the option to set SELinux functionality has been moved into the post-installation setup. Personally, I can't say I like the changes. Anaconda, a de facto standard among Linux installers, has been barely touched for years, so why the sudden need for a major interface surgery?

The core system components have been upgraded. Test2 comes with kernel 2.6.15, a development release of glibc 2.4, as well as a CVS build of the yet-to-be released GCC 4.1. The upgrade to glibc 2.4 is particularly significant since Fedora Core 5 will be the first distribution shipping with the new major version of the GNU C library. Although it is still in heavy development, we know that the new glibc will no longer be compilable with GCC 3.x, it won't support LinuxThreads (only Native Posix Thread Library), and all non-desktop CPUs will be moved to an unsupported ports add-on. As for the GCC 4.1 series, one of the most important improvements in its code is the introduction of fstack-protector, a feature whose purpose is to assign a random and verifiable value to the stack of key functions. This feature will make it harder for remote attackers to exploit buffer overflows.

On the desktop, a current development release of GNOME 2.14, combined with a brand new desktop theme, wallpaper and screensaver, represent a major visual change from the previous test release. With GNOME 2.14, much effort has been focused on the Evolution mail client, which is undergoing subtle interface changes, including dialog simplification and general improvements in consistency and polish. There has been a lot of emphasis on reduction of load times and memory footprints of both the GNOME desktop and its applications. The users of GnomeMeeting and Eye Of GNOME will also notice substantial interface changes, while much of Gedit's code has been rewritten under a new Multiple Documentation Interface specification. The Nautilus search engine has also been enhanced. Coincidentally, GNOME 2.14 final is scheduled to be released on March 15, exactly the same day as Fedora Core 5 - a fact that will almost certainly give rise to a few heated debates on the Fedora mailing lists and forums.

As for the main applications, Firefox 1.5 and OpenOffice.org 2.0.1 feature prominently on the desktop, but other recent additions to Fedora Core, such as the Beagle desktop search tool (version 0.1.4), F-Spot photo manager (0.1.5) and Tomboy note-taking utility, are also being pushed under the spotlight. On the other hand, Mono, a software suite for developing .NET client and server applications and which was added to the Fedora tree only recently, is not even mentioned in the release announcement - despite the fact that its sudden presence in Fedora caused a stir on many Linux news sites just last week. Although Mono is now an integral part of Fedora Core, Red Hat has stated that the product, which is developed by Novell (Red Hat's main commercial competitor) will not be included in the next release of the company's enterprise range of products.

Another new piece of software in Fedora Core 5 is "Package Updater", or pup for short. This is an application with a very simple interface - it lists all available updates after checking with the main update server, and allows the user to receive the latest security and bug fixes. There is nothing else to it - no intuitive way to configure the location of the update server or to prevent certain applications from being replaced with newer versions. Following the installer, this is another area which the Fedora development team decided to simplify in order to appease the non-technical computer user and perhaps to reduce the cost of technical support further down the line. Of course, power users can still reach for the command line to run yum and customize the package update options, but those who are not prepared to read the man pages are now expected to use pup.

Overall, I found that using this test release of Fedora Core was mostly a positive experience. Although I disliked the simplification effort in the installer and some of the applications, if it proves to be a successful way of bringing more users and companies to Linux, then I am all for it. On the application side, I haven't had any major problems during the two days of testing, but some users on the Fedora test list reported crashes in Evolution and GNOME Terminal, as well as a non-operational Nautilus CD Burner. At one time, while running Beagle and pup, my system became unresponsive and had to be rebooted, but I wasn't able to reproduce this later. A large number of updates have appeared on the Fedora development server since the release so it is likely that some of these bugs are fixed already. A decent release overall, but it still needs a fair amount of testing before it can be declared stable.

Comments (7 posted)

New Releases

K/Ubuntu Flight CD 3

Flight CD 3, milestone CD images of K/Ubuntu's Dapper Drake release, are available for testing and bug busting. The Edubuntu release should be available soon. Click below for a list of notable changes in this release.

Full Story (comments: 6)

Announcing Fedora Core 5 Test 2

The Fedora Project has announced the second release of the Fedora Core 5 development cycle, available for the i386, x86_64, and PPC/PPC64 architectures. Please note that Fedora Core 3 has now been transfered the the Fedora Legacy Project.

Full Story (comments: 7)

Fedora-netdev FC4

The latest Fedora Core 4 netdev kernel, kernel-2.6.14-1.1656_FC4.netdev.8 is now available. Click below for a list of patches that have been applied to this kernel package.

Full Story (comments: none)

Novell Releases SUSE Linux Enterprise Server SP3 (ITJungle)

ITJungle covers the release of Service Pack 3 for SUSE Linux Enterprise Server 9. "SLES 9 SP3 also has the AppArmor security program that Novell bought when it acquired Immunix, a provider of application security software for Linux, last May. SLES 9 SP3 has AppArmor woven in as well as Linux application security profiles for selected applications; the exact number was not revealed in the SP3 release notes. As the company revealed when it took the AppArmor product open source as an openSUSE project earlier this week, the full AppArmor code and a more complete set of application security profiles--some made by Novell, some made by application providers through the openSUSE community--are expected to be embedded into the future SLES 10 operating system, which is expected some time in May of this year."

Comments (none posted)

Distribution News

AGNULA loses its funding

The AGNULA project, whose goal is to put together a "reference multimedia distribution" based on Debian, has sent out a terse announcement saying that the Italian agency which has funded the project for the last few years has moved on to other things. As a result, AGNULA is now a 100% volunteer project. Projects like AGNULA are important - few people would say that the Linux multimedia experience is in no need of improvement. Hopefully they will be able to carry their work forward.

Full Story (comments: none)

Debian news

Watch for some major bug busting in the unstable tree. "This note is just some advance notice so that folks who don't want to risk any negative consequences, whatever they end up being, can ensure they don't have any RC bugs that are weeks old. Note that the RMs have declared it open season on NMUs, so do look at packages you care about even if you don't maintain them."

Here's a note about how the mirrors will be split. "First, the executive summary for mirror operators reading this: we'll be switching the primary mirror stuff for Debian to be for a small number of architectures rather than all of them; initially this will just be i386, but will probably expand to include amd64."

There are currently two proposals in discussion on debian-vote. This post contains links for those interested in keeping up with the discussion.

Comments (none posted)

Ubuntu Bugzilla to Malone (Launchpad) migration complete

Ubuntu has made a transition from Bugzilla to Launchpad's Malone bug tracker. All bugs are still available for browsing in Bugzilla, but logins are disabled.

Full Story (comments: none)

New Distributions

GParted LiveCD 0.1 (GnomeDesktop)

GnomeDesktop introduces the GParted LiveCD, a small, fast, Slackware-based live CD that syncs its releases with GParted.

Comments (none posted)

Distribution Newsletters

Debian Weekly News

The Debian Weekly News for January 17, 2006 is out, with a look at a proposed a license sufficient for Debian and FreeBSD for the Internet Engineering Task Force that releases RFC documents, the availability of X.org packages for the Hurd, the status of the m68k port, splitting mirrors by port, new scripts to discover neglected packages, maintaining packages by a team, and several other topics.

Full Story (comments: 7)

Fedora Projects Weekly Report

In an attempt to widen the communications channel, the Fedora Project has started a series of weekly reports; the January 16 edition is available now. It contains a terse summary of changes in rawhide, current known issues, and more.

Comments (none posted)

Fedora Weekly News Issue 29

The Fedora Weekly News covers Fedora Initiatives at LinuxWorld, Fedora Projects Weekly Report, Kadischi Screenshots in osdir.com, Mono and Fedora, Fedora Directory Server in Media, Fedora Rescue CD in Media, Thunderbird 1.5 Released, and other topics.

Comments (none posted)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of January 16, 2006 is out. This edition covers new baselayout with improved runscripts, Portage changes USE flags default behavior, PPC development roadmap, AMD64 project update, and other topics.

Comments (none posted)

DistroWatch Weekly, Issue 134

The DistroWatch Weekly for January 16, 2006 is out. "Several interesting announcements at last week's MacWorld provided fuel for many technology web sites, but an important question remained unanswered: will Linux run on the new MacBooks? Read on for an expert opinion. A rather quiet week on the Linux distribution front, but expect things to pick up shortly as the second test of Fedora Core 5 will be officially out today (Monday), while the first beta of SUSE Linux 10.1 should appear on mirrors later this week. Also in this issue: Fedora or Yellow Dog for your Mac, Xandros seeks beta testers, Debian terminology explained, news from the development of Dapper Drake, a new SUSE-based distribution for musicians, GParted Live CD for all your disk partitioning tasks, and a good round-up of popular Linux live CDs."

Comments (none posted)

Package updates

Fedora Core updates

Fedora Core 4 updates: system-config-bind (restore pre-FC5 pam configuration file), flex (bug fixes), alsa-lib (new ainit (0.7), fix for SW modems and root users), groff (bug fixes, spec cleanup), openoffice.org (rebuilt with alternative -mtune parameters for ix86), libwpd (update to latest libwpd), foomatic (fixes a conflict introduced by the HPLIP update, plus other additions and bug fixes), tcpdump (bug fix).

One last Fedora Core 3 update: tzdata (meta changes).

Comments (none posted)

Mandriva updates

Updates available for Mandriva Linux 2006.0: xorg-x11 (update to upstream 6.9.0 final), festival (rebuilt to prevent crashes), klamav (update to v0.32), OpenOffice.org (fix random crashes).

Updates for Mandriva Corporate Server 2.1: squid (new features).

Comments (none posted)

Slackware updates

The January 14 entry on the slackware-current changelog shows new linux-2.6.14.6 packages in testing, an upgrade to x11-6.9.0, and a few other changes.

Comments (none posted)

Trustix update

PostgreSQL has been updated for TSL 3.0 and 2.2, fixing various bugs.

Full Story (comments: none)

Newsletters and articles of interest

Linux Live CDs: All the Linux with None of the Commitment (informit.com)

Informit.com looks at some popular live Linux CD distributions. "Unfortunately, I can't cover everyone's favorite distro because I'd end up with a text book rather than an article, but I'll be looking at several popular distributions including SimplyMEPIS, SLAX, Damn Small Linux, Knoppix, and Puppy, and on the Mac side of things, Ubuntu. I'll also take a quick look at LG3D (Looking Glass 3D) and INSERT (Inside Security Rescue Toolkit). This should give you a good overview of just what's out there, as well as some of the cool things you can do with a live Linux CD."

Comments (none posted)

Distribution reviews

Review: Grafpup Linux live CD for graphic designers (Linux.com)

Linux.com reviews Grafpup, a distribution for graphic designers. "Based on Puppy Linux, Grafpup is a small distribution despite its plethora of tools. Download the 75MB ISO and you'll be amazed at its speed and simplicity. When running from the live CD, Grafpup loads the entire operating system into your RAM, ensuring that the applications run instantly. The first time you run the live CD, Grafpup saves a file called "pup101" on your hard disk that contains settings for your keyboard layout, mouse type, and more, so that you don't need to configure your machine each time you boot. Every successive boot completes in less than 20 seconds."

Comments (none posted)

GhostWriter: A Linux distro for writers (Linux.com)

Linux.com reviews the GhostWriter LiveCD. "GhostWriter is a live CD that provides a small number of tools for writers of short stories, novels, and screenplays. But GhostWriter can be used by someone authoring works of non-fiction as well. It's easy to use and has a small footprint. In fact, there's nothing to install -- you run GhostWriter off a CD. Unlike some live CD distros, GhostWriter doesn't have install scripts that let you make it a desktop distribution, but [author Billy-Bob] Ming has hinted that a future version might come with such scripts."

Comments (none posted)

Review: FreeBSD 6.0 (NewsForge)

NewsForge reviews FreeBSD 6.0. "For software that's been around since the late '70s, before any of today's more popular operating systems, open source BSDs (in their current avatars) don't get their due share of hard disks. FreeBSD, one of the first BSD flavors to emerge from the 386BSD project, is a Unix-like free operating system based originally on the BSD branch of 386BSD and later 4.4BSD-Lite. This makes BSD's more like traditional Unixes than Linux. Late last year FreeBSD unleashed release 6.0, with better support for 64-bit and wireless hardware."

Comments (1 posted)

Page editor: Rebecca Sobol

Development

Using open-source tools for documenting research

January 18, 2006

This article was contributed by Carl Bolduc

Introduction

Getting published is a major concern for students conducting graduate studies in science. I'm a PhD student in molecular biology and I started using Linux at the beginning of my graduate studies. Public science research mostly looks like open-source software development. You work hard and give your methods and results to everyone through publications in scientific journals. Ironically, the majority of people working in the field of science use only proprietary software. I myself work in a Microsoft Windows environment.

A typical scientific article will require the use of several tools to reach its final published state. First, most researchers use Microsoft Word and Excel for text writing and tables. They also use EndNote to manage and create the bibliographies you will find in every scientific article. Finally, scientists use a graphics suite, such as Adobe's Photoshop, for figures and PDF creation. This software listing scales up to more than one thousand dollars. It's practically impossible for the regular student to purchase such a platform. In some laboratories, when the head researcher is kind enough, you will find a computer where most of these tools are installed and shared by all members of the team. But what if you could create your own open-source research writing box for free? In fact, you can. You can accomplish the entire array of tasks associated with scientific writing with any good Linux distribution.

The easiest step

One of the most popular open source application that has boosted the Microsoft to Linux transition is certainly OpenOffice.org. For anybody working in science reporting, it is a first and easy step that enables you to step out of proprietary software and remain compatible with Microsoft Office formats. In addition, several journals will ask that the submissions should be in the .doc or PDF format. OpenOffice.org saves you a lot of trouble with its useful PDF export tool.

Although OpenOffice.org can complete a fair portion of the job, it doesn't contain a bibliographic manager tool such as EndNote yet. Such a facility is necessary for academic writer and OpenOffice.org is supposed to fill the blank with some bibliographic extensions in its next version. For now, there is a commercial web-based tool called WriteNote which offers a 30 day free trial and enables you to produce a bibliography with RTF files created by OpenOffice.org.

LaTeX

While OpenOffice.org may be a first step toward writing scientific articles under Linux, the true power resides inside LaTeX. As it is mentioned on the latex project website: "LaTeX is a high-quality typesetting system, with features designed for the production of technical and scientific documentation". "LaTeX is the de facto standard for the communication and publication of scientific documents."

Some of the LaTeX features include insertion of tables and figures as well as the capacity to create complex mathematical equations. Additionally, there are tremendous advantages in learning to write with LaTeX. In fact, BibTeX could get you out of proprietary software tomorrow. You can gather your bibliographic references in a simple text file with the BibTeX syntax and easily insert quotations inside your LaTeX documents, automatically generating a bibliography at the end of your articles.

While the LaTeX format requires a minimum of learning, you can rely on the useful TeXmed web-based tool to query NCBI PubMed and generate BibTeX entries for you. You must specify, in your LaTeX document, a bibliography style to format it according to the journal's recommendations. In fact, many journals now offer their bibliography style on their website. If you can't find the format that you need on the web, you can use custom-bib to create the style you need.

LyX and friends

LaTeX basics can be learned quite easily, but you might need to read a lot from the web or buy some books (like I did) to use its full potential. But do you really need to go through all this trouble? That's where LyX comes into play.

LyX is a GUI front end to LaTeX. Though it has its own file format, it can import and export to LaTeX. LyX looks like a word processor while taking care of all the formatting, just like LaTeX. LyX is fully featured and let you insert figures, tables, mathematical equations and more. Though managing a bibtex text file is very easy, you can rely on graphical tools here too. Software like gBib and JabRef will help you deal with your numerous references and even let you insert them in LyX, just like EndNote does with Word.

Gnuplot

Continuing in your path to build an open-source research writing box, you need a powerful tool to generate plots from your precious experiment results. That is where Gnuplot enters the scene, with its almost limitless possibilities. Gnuplot is a command-line plotting utility with easy to learn commands that enable you to create high quality 2D and 3D plots suitable for scientific publications. It can output LaTeX and EPS code which can be inserted in your LaTeX documents. You can check out this demo that shows the wide variety of Gnuplot's capabilities.

Inkscape

One thing that was really missing in Linux in the past was a good vector graphics editor. I had to install Adobe Illustrator under Wine to be able to draw high quality figures showing various metabolic pathways. Now, with Inkscape, I have everything that I need to create high quality vector graphics which can be exported to EPS and inserted in my LaTeX documents. Inkscape can draw shapes, paths, text and can also export to PNG.

The Gimp

To complete your open-source research writing box, you need a powerful image manipulation program to process your photos and to generate figures from them. That's where The Gimp comes into play. With The Gimp, you can process gel photos, crop the area that you like, obtain negatives of your originals and add labels where you want, all with a few mouse clicks.

Linux drawbacks

While this path can be rewarding, a significant effort will be required. The first thing you need to do is to install a Linux distribution. This might seem frightening to the newcomer, but there are powerful Linux distributions such as Mandriva, Fedora and Ubuntu which are very easy to install and have packaged most of the tools mentioned it this article.

You also need to learn how to use new software. A few of the applications mentioned above only have a command-line interface, but most operations can be performed using GUI-based tools. There is plenty of documentation online, and you can always join an IRC channel to get live help. In a short time, you will become very functional, and you will reach new levels of productivity.

The worst drawback of using Linux in a Microsoft-based environment may involve compatibility issues with your coworkers. Since my boss insists on working with .doc files, I have to convert my papers to RTF using latex2rtf before I send him anything, even if PDF is the most portable format out there. But this doesn't stop me from benefiting of the LaTeX functionality.

Finally, you must rely on the Internet for support. Most of the system administrators in the research field don't know much about Linux (at least not in Quebec, where I'm working) and won't be able to support you if you have problems.

Linux superiority

Beside the fact that Linux and all this software is free, there are many advantages in building an open-source research writing box. Linux provides a robust environment that is a virtually virus-free. Interoperability among applications is quite good, all of the applications mentioned in this article can share data through the LaTeX and EPS file formats.

With little experience, you will start working faster and more efficiently. Serious page formatting issues found in Windows-based WYSIWYG software will be gone. Finally, you will be able to easily share your work by creating high quality PDF files.

An example screenshot of my desktop publishing environment can be seen here.

Comments (40 posted)

System Applications

Database Software

MySQL 5.1.5-alpha has been released

Version 5.1.5-alpha of the MySQL database has been released. "This is a new alpha development release, adding new features and fixing recently discovered bugs."

Full Story (comments: none)

New Event Feature in MySQL 5.1.6

Trudy Pelzer explains events under MySQL version 5.1.6. "In this article, I'll give a preliminary description of a new MySQL feature for scheduling and executing tasks. In version 5.1.6, MySQL has added support for events. That is, you can now say: "I want the MySQL server to execute this SQL statement every day at 9:30am, until the end of the year" -- or anything similar that involves any number of SQL statements, and a schedule. Note that events are new and still in alpha, so there is still a good chance that we'll have to make adjustments as people experiment with them. This article describes the state of affairs only for the 5.1.6 release of MySQL."

Comments (5 posted)

Embedded Systems

BusyBox 1.1.0 is out

Version 1.1.0 of BusyBox, a compressed collection of command line tools for embedded systems, has been released. "The new stable release is BusyBox 1.1.0. It has a number of improvements, including several new applets. (It also has a few rough spots, but we're trying out a "release early, release often" strategy to see how that works. Expect 1.1.1 sometime in March.)"

Comments (none posted)

KLone 1.0.1 released

Version 1.0.1 of KLone, a small embeddable web server, has been released. LinuxDevices.com is also running a review of KLone. (Thanks to Steven Dorigotti.)

Comments (none posted)

Web Site Development

Campsite 2.4 Released

Version 2.4 of Campsite, a multi-lingual content management system for news websites, is available. "Version 2.4 is a major feature release."

Full Story (comments: none)

Desktop Applications

Audio Applications

SilentJack version 0.1 announced

The initial version of SilentJack is available. "SilentJack is a silence/dead air detector for the Jack Audio Connection Kit. It monitors the peak levels on a single JACK input port, and checks to see if they are below a specified theshold. SilentJack then runs a command after silence has been detected for a given number of seconds. It then waits for the command the finish, and waits for a grace period before detecting silence again."

Full Story (comments: none)

Sweep 0.9.0 Released

Version 0.9.0 of Sweep, a graphical audio file editor, is out. This is the first release of a new unstable series, it includes a switch to GTK2, improved mp3 capabilities, translation work, and more.

Full Story (comments: none)

Data Visualization

Gmsh 1.62 announced

Version 1.62 of Gmsh, a 3D finite element grid generator, has been announced. "This release adds a new option to draw color gradients in the background, an enhanced perspective projection mode, a new "lasso" selection mode, a new snapping grid when adding points in the GUI, a new extrusion syntax and nicer normal smoothing. This release also contains various small bug fixes and enhancements."

Comments (none posted)

Desktop Environments

GNOME Software Announcements

The following new GNOME software has been announced this week: You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

Formation of the KDE Technical Working Group in Progress (KDE.News)

KDE.News covers the formation of the KDE Technical Working Group. "The first Technical Working Group for KDE is now being formed, with elections due over the next few weeks. The Group will help the hundreds of KDE contributors come to technical decisions and smooth processes such as major releases. It will also provide technical guidance to KDE contributors."

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week: You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

Desktop Publishing

LyX 1.3.7 is released

Version 1.3.7 of LyX, a GUI front-end to the TeX typesetting system, is out. Changes include support for the new file format 245 standard, improvements to the Windows version and more.

Full Story (comments: none)

Electronics

Covered 20060109 released

Version 20060109 of Covered, a Verilog code coverage analysis tool, is available. "It has been almost a year since the last development release of Covered, but in the meantime there has been a lot of work put into the score command of Covered during this time to fix bugs, add more coverage support for various Verilog constructs, simulate more accurately, remove memory corruption/estrangement and improve the run-time speed of the score command. I think that user's of Covered will appreciate the enhancements. Documentation updates have been made and build problems have been fixed (Covered now compiles cleanly for Fedora Core 3 builds)."

Comments (none posted)

Kicad 2006-01-13 released

Version 2006-01-13 of Kicad an electronic printed circuit board CAD package, is out with a bug fix and one new feature.

Comments (none posted)

GUI Packages

pyFltk-1.1RC2 announced

Release candidate 2 of pyFltk-1.1, a Python binding to FLTK 1.1, has been announced. "This release candidate has been tested with fltk-1.1.6 and requires Python2.4."

Comments (none posted)

SPTK 3.0.12 announced

Version 3.0.12 of SPTK, the Simply Powerful ToolKit, has been announced. "SPTK 3.0.12 adds support for the database driver messages. These messages may be sent to the driver by the database server on different occasions. These messages may include the extended error information, and the messages created by a stored procedure using (for MSSQL, for instance) PRINT statement."

Comments (none posted)

Mail Clients

Thunderbird 1.5 Released

Thunderbird 1.5 is out. Changes in this release include improvements to the automatic update system, smarter address auto-completion, on-the-fly spelling checking, better searching, some simple phishing detection (covered here last October), the ability to delete attachments, and much more; see the release notes for details. (As seen on MozillaZine)

Comments (none posted)

Office Applications

Beagle Newsletter

Issue 11 of the Beagle Newsletter has been published. "Beagle is a search tool that ransacks your personal information space to find whatever you're looking for. Beagle can search in many different domains."

Comments (none posted)

HylaFAX 4.2.5 released

Version 4.2.5 of HylaFAX, a fax-modem utility, has been announced. "The HylaFAX development team is pleased to announce our 4.2.5 patch level release! This fixes the problems users have been reporting in 4.2.4, which will be removed from the FTP and web sites. As always, our sincerest thanks go to all who participate and provide feedback." Several security fixes are included in this release.

Comments (none posted)

Office Suites

Moving to OpenOffice: Batch Converting Legacy Documents (O'Reilly)

Bob DuCharme writes about the conversion of legacy documents to OO.o in an O'Reilly xml.com article. "Like its Microsoft counterpart, OpenOffice has a macro language. You can start up OpenOffice from the Linux or Windows command-line prompt with instructions to to run a particular macro, and you can even pass a filename as a parameter to that macro. Adding the -invisible switch to the command line tells OpenOffice to start up without the graphical user interface (GUI). Put all these together, and you've got a command line that converts a Microsoft Office file to an OpenOffice file (or an Acrobat file) with no use of the GUI. To convert a hundred files, you can use a Perl script or other scripting language to create a batch file or shell script that has the hundred commands necessary to convert those files."

Comments (none posted)

Streaming Media

Gst-Python 0.10.2 announced

Version 0.10.2 of Gst-Python, has been announced. "Gst-Python provides Python bindings for the GStreamer project. These bindings provide access to almost all of the GStreamer C API through an object oriented Python API. This release allow fractions in structures and added vmethods for base classes. "

Comments (none posted)

Web Browsers

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the January 4, 2006 mozilla.org staff meeting have been announced. "Issues discussed include Upcoming Releases, Marketing, Thunderbird, 1.9 Roadmap, Firefox 2 Process and Calendar. The mintues have been posted to the new mozilla.dev.general newsgroup, which is accessible via news.mozilla.org."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The January 10-17, 2006 edition of the Caml Weekly News is out with new Caml articles. Topics include: Pickling for OCaml?, Marching Tetrahedra and A bunch of ocaml programs.

Full Story (comments: none)

Java

An Exception Handling Framework for J2EE Applications (O'ReillyNet)

O'Reilly is running an article on J2EE exception handling. "One common hassle in J2EE development is exception handling: many apps devolve into a mess of inconsistent and unreliable handling of errors. In this article, ShriKant Vashishtha introduces a strategy for predictably collecting your exception handling in one place."

Comments (none posted)

Secure Java apps on Linux using MD5 crypt (IBM developerWorks)

Vladimir Silva shows how to interface Java to the PAM system in an IBM developerWorks article. "If you are a security developer and need to interface a Java application with the local operating system user registry, what do you do? This article gives you the answer: UNIX/Linux PAM (Pluggable Authentication Module)-compatible systems that use authentication based on the GNU MD5 extensions to the crypt() system call. I'll describe these extensions and show you a Java implementation of MD5 crypt (using FreeBSD as my UNIX)."

Comments (none posted)

Lisp

GNU CLISP 2.37 released

Version 2.37 of GNU CLISP, a Common Lisp implementation, is out. "This version adds new options to SOCKET-SERVER, changes the way a proxy can be specified for EXT:HTTP-PROXY, treats named pipes correctly, and fixes a few bugs."

Full Story (comments: 1)

HEUTE 1.0 announced

The initial public release of HEUTE is available. "HEUTE (Hierarchical Extensible Unit Testing Environment for Common LISP) is a unit testing framework written in Common Lisp. It features a hierarchical approach to testing in which a test suite is represented by a CLOS class, with subclasses corresponding to sub-suites. A suite is considered passed only when its sub-suites also pass."

Full Story (comments: none)

Perl

What is Perl 6? (O'Reilly)

chromatic looks at the motivation for designing Perl 6 in an O'Reilly article. "Perhaps the biggest imperfection of Perl 5 is its internals. Though much of the design is clever, there are also places of obsolescence and interdependence, as well as optimizations that no one remembers, but no one can delete without affecting too many other parts of the system. Refactoring an eleven-plus-year-old software project that runs on seventy-odd platforms and has to retain backwards compatibility with itself on many levels is daunting, and there are few people qualified to do it. It's also exceedingly difficult to recruit new people for such a task."

Comments (none posted)

PHP

PHP 4.4.2 and 5.1.2 Released

Version 4.4.2 of PHP has been announced. "This release address a few small security issues, and also corrects some regressions that occurred in PHP 4.4.1. All PHP 4 users are encouraged to upgrade to this release."

Also, development version 5.1.2 of PHP is out. "This release combines small feature enhancements with a fair number of bug fixes and addresses three security issues."

Comments (none posted)

Python

pyPdf 1.1 released

Version 1.1 of pyPdf, a Python-based PDF toolkit, is out. Changes include a new page rotation capability, Improved PDF reading support and PDF 1.5 support.

Comments (none posted)

Dr. Dobb's Python-URL!

The January 18, 2006 edition of Dr. Dobb's Python-URL! is online with new Python articles and resources.

Full Story (comments: none)

Ruby

Ruby Weekly News

The January 15th, 2006 edition of the Ruby Weekly News looks at the latest discussions from the ruby-talk mailing list.

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The January 17, 2006 edition of Dr. Dobb's Tcl-URL! is online with the latest Tcl/Tk articles and resources.

Full Story (comments: none)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

There Is No Open Source Community (O'ReillyNet)

OnLamp has published a lengthy tome on open source as a purely economic phenomenon. "An updated open source mentality has profound implications for businesses looking to leverage open source in commercial ventures. Reevaluating the open source equation in economic terms presents a different takeaway. The commoditization of software and a gradual, long-term reduction in price have played far more important roles than previously recognized. Business strategy designed to leverage open source should focus more on economies of scale (in terms of user and developer bases) and less on pleasing a mythical, monolithic community."

Comments (45 posted)

The Open Source as Prior Art Discussion Begins (Groklaw)

Groklaw takes a look at the Open Source as Prior Art Project. "It's easier to want to have something crash if you are not one of the likely first victims. The US patent system is broken. Everyone knows it. It's a runaway train. And in my opinion, it's heading toward FOSS, not because it should, but because some have SCO-like desires to work the system to target it, to slow down Linux and FOSS adoption. There haven't been enough trained USPTO examiners. And it's hard for them to find prior art, for reasons I'll explain."

Comments (none posted)

Reactions to the GPLv3 Draft and a GPLv2-V3 Comparative Chart (Groklaw)

Groklaw takes a look at some reactions to the draft GPLv3, and presents a chart comparing v2 to v3. "But if decent businesses want to use the code -- and that is voluntary -- perhaps they need to consider being more "freedom friendly" and realize that the GPL community is quite serious about protecting users' and developers' freedoms, by protecting the code's freedom. While many businesses are buying into the DRM, cuff-the-customer balkanization strategy, the GPL stands for users and against the business mentality of profit at *any* cost to anyone and anything."

Comments (6 posted)

Trade Shows and Conferences

Intel and More Inside (O'ReillyNet)

O'Reilly has published coverage of Steve Jobs' Macworld keynote. "When Apple CEO Steve Jobs delivers his Macworld keynote address, it is some of the best theatre you will ever see. This year, in a little over an hour and a half, he reported on Apple sales statistics, introduced the many changes in iLife '06, rushed past the lack of much in the way of improvements to the iWork suite, and introduced the new Intel-based iMac. Almost as an afterthought. he let the audience know that there was one more thing. Nearly 90 minutes into his talk he just casually mentions the PowerBook is being replaced by the Intel-powered MacBook Pro. Pure theatre."

Comments (25 posted)

Fresh eyes to greet linux.conf.au (LinuxWorld)

LinuxWorld.com.au looks forward to linux.conf.au, coming up soon in New Zealand. "Like last year's conference in Canberra, the show will again play host to Free and Open Source Software bigwigs including Andrew Tridgell of Samba fame, Linux International's Jon "maddog" Hall, Ubuntu founder Mark Shuttleworth, PHP founder Rasmus Lerdorf, and HP's CTO for Open Source and Linux, Bdale Garbee."

Comments (none posted)

Osnabrueck IV Meeting Brings 'Akonadi' PIM Data Storage Service (KDE.News)

KDE.News has this report from the Osnabrueck IV Meeting. " For the fourth consecutive year a group of KDE PIM developers followed the gracious invitation of Intevation GmbH to meet at their headquarters in Osnabrück, Germany on the first weekend in January. As in the past years, the face-time proved very productive especially since everyone felt that with KDE 4 the time for more fundamental changes has come. By the end of the meeting the group had agreed on a vision and initial architecture for a unified, extensible storage service for PIM data and metadata, allowing all applications on the desktop fast and reliable access as well as powerful search capabilities. This service, codenamed "Akonadi", together with intiatives like Plasma and Solid will form the basis of an exciting KDE 4 experience."

Comments (none posted)

Companies

HP Appoints New VP for Open Source, Linux (eWeek)

eWeek covers the appointment of Christine Martino as HP's new VP for Open Source and Linux. "Asked what her immediate goals were for HP's open-source and Linux division, Martino said she is not coming in with a plan to make big strategy shifts, "as we already have the right strategy, which is borne out by the fact that we have top market share and the success we have had with customers," she said. "We offer them choice on the hardware side, a multiple operating system strategy and a level playing field across all of those, which works well.""

Comments (17 posted)

Companies push Linux partitioning effort (News.com)

News.com looks into efforts by SWsoft to get OpenVZ into the Linux kernel. "In this, it has a major ally: Red Hat, the top seller of the open-source operating system, which plans to add the software to its free Fedora version of Linux for enthusiasts. The companies' move to make OpenVZ partitioning standard in Linux is timely, said Pund-IT analyst Charles King." (Thanks to Andrew Kornak)

Comments (none posted)

Business

TurboCASH debates moving to Linux (NewsForge)

Here's a NewsForge report on the possibility that TurboCASH - a GPL-licensed but Windows-only small business accounting program - might move to Linux. "The debates surrounding these decisions sum up the major problem that the new TurboCASH faces: its 20- year legacy is both its greatest asset and its main liability. For example, it's unlikely that a brand new project would have a debate over FreePascal/Lazarus or Python."

Comments (18 posted)

Linux Adoption

25 Reasons to Convert to Linux (Bellevuelinux)

Bellevuelinux.org presents twenty-five reasons to switch to Linux. "(10) Linux is highly resistant to system crashes and rarely needs rebooting (i.e., restarting). This can be very important for large organizations for which even a few minutes of down time can result in a substantial cost. The reason is that Linux has been designed from the ground up to be an extremely stable and robust operating system, incorporating all that has been learned about attaining these goals from the more than 35 years of history of Unix-like operating systems."

Comments (none posted)

Legal

Some Safety and Reliability Questions About DRM, by Victor Yodaiken (Groklaw)

Victor Yodaiken discusses DRM issues in a Groklaw article. "We are entering the era of ubiquitous and safety critical computing, but the developers of DRM technologies seem to believe that computers are nothing more than personal entertainment systems for consumers. This belief is convenient, because creating DRM mechanisms that respect security, safety, and reliability concerns is going to be an expensive and complex engineering task."

Comments (none posted)

Microsoft, Yahoo, others sued by Softvault over DRM (Inquirer)

Here's an Inquirer article on a company called SoftVault, which is suing a long list of companies for infringement of its DRM patents. If we weren't so opposed to software patents, we might be tempted to see this as a sort of poetic justice.

A look at SoftVault's web site is also instructive: "Access to software programs or digital content, or to a device, is enabled by periodic authorization messages, akin to a 'heartbeat,' exchanged between the server and client agents. As long as these periodic authorization messages continue to be exchanged, access is enabled. If for any reason the authorization messages are terminated, access is disabled. In the case of software or digital content, disabling may involve encrypting or deleting files. In the case of a device, the disabling logic would essentially turn the device into a 'brick' that is unusable and therefore has no practical resale value."

Comments (5 posted)

Math You Can't Use, Ch. 6 ~ by Ben Klemens (Groklaw)

Groklaw has an excerpt from Math You Can't Use, a book on copyrights, patents and software. "The world of software engineering is in no way restricted to software companies. Beyond Microsoft or thousands of smaller software vendors, almost every corporation in the world keeps a stable of programmers in the basement to write little scripts that move the company's e-mail and make the "add to cart" button do what it should. I am a programmer because I write simulations and statistical analyses. Even you are a software programmer if you use the Record Macro feature of your spreadsheet or word processor."

Comments (none posted)

Interviews

Previewing KDE 4 (O'ReillyNet)

John Littler talks with Aaron J. Seigo about KDE 4. "Recently at a Linux show, John Littler saw a preview of a new version of KDE running on a KDE developer's laptop. The interface looked cleaner than before, and apparently there was a whole raft of new stuff under the hood. John recently interviewed KDE developer Aaron J. Seigo about the forthcoming KDE 4 (due in the fall) and also a little about the recent controversy surrounding the porting of KDE to operating systems other than Linux."

Comments (none posted)

Görkem Çetin (People Behind KDE)

The People Behind KDE talk with Görkem Çetin, leader of KDE Turkey. "How and when did you get involved in KDE? I got my first KDE installation when it reached version 0.3. After doing some translation for KDE in 1998, I took over the Turkish translation team work and I have been the lead of this group for 7 years now. It was the time when Linux was referred as "multithreaded, multiplatform, ..." etc. Sounds funny now." (Found on KDE.News)

Comments (none posted)

Resources

CLI Magic: Learn to talk awk (Linux.com)

Linux.com slices and dices text with awk. "When it comes to slicing and dicing text, few tools are as powerful, or as underutilized, as awk. The name "awk" was coined from the initials of its authors, Aho, Weinberger, and Kernighan -- yes, the same Kernighan of the famous Kernighan and Ritchie "C Programming Language" book. In the Linux world, every distribution includes the GNU version, gawk (/bin/awk is usually a symbolic link to /bin/gawk). The GNU version has a few more features than the original. Let's play with some of the core features common among POSIX-compliant awks."

Comments (none posted)

Building a Linux home media center (Linux.com)

Tom Lynema assembles a Ubuntu-based Linux home media center. "Like a lot of people nowadays, I have a growing collection of digital media. My digital media is stored on a home Linux server. Most of the digital media players available today do not support protocols to connect to a Linux server, which make them unsuitable for my use. I realized the best way to connect my digital media library with my home theatre was to build my own Linux home media center (LHMC)."

Comments (12 posted)

SAMBA Server For Small Workgroups With Ubuntu 5.10 (Howto Forge)

Howto Forge presents a tutorial on setting up Samba under Ubuntu 5.10. "This is a detailed description about the steps to set up a Ubuntu based server (Ubuntu 5.10 - Breezy Badger) to act as file- and print server for Windows (tm) workstations in small workgroups. This howto uses the tdb backend for SAMBA to store passwords and account information. This is suitable for workgroups for up to 250 users and is easier to setup than an LDAP backend."

Comments (none posted)

Xen Virtualization and Linux Clustering, Part 1 (Linux Journal)

Ryan Mauer introduces Xen in a Linux Journal article. "In this article, I briefly introduce the concepts of Xen virtualization and Linux clustering. From there, I show you how to set up multiple operating systems on a single computer using Xen and how to configure them for use with clustering."

Comments (none posted)

Reviews

Google Talk API and source code release (NewsForge)

Nathan Willis examines the recently released Google Talk software. "Last month, the Jabber Software Foundation (JSF) released documentation for two extensions to the Jabber (XMPP) protocol, named Jingle Signaling and Jingle Audio. On the same day, Google -- co-creators of the extensions -- released a BSD-style-licensed library called libjingle, the implementation of the extensions that powers the company's Google Talk software. In addition to opening the API used in Google Talk itself, both actions will benefit open source instant messaging clients and perhaps increase the pressure on closed systems like Skype."

Comments (1 posted)

Exploring natural media graphics with Krita (Linux.com)

Linux.com has a review of Krita. "[Boudewijn] Rempt's guidance has taken the project away from the 'GIMP for KDE' philosophy towards what he describes as a painting model -- namely, simulating the tools, materials, and work flow of a real-world artist, who creates a picture out of physical 'stuff' -- not pixels or shapes -- and puts 'gunk on his paper or canvas and generally pushes that around.' For starters, this means drawing tools (pens, brushes, and paint) take center stage over the image adjustment tools (histograms, contrast controls, and masks) found in the GIMP. It also requires built-in pressure sensitivity and new ways to model color. The real difference, though, is conceptual. Eventually, Rempt wants Krita to simulate the experience of working with physical media, right down to mixing colors on the artist's palette."

Comments (none posted)

Xen Virtualization and Linux Clustering, Part 2 (Linux Journal)

Ryan Mauer continues a look at Xen and clustering. "We ended last time after configuring our first unprivileged Xen domain. In this article, we complete our cluster and then test it using an open-source parallel ray tracer. The first thing we need to do is create additional slave nodes to be used with the cluster. So, let's get down to business."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

The Apache Software Foundation Accomplishments of 2005

The Apache Software Foundation has sent out a a press release that highlights its accomplishments in 2005. "In addition to the Apache HTTP Server, recognized ASF projects include Ant, Axis Web Services, Derby, Forrest, Geronimo, James, Lenya, Lucene, Maven, mod_perl, MyFaces, Tomcat, SpamAssassin, Struts, Tapestry, and Xerces - from the core basics to in-demand solutions such as scalable Internet architectures, Cocoon, DB, Jakarta, and XML. All software developed within the ASF is free to download, use, modify, and distribute under the Open Source Apache License."

Comments (none posted)

Patents back on EU agenda

Florian Mueller, founder of the NoSoftwarePatents.com Web site, tells us that software patents are once again on the EU agenda. "[Mueller] believes that it is "imperative for our movement to influence the new debate on the community patent on a timely basis, or else we would find it hard, if not impossible, to stop the avalanche". In his opinion, it is "a steep challenge" to ensure that a community patent law would simultaneously address the issue of the EPO's patent granting practice, "because many politicians believe that the community patent is an important measure from a competitiveness point of view, and won't like the all-or-nothing notion of having to solve two huge problems at one fell swoop". But, he adds, "defining what is patentable would be needed to really make Europe more competitive"."

Full Story (comments: 4)

Commercial announcements

Aheeva collaborates with Asterisk and SugarCRM

Aheeva has announced a new version of their Asterisk-based IP Contact Center Software. "Aheeva CCS Version 2.0 is smarter IP contact center software, featuring improved quality monitoring tools, enhanced statistical analysis and tools to increase agent efficiency. Now supporting SugarCRM, a customer relationship management solution, Version 2.0 remains a cost-effective solution based on open source technology."

Full Story (comments: none)

EnterpriseDB Announces Partner Program

EnterpriseDB has announced a new partner program. "EnterpriseDB, the world’s leading enterprise-class, open source database company, today launched a formal partner program that enables companies to incorporate the award-winning EnterpriseDB database into their business models. Via the new partner program, Technology Partners, including SugarCRM, JasperSoft, Continuent, and TenFold, will collaborate with EnterpriseDB to certify products with the EnterpriseDB database, Service Partners, including dbConcert, Fusion Technologies, Optaros and Buda Consulting will grow market opportunities by providing professional services supporting EnterpriseDB, and Business Partners, including Contegix, will offer EnterpriseDB as an integral component of solutions for end-user customers."

Comments (none posted)

HP to sell Mandriva systems in Latin America

Mandriva has announced a deal with HP wherein HP will offer systems preloaded with Mandriva Linux throughout Latin America. "The first pre-loaded machines - one targeted to the consumer market and one for the enterprise - are shipping in Brazil. HP and Mandriva have been collaborating for several months to certify various system configurations and optimize performance, as well as expand language support. Technical support will be offered in both Spanish and Portuguese for all of Latin America."

Full Story (comments: none)

Lattix LDM for Eclipse Now Available

Lattix, Inc. has announced the release of Lattix LDM for Eclipse. "With this new Eclipse plugin, Lattix further extends the developers' capabilities to visualize and maintain the architecture during application development by delivering the power of Lightweight Dependency Models (LDM) to formalize, communicate and control the architecture of Eclipse projects."

Full Story (comments: none)

Linux Professional Institute Offers Certification Exams at IBM Software University

The Linux Professional Institute will be offering discounted exams at the IBM Software University event in Las Vegas, NV on January 19, 2006.

Full Story (comments: none)

MySQL Awarded GSA Contract Schedule 70

MySQL AB has announced the award of a five-year US government GSA contract. "More than 8 million active installations around the world employ MySQL, including thousands of federal, state, and local government organizations such as Los Alamos National Labs, U.S. Census Bureau, U.S. Geological Survey, NASA and the Department of Defense. MySQL database products are recognized for low cost-of-ownership (TCO), as well as superior ease of use, performance and reliability. MySQL's inclusion on the GSA schedule is enabled by an agreement with Carahsoft Technology, a leading government IT solutions provider based in Reston, Virginia that represents a select group of top tier software and hardware manufacturers."

Comments (none posted)

Novell Reaffirms Commitment to ODF

Novell sent out a reaffirmation of its support for the OpenDocument format. "Novell today reaffirmed its roadmap for support of the OpenDocument file format in current and future Novell(r) products, which reinforces Novell's commitment to open standards, customer choice and flexibility. Novell has delivered OpenDocument support in its SUSE(r) Linux distribution since March 2005. Novell will deliver complete OpenDocument support in the next edition of its enterprise desktop in 2006."

Full Story (comments: none)

Open-Xchange Hires Executive VP of Marketing Strategy

Open-Xchange has announced the hiring of Daniel M. Kusnetzky as the executive vice president of Marketing Strategy. "Kusnetzky, most recently vice president of IDC's System Software research, was responsible for research and analysis on the worldwide market for operating environments and virtualization software. Prior to his 11 years at IDC, he spent 15 years with Digital Equipment Corporation, where he was responsible for program and product management, and marketing in the areas of client software, server software, and clustered and networked systems. Kusnetzky appears regularly as a keynote speaker at industry trade shows and is a noted expert on the open source industry."

Full Story (comments: none)

Penguin Computing Recruits HP Exec

Penguin Computing has announced the hiring of Pauline Nist as Senior Vice President of Product Development and Management. "Pauline, formerly Vice President of HP's Enterprise, Storage and Servers business unit, brings over 20 years of in-depth experience in the high performance computing (HPC) and enterprise markets to this new position."

Comments (none posted)

LI president Jon Hall to form UnifiedRoot Advisory Board

Linux International president Jon Hall will form a UnifiedRoot Advisory Board. "UnifiedRoot, the company that has created a new and simplified Internet addressing system for corporate and public top-level domains (TLDs), has appointed Jon Hall, president of Linux International, as a founding member of its advisory board. He will assist UnifiedRoot in the expansion of the advisory board with the specific task of addressing technical and policy issues."

Full Story (comments: none)

New Books

Embedded Linux System Design and Development published

The book Embedded Linux System Design and Development by Amol Lad is available from Auerbach Publications.

Full Story (comments: none)

Pragmatic Bookshelf releases "Learn to Program"

Pragmatic Bookshelf has published the book Learn to Program by Chris Pine.

Full Story (comments: none)

Running Linux, Fifth Edition - O'Reilly's Latest Release

O'Reilly has published the book Running Linux, Fifth Edition by Matthias Kalle Dalheimer and Matt Welsh.

Full Story (comments: none)

Understanding Linux Network Internals - O'Reilly's Latest Release

O'Reilly has published the book Understanding Linux Network Internals by Christian Benvenuti.

Full Story (comments: none)

Resources

Three new Audio Libre articles

LinuxUser & Developer magazine has announced three new PDF articles in the Audio Libre series. Titles include FAVE raves - a new event for free software creativity, The 64-bit question - 64 Studio distribution and Snake dance - the Kamaelia streaming media system.

Full Story (comments: none)

Grid Computing Newsletter Looks at Key Open Source Development Efforts

A new issue of the Globus Consortium Journal has been announced. "The Globus Consortium (founded by IBM, HP, Sun, Intel, Nortel, Univa and Cisco) today published the latest issue of the “Globus Consortium Journal. (http://www.globusconsortium.org/journal).” The newsletter focuses on open source Grid computing projects - and this month features developer interviews with the leaders of the three most important services in the Globus Toolkit (www.globustoolkit.org)."

Full Story (comments: none)

Contests and Awards

Performance Technologies wins Product of the Year award

Performance Technologies has announced the naming of their NexusWare(TM) Linux-Based Software Suite as Product of the Year by Internet Telephony Magazine. "The NexusWare Software Suite is a development, management and operating system environment which enables users of Performance Technologies' hardware and platform products to rapidly develop and deploy value-added capabilities with their solutions. NexusWare was chosen as an INTERNET TELEPHONY Product of the Year due to its strong embodiment of Linux and its ability to facilitate the use of open-source software packages."

Comments (none posted)

Upcoming Events

Austin Group to meet in Ottawa, Feb 2006

The tenth plenary of the Austin Group meeting will be held in Ottawa, Canada on February 21-24, 2006.

Full Story (comments: none)

EUSecWest papers and CanSecWest CFP

The selection of papers for EUSecWest (London, U.K. February 20-21, 2006) and a call for papers for CanSecWest (Vancouver, Canada April 3-7, 2006) have been announced. CanSecWest papers are due by March 15, 2006.

Full Story (comments: none)

FrOSCon 2006 - Call for Papers

A Call for Papers has gone out for FrOSCon 2006. The event will take place on June 24 and 25, 2006 near Bonn, Germany. The Deadline for submission is March 15, 2006.

Comments (none posted)

2006 GCC and GNU Toolchain Developers' Summit CFP

A call for papers has gone out for the 2006 GCC and GNU Toolchain Developers' Summit. The event will be held on June 28 - 30, 2006 in Ottawa, Canada. Submissions are due by February 15, 2006.

Full Story (comments: none)

HLUG Special Event February 1st with Peter Salus (Groklaw)

Groklaw has announced a panel discussion that is being put on by the Hamilton Linux User Group. "For those of you near Hamilton, Canada, or those who like to travel, here's some news of an event you might like to attend. Peter Salus, Bob Young, owner of the Hamilton Tiger-Cats, Lulu.com digital publishing, founder of The Center for the Public Domain, and co-founder of Red Hat Software, and EFF's Policy Coordinator, Americas, Ren Bucholz will be the guests at the Hamilton Linux User Group on February 1st. The topic of the panel discussion will be Linux v. SCO and the relevant freedom issues and legalities."

Comments (none posted)

LinuxFest Northwest 2006 call for presenters

A call for presenters has gone out for LinuxFest Northwest 2006. The event will take place on April 29, 2006 in Bellingham Wash. "This is an annual, International grass roots event put on by Lugs from the USA and Canada."

Full Story (comments: none)

LinuxTag 2006 Call for Projects

A Call for Projects has gone out for LinuxTag 2006. The event takes place in Wiesbaden, Germany on May 3-6, 2006. Projects are due by February 3.

Comments (none posted)

Call for help for LinuxTag2006

A LinuxTag 2006 call for help has been sent to the Linux Audio Users list. The event will be held in Wiesbaden, Germany on May 3-6, 2006. "A booth at LinuxTag is a good opportunity to present Linux Audio to the people, not only to developers but more to users. The crowd is mostly industry (producers, technicians, musicians) at the weekdays and home-recording-users at the weekend. Don't be afraid, there won't be much questions about setting up drivers for consumer-cards (and If there are, we usually send them to their distributions booth :-) ). But there will be a lot people thinking about using your app in studio! So you definitly don't want to miss this chance!"

Full Story (comments: none)

LPI Exam Labs in Houston, Texas, January 2006

The Linux Professional Institute will be holding a discounted exam lab at the daratechPLANT conference in Houston, Texas on January 23-25, 2006.

Full Story (comments: none)

OpenOffice.org 2006 Conference - Call for Location

A Call for Location has gone out for the 2006 OpenOffice.org Conference. "The first three OpenOffice.org conferences in Hamburg, Berlin and Koper/Capodistria were a huge success. The highlight so far was this year's conference which, for the first time, was organized by a team of volunteer community members. Now we are wondering if this outstanding event can actually be bettered. Therefore, we are searching for the perfect location for the OpenOffice.org Conference in 2006."

Full Story (comments: none)

SELinux Symposium Online Registration is Open

Online registration for the next SELinux Symposium has been opened. The event takes place on February 27 - March 3, 2006 in Baltimore, Md.

Full Story (comments: none)

TimeSys to Host Educational Webinars for Embedded Developers

TimeSys has announced a pair of educational webinars for embedded Linux developers. "Each webinar will be led by a Linux development expert using LinuxLink by TimeSys(TM), a continuously updated, Web-based resource for embedded Linux development. Webinar hosts will guide attendees through the process of creating a custom Linux platform for an embedded development project targeting a PowerPC or x86 processor..." The events will take place on January 24 and 31, 2006.

Full Story (comments: none)

Events: January 19 - March 16, 2006

Date Event Location
January 23 - 28, 2006linux.conf.au 2006Dunedin, New Zealand
January 23 - 25, 2006Black Hat Federal Briefings and Training 2006(Sheraton Crystal City)Washington, D.C.
January 24 - 26, 2006O'Reilly Emerging Telephony Conference(San Francisco Airport Marriott)San Francisco, CA
February 6 - 7, 2006ICMCC Conference on EHR Standards and Interoperability(World Forum Convention Center, The Hague)The Netherlands
February 7 - 9, 2006OSCMS SummitVancouver, BC, Canada
February 8 - 10, 2006X Developer's Conference(XDevConf)(Sun Campus)Santa Clara, CA
February 8 - 10, 2006LinuxAsia Conference and Expo 2006(India Habitat Centre)New Delhi, India
February 10 - 12, 2006CodeCon 2006San Francisco, CA
February 10, 2006SCALE Workshop On Open Standards For Government Organizations(Airport Radisson)Los Angeles, CA
February 11 - 12, 2006Southern California Linux Expo(SCALE 4x)(Airport Radisson)Los Angeles, California
February 20 - 21, 2006EuSecWest/core06 conferenceLondon, England
February 24 - 26, 2006PyCon 2006(Dallas/Addison Marriott Quorum hotel)Addison, TX
February 25 - 26, 2006FOSDEM 2006(ULB Campus)Brussels, Belgium
February 26 - 28, 2006OSDC::Israel::2006(Netanya Academic College)Netanya, Israel
February 27 - March 3, 2006SELinux Symposium and Developer Summit(Wyndham Hotel)Baltimore, MD
February 28 - March 3, 2006Black Hat Europe Briefings and Training 2006(Grand Hotel Krasnapolsky)Amsterdam, the Netherlands
March 3 - 4, 2006LinuxForum 2006Copenhagen, Denmark
March 6 - 9, 2006O'Reilly Emerging Technology Conference(ETech)(Manchester Grand Hyatt)San Diego, CA

Comments (none posted)

Audio and Video programs

Tux Power! - a compilation of music made with Linux

Tux Power! is a freely available music compilation from members of Linuxaudio.org. "Linuxaudio.org has released its first compilation CD of music by artists using libre software - Tux Power! Every single part of the CD was made on Linux, including all the music, the mastering (with Jamin) and the artwork (with Scribus)."

Full Story (comments: 6)

Page editor: Forrest Cook

Copyright © 2006, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds