The Free Software Foundation has, at last, made
a draft version of version 3 of the
General Public License available for comments. Your editor, having
read it five minutes ago, is now ready to comment. What follows is a quick
overview of the changes which have been made to the GPL; anybody wanting
more information should certainly read the accompanying
rationale document, which
describes the changes - and their motivations - in detail.
The GPL is an important license. It is the most popular of free software
licenses, and it covers many important components of a Linux system. It is
a codification of the FSF's view of how free software should work, and it
imposes some real obligations on those who redistribute GPL-licensed
software. It is a core piece of our legal source code. So a major
revision of the GPL requires a great deal of thought. In your editor's
opinion, the FSF has put in that thought, and has put forward a revised
license which meets current challenges while remaining true to the spirit
of previous versions.
Digital restrictions management
Many of the changes in GPLv3 have to do with DRM schemes. The license
makes the FSF's position on DRM quite clear, and does its best to ensure
that GPL-licensed code will stay as far away from DRM as possible.
To start, the license makes its intent with regard to DRM clear:
As a free software license, this License intrinsically disfavors
technical attempts to restrict users' freedom to copy, modify, and
share copyrighted works. Each of its provisions shall be
interpreted in light of this specific declaration of the licensor's
intent. Regardless of any other provision of this License, no
permission is given to distribute covered works that illegally
invade users' privacy, nor for modes of distribution that deny
users that run covered works the full exercise of the legal rights
granted by this License.
The purpose here is to help ensure that, in any future court case, all of
the terms of the GPL will be interpreted with an anti-DRM bias.
An interesting clause can be found in section 3:
No covered work constitutes part of an effective technological
protection measure: that is to say, distribution of a covered work
as part of a system to generate or access certain data constitutes
general permission at least for development, distribution and use,
under this License, of other software capable of accessing the same
data.
This provision is clearly targeted at anti-circumvention laws. If it
stands up, it says users can bypass any restrictions encoded in
GPL-licensed software without circumventing "technological protection
measures," since no GPL-licensed program can be part of such a measure.
Another key provision can be found in the revised definition of "source
code":
Complete Corresponding Source Code also includes any encryption or
authorization codes necessary to install and/or execute the source
code of the work, perhaps modified by you, in the recommended or
principal context of use, such that its functioning in all
circumstances is identical to that of the work, except as altered
by your modifications. It also includes any decryption codes
necessary to access or unseal the work's output.
In other words, "trusted computing" mechanisms designed to keep people from
replacing the software on their gadgets cannot be used with GPLv3-licensed
software. This is a large and important change - though its effect will be
somewhat limited for as long as the Linux kernel remains licensed under
version 2 of the GPL.
Software patents
As expected, the new version of the GPL addresses software patents in a
much more comprehensive manner. One fundamental change is that anybody who
redistributes software covered by the GPLv3 is explicitly granting all
patent licenses needed to use the software. This grant covers "all
versions of the covered work," and would seem to override the "field of
use" restrictions imposed by some patent owners.
Here's an interesting addition in v3:
This License gives unlimited permission to privately modify and run
the Program, provided you do not bring suit for patent infringement
against anyone for making, using or distributing their own works
based on the Program.
It is, of course, a patent retaliation clause. If you launch a patent suit
against somebody using a specific program, you cannot make any further use
of that program. It's a big departure from GPLv2; the previous version of
the license imposed no restrictions on individual use of the software at
all. With GPLv3, the right to use the software - not just to redistribute
it - can go away as a result of filing a patent suit.
There are no other patent retaliation clauses in the GPL itself; the FSF is
not entirely comfortable with this concept in general. From the rationale
document:
Several other free software licenses include significantly broader
patent retaliation provisions. In our view, too little is known
about the consequences of these forms of patent retaliation.
There is, however, a subsection which allows the incorporation of
additional, limited patent retaliation terms. Terms which take away use of
the software for filing a wider range software patent lawsuits can be
added:
They may impose software patent retaliation, which means permission
for use of your added parts terminates or may be terminated, wholly
or partially, under stated conditions, for users closely related to
any party that has filed a software patent lawsuit (i.e., a lawsuit
alleging that some software infringes a patent). The conditions
must limit retaliation to a subset of these two cases: 1. Lawsuits
that lack the justification of retaliating against other software
patent lawsuits that lack such justification. 2. Lawsuits that
target part of this work, or other code that was elsewhere released
together with the parts you added, the whole being under the terms
used here for those parts.
So the GPLv3 does not include full-scale patent retaliation, but there
should be enough there to get the attention of some types of patent
holders.
Additional terms
A few other types of additional restrictions are allowed in GPLv3. These
include limits on trademark use or the use of contributors' names for
publicity purposes. The idea here was to try to make the GPL compatible
with a wider range of free software licenses.
The much-discussed "web services loophole" is also addressed by way of an
optional restriction:
They may require that the work contain functioning facilities that
allow users to immediately obtain copies of its Complete
Corresponding Source Code.
Beyond that, version 3, like its predecessors, explicitly disallows the
imposition of additional restrictions.
Other changes
Under version 2, termination of the license was automatic if its terms were
violated. In theory, one who had gone against the GPL would have to go and
explicitly beg forgiveness before being able to distribute the relevant
software again. Back in 2000, Richard Stallman told
the KDE developers that they had to ask forgiveness in this way.
Version 3 changes the terms to put the onus on copyright holders to
terminate a license. Any copyright holder can do so if the terms are
violated, but a violator who mends his ways need not ask forgiveness from
any copyright holder who has not exercised that right.
Version 2 contains a clause saying that, if a program cannot be distributed
in a way which complies with both the GPL and any other restrictions
(patent licenses in particular), it cannot be distributed at all. There
has been some disagreement over just how strong that restriction is. GPLv3
makes it clear that a strong interpretation is expected; this section is
now titled "Liberty or Death for the Program."
The geographical restrictions clause, which allows terms disallowing the
distribution of code in certain countries due to legal problems there, has
been retained in GPLv3. The rationale document states, however, that the
FSF knows of no actual use of that clause, and they suggest it could be
removed during the comment period.
There are many other changes, mostly aimed at clarifying intent and
ensuring that the license is enforceable worldwide. Again, interested
parties are urged to read the license itself and the rationale document for
the full story. They will then be prepared to take part in the comment and
revision process, which is expected to last for about one year. If all
goes well, the FSF hopes to adopt GPLv3 in January, 2007.
Comments (110 posted)
January 18, 2006
This article was contributed by Mitch Skinner
The Mono project pushes a lot of buttons in the free software community.
Patents, Microsoft, language choice, and platform choice all generate lots
of heat individually, and Mono has them all. In spite of all the debate,
there are still some issues that remain unresolved. There are undoubtedly
some people who have been avoiding Mono just because Red Hat was; now that
Fedora has it (while RHEL is still apparently up in the air) it's tough to
know if Mono is safe to use or not.
I'm not a lawyer, but since everyone who has gotten advice from one (or
who is one) is being tight-lipped about it, the rest of us apparently have
to figure things out the best we can. I asked Red Hat Deputy General
Counsel Mark Webbink about the decision to include Mono, and he replied:
I think you can understand that I cannot discuss Red Hat's internal IP
policy. I would point out that the decision to include Mono with Fedora
was made by the Fedora Foundation and its project folks. I feel confident
the determination was made with an understanding of various patent concerns
that have previously been posed to Novell but also with an understanding
that there are protections available to open source developers, vendors,
etc.
"...protections available to open source developers, vendors,
etc."--sounds like the patent pools that are intended to create a
mutually-assured-destruction sort of scenario for anyone wanting to sue
open source projects for patent infringement. These pools have
been derided as PR gimmicks, but Webbink's note makes it sound like
some people are willing to actually put some trust in them.
This message
also makes it sound like the Fedora decision-making mechanisms are finally
starting to become separate from Red Hat's. I sent a message to Greg
DeKoenigsberg of the Fedora Foundation, and I got the one-sentence official
line in return:
"Business considerations that prevented certain Mono components from
being
included in Fedora previously have now been resolved."
Greg also suggested that more information may be forthcoming soon.
One of the really
interesting aspects of the timing is the fact that the main
patent application that has been discussed in the media (the API patent
application) appears close to being automatically abandoned.
The API patent, if it were granted, would be a big blow to the
Mono project. Many patents on various aspects of the implementation could
have been worked around, but the API implementation not only makes up a
significant portion of the Mono codebase (making it a big project to
re-do), but is also what all software written for Mono/.NET uses. If
the API becomes unusable, you can't hide a work-around in the Mono
internals, because the API forms the connection between Mono and the rest
of the world.
In October of last year, the patent office issued a "Non-Final
Rejection" to the patent application, meaning that
Microsoft can try to fix the application. Indeed, if you read the
non-final rejection, there are several suggestions the patent examiner makes
about how to fix problematic issues. However, there is also a big section
of the rejection notice that talks about prior art in the form of two
already-issued patents. Those could be harder to work around.
The rejection notice says that the deadline for reply is three months
from the date of mailing, which was October 21st, 2005. It has now been
almost three months, and Microsoft has not yet replied. According to the
rejection notice, if there's no reply before the deadline, the application
is automatically abandoned.
What does that mean? Well, ask a lawyer, I guess, but it sounds pretty
good for Mono. More importantly, maybe, is what it means for GNOME. In
the spring of 2004, there was a big discussion on whether to
begin using Mono in the GNOME core desktop. For example, see Havoc Pennington's essay on
the topic. Clearly, it would be good to start writing core
functionality in something nicer than C; however, the GNOME developers are
understandably reluctant to open things up too widely and end up with a
large number of different languages in the core desktop. The debate didn't
reach a conclusion, with Novell going one way, Red Hat going another, and
the community left hanging, with little information with which to make a
decision.
Since then, several useful GNOME-targeted applications have been written
using Mono. With the confusion regarding whether or not Mono would end up
in all the major distributions, though, those applications have undoubtedly
not gotten as much support and contributors as they could have. There are
also non-Mono alternatives to some of them. While competition between
projects is certainly healthy and a good thing in general, one of the
strengths of free software is the ability to share and cross-pollinate. If
different projects use different languages, libraries, and platforms,
though, that sharing becomes much more difficult. Hopefully, some clarity
on Mono's risks is forthcoming, and then maybe the split can be
resolved.
[The author wishes to disclose that he holds stock in Red Hat, Inc.]
Comments (30 posted)
Last July, when the European Parliament killed the software patent
directive, few people thought that it would remain dead forever. The sorts
of
people who push for that sort of expansion of legal monopoly rights tend to
be tenacious; they do not give up easily. Still, the recent headlines
proclaiming the return of the software patent debate were a bit of a
surprise; one would have thought that the pro-patent camp would lie low for
a little bit longer.
In fact, what is on the agenda now is not really a return of the software
patent directive. It is, instead, the longstanding idea of a "community
patent," which would apply across the entire EU. The idea is not entirely
nonsensical; patenting an idea across the EU is currently a lengthy and
expensive affair. People and companies interested in obtaining patents
would really rather go through the process just once; the community patent
would make that possible. The text
of the proposal [PDF] is available for those who are interested.
An attentive reader will note that there
is no mention of software patents in the proposal.
Where the trouble comes in is with this clause here:
The European Patent Office will play a central role in the
administration of Community Patents and will alone be responsible
for examination of applications and the grant of Community Patents.
So, if somebody were to convince the EPO to start granting patents on
algorithms, community software patents would be a reality. The unfortunate
news here is that the EPO has been happily granting software patents for
some time. FFII has put together a list of some
of the worst EPO software patents; included therein are patents on
JPEG, MP3, tabbed dialog boxes, form processing in web servers, some remote
procedure call protocols, electronic shopping carts, and more. Such
patents have no Europe-wide significance now, but, if they were issued as
community patents, the situation would then be different. At that point,
the only hope would be a court battle with the objective of getting
software patents declared invalid. Not a fun process. Besides, it was in
the courts that software patents became enforceable in the U.S.
Before this situation could come about, however, the community patent
proposal would have to be adopted. That has not happened, so far, despite
years of trying. Still, if there is to be a renewed push to establish a
community patent, it would be much better for that patent to come with
clear rules about the patentability of software. The current consultation
period goes through the end of March; there will be a European Commission
hearing on the community patent on June 13, 2006. So there is not a
lot of time to push for changes.
Comments (1 posted)
Page editor: Jonathan Corbet
Security
The
ping
attribute is an HTML extension proposed by the
Web Hypertext Application Technology Working
Group. This attribute may be applied to anchor ("
<A>")
tags; its value is a list of URIs. If the user clicks upon the link
created by the
<A> tag, the browser will, in addition to
displaying the destination page, also send a request for each of the given
URIs. Essentially, the browser is phoning home - possibly to multiple
homes - to report on the user's action.
As it turns out, future Firefox releases will
implement the ping attribute; by some accounts, this feature will turn
Firefox into spyware. Calling it "spyware" is probably overstating the
case a little, but this feature is still worth some thought.
Many sites perform tracking of outbound clicks now. The normal technique
is to reformat an external link to point at an internal script; that script
logs the click, then returns an HTTP "redirect" response which sends the
browser to the true destination. The redirect technique is arguably worse
than the ping attribute for a couple of reasons. The first is the fact
that redirect-style URLs obscure the true destination. Redirected URLs can
be moderately obfuscated, such as this one taken from a
News.com story:
http://dw.com.com/redir?destUrl=http%3A%2F%2Fwww.nationalskillsregistry.in&siteId=3&\
oId=2100-1029-6028107&ontId=1009&lop=nl.ex
They can also be completely obscure:
http://linuxfr.org/redirect/45255.html
(The above URL takes the reader to the Fedora directory
server page).
Redirected URLs can, in the presence of JavaScript, be imposed entirely by
stealth.
The other problem with using redirect in this way is that it requires a
conversation with the logging server before the browser wanders on to the
place the user actually wanted to be. If the logging server is
sufficiently slow or off the net entirely, the destination becomes
unreachable.
The ping attribute addresses both of these problems. Destination URLs are
not hidden, and the actual phoning home can happen after the destination
page has been displayed. The option of ignoring ping attributes can also
be presented to the user; there is no such option for links using redirect
(though there are some firefox extensions which try hard for specific
sites). So, in theory, ping is an improvement over what came before.
Still, it is hard to avoid a sense of discomfort with this feature.
Firefox is free software, and free software is written with its users'
interests in mind. Free software users have grown accustomed to the idea
that, for example, applications will not be quietly phoning home in the
background. Certainly, Firefox users have no motivation to leave ping enabled -
it potentially compromises their privacy while offering them little in
return. People will disable ping, and distributors will have a strong
motivation to disable it by default in their packages. The Firefox
hackers, by adding this feature, risk appearing to serve a community
other than their users, and that appearance could reflect back on the
reputation of this fine browser in general.
Comments (30 posted)
Brief items
Ed Felten is
looking at
the copy protection technologies mandated by the proposed "analog hole"
law in the U.S. "
The second technology, VEIL, is a watermark that is
inserted into the video itself. VEIL was originally developed as a way for
TV shows to send signals to toys. If you pointed the toy at the TV screen,
it would detect any VEIL information encoded into the TV program, and react
accordingly. Then somebody got the idea of using VEIL as a 'rights
signaling' technology. The idea is that whenever CGMS-A is signaling
restrictions on copying, a VEIL watermark is put into the video."
Comments (none posted)
New vulnerabilities
albatross: design error
| Package(s): | albatross |
CVE #(s): | CVE-2006-0044
|
| Created: | January 16, 2006 |
Updated: | January 20, 2006 |
| Description: |
A design error has been discovered in the Albatross web application
toolkit that causes user supplied data to be used as part of template
execution and hence enables arbitrary code execution. |
| Alerts: |
|
Comments (none posted)
antiword: insecure temporary file
| Package(s): | antiword |
CVE #(s): | CVE-2005-3126
|
| Created: | January 17, 2006 |
Updated: | January 18, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit project
discovered that two scripts in antiword, utilities to convert Word
files to text and Postscript, create a temporary file in an insecure
fashion. |
| Alerts: |
|
Comments (none posted)
ClamAV: arbitrary code execution
| Package(s): | clamav |
CVE #(s): | CVE-2006-0162
|
| Created: | January 13, 2006 |
Updated: | January 25, 2006 |
| Description: |
A vulnerability in ClamAV v0.80 through
0.87.1, allows remote attackers to execute arbitrary code on vulnerable
ClamAV installations. Authentication is not required to exploit this
vulnerability. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-3356
CVE-2005-4605
CVE-2005-4618
CVE-2005-4639
CVE-2006-0095
CVE-2006-0096
|
| Created: | January 18, 2006 |
Updated: | March 7, 2006 |
| Description: |
The latest set of kernel vulnerabilities includes:
- A reference counting bug in sys_mq_open(), exploitable by a local user to crash the kernel. (CVE-2005-3356)
- A misuse of signed data types in /proc, potentially providing read access to random kernel memory. (CVE-2005-4605)
- An off-by-one error in sysctl(), with the potential for arbitrary code execution. (CVE-2005-4618)
- A buffer overflow in the TwinHan DST
Frontend/Card DVB driver; potential code execution. (CVE-2005-4639)
- A potential key disclosure in dm-crypt. (CVE-2006-0095)
- Missing capability check could (maybe) allow arbitrary users to load new firmware into SDLA WAN cards. (CVE-2006-0096)
|
| Alerts: |
|
Comments (none posted)
Kolab Server: broken email-signatures or attachments
| Package(s): | kolab |
CVE #(s): | |
| Created: | January 13, 2006 |
Updated: | January 18, 2006 |
| Description: |
A problem
exists if the Kolab Server transports an email bigger than 8KB and
there is a dot (".") character at the wrong place, kolabfilter will double
this dot and a modified email will be delivered. This can lead to broken
email clear-text signatures or broken attachments. |
| Alerts: |
|
Comments (none posted)
mantis: multiple vulnerabilities
Comments (none posted)
novell-nrm: heap memory corruption
| Package(s): | novell-nrm |
CVE #(s): | CVE-2005-3655
|
| Created: | January 13, 2006 |
Updated: | January 18, 2006 |
| Description: |
A security problem with the Novell Remote Manager may be triggered by
passing a huge or negative size via a HTTP request header to httpstkd. It
is possible to corrupt heap memory and so potentially execute code. See
this iDefense advisory for more details. |
| Alerts: |
|
Comments (none posted)
struts: cross-site scripting vulnerability
| Package(s): | struts |
CVE #(s): | CVE-2005-3745
|
| Created: | January 12, 2006 |
Updated: | March 8, 2006 |
| Description: |
The Struts error display system has a cross-site scripting vulnerability.
An attacker may be able to maliciously craft a URL that can trick
a user into thinking they are looking at a trusted site when they are not. |
| Alerts: |
|
Comments (none posted)
sun-jdk: applet privilege escalation
| Package(s): | sun-jdk sun-jre blackdown-jdk |
CVE #(s): | CVE-2005-3905
CVE-2005-3906
|
| Created: | January 16, 2006 |
Updated: | January 18, 2006 |
| Description: |
Adam Gowdiak discovered multiple vulnerabilities in the Java Runtime
Environment's Reflection APIs that may allow untrusted applets to
elevate privileges. A remote attacker could embed a malicious Java applet
in a web page and entice a victim to view it. This applet can then bypass
security restrictions and execute any command or access any file with the
rights of the user running the web browser. |
| Alerts: |
|
Comments (none posted)
tuxpaint: insecure temporary file
| Package(s): | tuxpaint |
CVE #(s): | CVE-2005-3340
|
| Created: | January 16, 2006 |
Updated: | January 18, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit project
discovered that a script in tuxpaint, a paint program for young
children, creates a temporary files in an insecure fashion. |
| Alerts: |
|
Comments (none posted)
wine: Windows WMF vulnerability
| Package(s): | wine |
CVE #(s): | CVE-2006-0106
|
| Created: | January 13, 2006 |
Updated: | January 25, 2006 |
| Description: |
H D Moore discovered that Wine implements the insecure-by-design
SETABORTPROC GDI Escape function for Windows Metafile (WMF) files. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2005-3352
|
| Created: | December 14, 2005 |
Updated: | May 10, 2006 |
| Description: |
Versions 1 and 2 of the apache web server suffer from a cross-site scripting vulnerability in the mod_imap module; see this bugzilla entry for details. |
| Alerts: |
|
Comments (none posted)
auth_ldap: format string vulnerability
| Package(s): | auth_ldap |
CVE #(s): | CVE-2006-0150
|
| Created: | January 10, 2006 |
Updated: | February 28, 2006 |
| Description: |
The auth_ldap package is an httpd module that allows user authentication
against information stored in an LDAP database. A format string flaw was
found in the way auth_ldap logs information. It may be possible for a
remote attacker to execute arbitrary code as the 'apache' user if auth_ldap
is used for user authentication. |
| Alerts: |
|
Comments (none posted)
blender: integer overflow
| Package(s): | blender |
CVE #(s): | CVE-2005-4470
|
| Created: | January 6, 2006 |
Updated: | June 15, 2006 |
| Description: |
Damian Put discovered that Blender did not properly validate a 'length'
value in .blend files. Negative values led to an insufficiently sized
memory allocation. By tricking a user into opening a specially crafted
.blend file, this could be exploited to execute arbitrary code with the
privileges of the Blender user. |
| Alerts: |
|
Comments (none posted)
bogofilter: buffer overflow
| Package(s): | bogofilter |
CVE #(s): | CVE-2005-4591
|
| Created: | January 11, 2006 |
Updated: | January 11, 2006 |
| Description: |
A buffer overflow was found in the UTF-8 handling code in bogofilter; it can be exploited via a malicious email message. |
| Alerts: |
|
Comments (none posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
ktools: buffer overflow
| Package(s): | centericq |
CVE #(s): | CVE-2005-3863
|
| Created: | December 7, 2005 |
Updated: | August 29, 2006 |
| Description: |
From the Debian-Testing alert: Mehdi Oudad "deepfear" and Kevin Fernandez "Siegfried" from the Zone-H
Research Team discovered a buffer overflow in kkstrtext.h of the ktools
library, which is included in (at least) centericq and motor. |
| Alerts: |
|
Comments (none posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
curl: buffer overflow
| Package(s): | curl |
CVE #(s): | CVE-2005-4077
|
| Created: | December 8, 2005 |
Updated: | March 27, 2006 |
| Description: |
The curl file transfer utility has a buffer overflow vulnerability
in the URL authentication code. If an overly long URL is used,
a buffer overflow can result, allowing for local unauthorized access. |
| Alerts: |
|
Comments (none posted)
cyrus-imapd: buffer overflows
| Package(s): | cyrus-imapd |
CVE #(s): | CAN-2005-0546
|
| Created: | February 23, 2005 |
Updated: | April 10, 2006 |
| Description: |
Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system. |
| Alerts: |
|
Comments (none posted)
dia: missing input sanitizing
| Package(s): | dia |
CVE #(s): | CAN-2005-2966
|
| Created: | October 4, 2005 |
Updated: | April 6, 2006 |
| Description: |
Joxean Koret discovered that the SVG import plugin did not properly
sanitize data read from an SVG file. By tricking an user into opening
a specially crafted SVG file, an attacker could exploit this to
execute arbitrary code with the privileges of the user. |
| Alerts: |
|
Comments (none posted)
emacs21: format string vulnerability in "movemail"
| Package(s): | emacs21 |
CVE #(s): | CAN-2005-0100
|
| Created: | February 7, 2005 |
Updated: | May 15, 2006 |
| Description: |
Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could be exploited to
execute arbitrary code with the privileges of the user and the "mail"
group. |
| Alerts: |
|
Comments (none posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
ethereal: denial of service
| Package(s): | ethereal |
CVE #(s): | CVE-2005-3313
|
| Created: | January 5, 2006 |
Updated: | January 11, 2006 |
| Description: |
Ethereal, a network traffic monitor has an IRC protocol dissector
vulnerability, remote attackers can cause a denial of service
by creating an infinite loop. |
| Alerts: |
|
Comments (none posted)
evolution: format string issues
Comments (2 posted)
fetchmail: multidrop bug
| Package(s): | fetchmail |
CVE #(s): | CVE-2005-4348
|
| Created: | December 20, 2005 |
Updated: | May 27, 2006 |
| Description: |
Fetchmail contains a bug which allows a malicious mail server to crash the
client by sending a message without headers. This occurs when running in
multidrop mode. |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflow
| Package(s): | ffmpeg |
CVE #(s): | CVE-2005-4048
|
| Created: | December 15, 2005 |
Updated: | March 17, 2006 |
| Description: |
The avcodec_default_get_buffer() function of the ffmpeg library
has a buffer overflow vulnerability. A user can be tricked into
playing a maliciously created PNG movie, allowing the attacker to
run arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
firefox: multiple vulnerabilities
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FUSE: mtab corruption through fusermount
| Package(s): | fuse |
CVE #(s): | CVE-2005-3531
|
| Created: | November 22, 2005 |
Updated: | January 24, 2006 |
| Description: |
Thomas Biege discovered that fusermount fails to securely handle
special characters specified in mount points. A local attacker could corrupt the contents of the /etc/mtab file by mounting over a maliciously-named directory using fusermount, potentially allowing the attacker to set unauthorized mount options. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow
| Package(s): | gaim |
CVE #(s): | CAN-2005-2103
|
| Created: | August 10, 2005 |
Updated: | February 27, 2006 |
| Description: |
Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
gdb: multiple vulnerabilities
| Package(s): | gdb |
CVE #(s): | CAN-2005-1704
CAN-2005-1705
|
| Created: | May 20, 2005 |
Updated: | August 11, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer
overflow in the BFD library, resulting in a heap overflow. A review also
showed that by default, gdb insecurely sources initialization files from
the working directory. Successful exploitation would result in the
execution of arbitrary code on loading a specially crafted object file or
the execution of arbitrary commands. |
| Alerts: |
|
Comments (5 posted)
gdk-pixbuf: multiple vulnerabilities
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CVE-2005-3186
CVE-2005-2976
CVE-2005-2975
|
| Created: | November 15, 2005 |
Updated: | March 20, 2006 |
| Description: |
The gdk-pixbuf package contains an image loading library used with the
GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM file
in such a way that it could cause an application linked with gdk-pixbuf to
execute arbitrary code when the file was opened by a victim.
Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM
file in such a way that it could cause an application linked with
gdk-pixbuf to execute arbitrary code or crash when the file was opened by a
victim.
Ludwig Nussel also discovered an infinite-loop denial of service bug in the
way gdk-pixbuf processes XPM images. An attacker could create a carefully
crafted XPM file in such a way that it could cause an application linked
with gdk-pixbuf to stop responding when the file was opened by a victim. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gzip: arbitrary command execution
| Package(s): | gzip |
CVE #(s): | CAN-2005-0758
|
| Created: | August 1, 2005 |
Updated: | January 10, 2007 |
| Description: |
zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|'
and '&' properly when they occurred in input file names. This could be
exploited to execute arbitrary commands with user privileges if zgrep is
run in an untrusted directory with specially crafted file names. |
| Alerts: |
|
Comments (2 posted)
HylaFAX: input validation vulnerability
| Package(s): | hylafax |
CVE #(s): | CVE-2005-3538
CVE-2005-3539
|
| Created: | January 6, 2006 |
Updated: | January 17, 2006 |
| Description: |
The HylaFAX
4.2.4 release corrects issues with previous versions. HylaFAX runs the
notify script on untrusted user input. Furthermore, users can log in
without a password when HylaFAX is installed with the pam USE-flag
disabled. |
| Alerts: |
|
Comments (none posted)
imap: buffer overflow in c-client
| Package(s): | imap |
CVE #(s): | CAN-2003-0297
|
| Created: | February 18, 2005 |
Updated: | April 10, 2006 |
| Description: |
A buffer overflow flaw was found in the c-client IMAP client. An attacker
could create a malicious IMAP server that if connected to by a victim could
execute arbitrary code on the client machine. |
| Alerts: |
|
Comments (none posted)
ipsec-tools: denial of service
| Package(s): | ipsec-tools |
CVE #(s): | CVE-2005-3732
|
| Created: | December 1, 2005 |
Updated: | June 8, 2006 |
| Description: |
ipsec-tools has a remote
denial of service vulnerability in the racoon daemon.
If racoon is running in aggressive mode, it fails to check all peer
payloads during
When the daemon the IKE negotiation phase, allowing a malicious peer
to crash the daemon. One should always be careful around aggressive racoons. |
| Alerts: |
|
Comments (none posted)
kdebase: local root vulnerability
| Package(s): | kdebase |
CVE #(s): | CAN-2005-2494
|
| Created: | September 7, 2005 |
Updated: | August 11, 2006 |
| Description: |
The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kernel: multiple vulnerabilities
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-2709
CVE-2005-2973
CVE-2005-3055
CVE-2005-3180
CVE-2005-3271
CVE-2005-3272
CVE-2005-3273
CVE-2005-3274
CVE-2005-3275
CVE-2005-3276
|
| Created: | November 22, 2005 |
Updated: | March 15, 2006 |
| Description: |
Al Viro discovered a race condition in the /proc file handler of
network devices. A local attacker could exploit this by opening any
file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that
interface was shut down. Under certain circumstances this could lead
to a kernel crash or even arbitrary code execution with full kernel
privileges. (CVE-2005-2709)
Tetsuo Handa discovered a local Denial of Service vulnerability in the
udp_v6_get_port() function. On computers which use IPv6, a local
attacker could exploit this to trigger an infinite loop in the kernel.
(CVE-2005-2973)
Harald Welte discovered a Denial of Service vulnerability in the USB
devio driver. A local attacker could exploit this by sending an "USB
Request Block" (URB) and terminating the sending process before the
arrival of the answer, which left an invalid pointer and caused a
kernel crash. (CVE-2005-3055)
Pavel Roskin discovered an information leak in the Orinoco wireless
card driver. When increasing the buffer length for storing data, the
buffer was not padded with zeros, which exposed a random part of the
system memory to the user. (CVE-2005-3180)
A resource leak has been discovered in the handling of POSIX timers in
the exec() function. This could be exploited to a Denial of Service
attack by a group of local users. (CVE-2005-3271)
Stephen Hemminger discovered a weakness in the network bridge driver.
Packets which had already been dropped by the packet filter could
poison the forwarding table, which could be exploited to make the
bridge forward spoofed packages. (CVE-2005-3272)
David S. Miller discovered a buffer overflow in the rose_rt_ioctl()
function. By calling the function with a large "ngidis" argument, a
local attacker could cause a kernel crash. (CVE-2005-3273)
Neil Horman discovered a race condition in the connection timer
handling. This allowed a local attacker to set up an expiration
handler which modified the connection list while the list still being
traversed, which could result in a kernel crash. This vulnerability
only affects multiprocessor (SMP) systems. (CVE-2005-3274)
Patrick McHardy noticed a logic error in the network address
translation (NAT) connection tracker. A remote attacker could exploit
this by causing two packets for the same protocol to be NATed at the
same time, which resulted in a kernel crash. (CVE-2005-3275)
Paolo Giarrusso discovered an information leak in the
sys_get_thread_area(). The returned structure was not properly
cleared, which exposed a small amount of kernel memory to userspace
programs. This could possibly expose confidential data.
(CVE-2005-3276) |
| Alerts: |
|
Comments (2 posted)
libconvert-uulib-perl: arbitrary code execution
| Package(s): | libconvert-uulib-perl |
CVE #(s): | CAN-2005-1349
|
| Created: | May 20, 2005 |
Updated: | January 27, 2006 |
| Description: |
Mark Martinec and Robert Lewis discovered a buffer overflow in
Convert::UUlib (before 1.051), a Perl interface to the uulib library, which
may result in the execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libdbi-perl: insecure temporary file
| Package(s): | libdbi-perl |
CVE #(s): | CAN-2005-0077
|
| Created: | January 25, 2005 |
Updated: | March 2, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Project
discovered that the DBI library, the Perl5 database interface, creates
a temporary PID file in an insecure manner. This can be exploited by a
malicious user to overwrite arbitrary files owned by the person
executing the parts of the library. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libnet-ssleay-perl: weakened cryptographic operations
| Package(s): | libnet-ssleay-perl |
CVE #(s): | CAN-2005-0106
|
| Created: | May 3, 2005 |
Updated: | January 27, 2006 |
| Description: |
Javier Fernandez-Sanguino Pena discovered that this library used the
file /tmp/entropy as a fallback entropy source if a proper source was
not set in the environment variable EGD_PATH. This can potentially
lead to weakened cryptographic operations if an attacker provides a
/tmp/entropy file with known content. |
| Alerts: |
|
Comments (none posted)
libpam-ldap: authentication bypass
| Package(s): | libpam-ldap |
CVE #(s): | CAN-2005-2641
|
| Created: | August 25, 2005 |
Updated: | October 6, 2006 |
| Description: |
libpam-ldap, the PAM LDAP interface, has a vulnerability in which
it fails to authenticate with an LDAP server which is not configured
properly, allowing an authentication bypass. |
| Alerts: |
|
Comments (none posted)
libTIFF: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2005-1544
|
| Created: | May 10, 2005 |
Updated: | February 18, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
stack based buffer overflow in the libTIFF library when reading a TIFF
image with a malformed BitsPerSample tag. Successful exploitation would
require the victim to open a specially crafted TIFF image, resulting in the
execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libungif: memory corruption
| Package(s): | libungif |
CVE #(s): | CAN-2005-2974
|
| Created: | November 3, 2005 |
Updated: | March 20, 2006 |
| Description: |
The libungif library has a vulnerability in the GIF file
colormap handling code. A maliciously crafted GIF file can
cause out of bounds memory writing and register corruption. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libXpm: new buffer overflows
| Package(s): | libXpm |
CVE #(s): | CAN-2005-0605
|
| Created: | March 4, 2005 |
Updated: | March 8, 2006 |
| Description: |
A new vulnerability has been discovered in libXpm, which is included in
OpenMotif and LessTif, that can potentially lead to remote code
execution. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mailman: denial of service
| Package(s): | mailman |
CVE #(s): | CVE-2005-3573
|
| Created: | December 2, 2005 |
Updated: | March 8, 2006 |
| Description: |
Scrubber.py in Mailman 2.1.4 - 2.1.6 does not properly handle UTF8
character encodings in filenames of e-mail attachments, which allows
remote attackers to cause a denial of service. |
| Alerts: |
|
Comments (none posted)
mod_auth_pgsql: format string flaws
| Package(s): | mod_auth_pgsql |
CVE #(s): | CVE-2005-3656
|
| Created: | January 6, 2006 |
Updated: | February 28, 2006 |
| Description: |
The mod_auth_pgsql package is an httpd module that allows user
authentication against information stored in a PostgreSQL database.
Several format string flaws were found in the way mod_auth_pgsql logs
information. It may be possible for a remote attacker to execute arbitrary
code as the 'apache' user if mod_auth_pgsql is used for user
authentication. |
| Alerts: |
|
Comments (none posted)
mod_python: remote access vulnerability
| Package(s): | mod_python |
CVE #(s): | CAN-2005-0088
|
| Created: | February 10, 2005 |
Updated: | April 10, 2006 |
| Description: |
mod_python has a vulnerability in the publisher handler that may allow
a remote user to use a specially crafted URL to allow access to
objects that should be protected. An information leak can result. |
| Alerts: |
|
Comments (none posted)
mysql: buffer overflow
| Package(s): | mysql |
CVE #(s): | CAN-2005-2558
|
| Created: | September 12, 2005 |
Updated: | January 12, 2006 |
| Description: |
The mysql CREATE FUNCTION can be used to create a buffer overflow.
A specially crafted long function name can be used by a local attacker
to crash the server or execute arbitrary code with the privileges of
the server. |
| Alerts: |
|
Comments (none posted)
mysql: low-impact security fix
| Package(s): | mysql |
CVE #(s): | CAN-2005-1636
|
| Created: | July 20, 2005 |
Updated: | February 22, 2006 |
| Description: |
An update to MySQL version 4.1.12 fixes a low-impact security
problem (bz#158689). |
| Alerts: |
|
Comments (1 posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | January 6, 2006 |
Updated: | March 7, 2011 |
| Description: |
Kurt Fitzner discovered that the NBD (network block device) server did not
correctly verify the maximum size of request packets. By sending specially
crafted large request packets, a remote attacker who is allowed to access
the server could exploit this to execute arbitrary code with root
privileges. |
| Alerts: |
|
Comments (none posted)
ncpfs: multiple vulnerabilities
| Package(s): | ncpfs |
CVE #(s): | CAN-2005-0013
CAN-2005-0014
|
| Created: | January 31, 2005 |
Updated: | May 15, 2006 |
| Description: |
Erik Sjolund discovered two vulnerabilities in the programs bundled
with ncpfs: there is a potentially exploitable buffer overflow in
ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities
using the NetWare client functions insecurely access files with
elevated privileges (CAN-2005-0013). |
| Alerts: |
|
Comments (none posted)
nfs-utils: arbitrary code execution
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-0946
|
| Created: | January 11, 2005 |
Updated: | February 27, 2006 |
| Description: |
Arjan van de Ven discovered a buffer overflow in rquotad on 64bit
architectures; an improper integer conversion could lead to a buffer
overflow. An attacker with access to an NFS share could send a specially
crafted request which could then lead to the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
ntp: uses wrong gid
| Package(s): | ntp |
CVE #(s): | CAN-2005-2496
|
| Created: | August 26, 2005 |
Updated: | August 11, 2006 |
| Description: |
When starting xntpd with the -u option and specifying the
group by using a string not a numeric gid the daemon uses
the gid of the user not the group. This problem is now fixed
by this update. |
| Alerts: |
|
Comments (none posted)
openmotif: buffer overflows
| Package(s): | openmotif |
CVE #(s): | CVE-2005-3964
|
| Created: | December 29, 2005 |
Updated: | July 27, 2006 |
| Description: |
The libUil component of the OpenMotif toolkit has a pair of buffer
overflow vulnerabilities that can possibly be used for the execution
of arbitrary code.
|
| Alerts: |
|
Comments (none posted)
openssh: GSSAPI credential disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2005-2798
|
| Created: | September 7, 2005 |
Updated: | February 3, 2006 |
| Description: |
OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
|
| Alerts: |
|
Comments (none posted)
otrs: multiple vulnerabilities
| Package(s): | otrs |
CVE #(s): | CVE-2005-3893
CVE-2005-3894
CVE-2005-3895
|
| Created: | December 16, 2005 |
Updated: | February 15, 2006 |
| Description: |
Several vulnerabilities were discovered in the CMS system OTRS. Multiple
SQL injection vulnerabilities in index.pl in Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, multiple cross-site
scripting vulnerabilities in index.pl in Open Ticket Request System (OTRS)
1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, and Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when
AttachmentDownloadType is set to inline, renders text/html e-mail
attachments as HTML in the browser when the queue moderator attempts to
download the attachment. |
| Alerts: |
|
Comments (none posted)
pcre3: arbitrary code execution
| Package(s): | pcre3 |
CVE #(s): | CAN-2005-2491
|
| Created: | August 23, 2005 |
Updated: | March 10, 2006 |
| Description: |
A buffer overflow has been discovered in the PCRE, a widely used library
that provides Perl compatible regular expressions. Specially crafted
regular expressions triggered a buffer overflow. On systems that accept
arbitrary regular expressions from untrusted users, this could be exploited
to execute arbitrary code with the privileges of the application using the
library. |
| Alerts: |
|
Comments (none posted)
perl: setuid vulnerabilities
| Package(s): | perl |
CVE #(s): | CAN-2005-0155
CAN-2005-0156
|
| Created: | February 2, 2005 |
Updated: | August 11, 2006 |
| Description: |
There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access. |
| Alerts: |
|
Comments (none posted)
perl: symlink vulnerability
| Package(s): | perl |
CVE #(s): | CAN-2005-0448
|
| Created: | March 9, 2005 |
Updated: | January 30, 2006 |
| Description: |
The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries. |
| Alerts: |
|
Comments (none posted)
perl: integer overflow
| Package(s): | perl |
CVE #(s): | CVE-2005-3962
CVE-2005-3912
|
| Created: | December 1, 2005 |
Updated: | February 27, 2006 |
| Description: |
Perl has an sprintf integer overflow vulnerability
that may be used for a denial of service, remote code
execution and information leakage. |
| Alerts: |
|
Comments (none posted)
petris: buffer overflow
| Package(s): | petris |
CVE #(s): | CVE-2005-3540
|
| Created: | January 9, 2006 |
Updated: | January 11, 2006 |
| Description: |
Steve Kemp from the Debian Security Audit project discovered a buffer
overflow in petris, a clone of the Tetris game, which may be exploited
to execute arbitrary code with group games privileges. |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
phpMyAdmin: multiple vulnerabilities
| Package(s): | phpmyadmin |
CVE #(s): | CVE-2005-4079
CVE-2005-3665
|
| Created: | December 12, 2005 |
Updated: | November 20, 2006 |
| Description: |
Stefan Esser reported multiple vulnerabilities
found in phpMyAdmin. The $GLOBALS variable allows modifying the global
variable import_blacklist to open phpMyAdmin to local and remote file
inclusion, depending on your PHP version (CVE-2005-4079, PMASA-2005-9).
Furthermore, it is also possible to conduct an XSS attack via the
$HTTP_HOST variable and a local and remote file inclusion because the
contents of the variable are under total control of the attacker
(CVE-2005-3665, PMASA-2005-8). |
| Alerts: |
|
Comments (none posted)
poppler: arbitrary code execution
| Package(s): | poppler |
CVE #(s): | CVE-2005-3191
CAN-2005-3193
|
| Created: | December 8, 2005 |
Updated: | January 16, 2006 |
| Description: |
The poppler PDF rendering library has a heap overflow vulnerability
that can be exploited by viewing specially crafted PDF files.
An attacker can cause a crash or the execution of arbitrary
code. This vulnerability is related to
a similar vulnerability with xpdf. |
| Alerts: |
|
Comments (none posted)
postgresql: database initialization errors
| Package(s): | postgresql |
CVE #(s): | CAN-2005-1409
CAN-2005-1410
|
| Created: | May 4, 2005 |
Updated: | February 28, 2006 |
| Description: |
PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
|
| Alerts: |
|
Comments (none posted)
pound: HTTP Request Smuggling Attack
| Package(s): | pound |
CVE #(s): | CVE-2005-3751
|
| Created: | January 10, 2006 |
Updated: | June 8, 2006 |
| Description: |
HTTP requests with conflicting Content-Length and Transfer-Encoding headers
could lead to HTTP Request Smuggling Attack, which can be exploited to
bypass packet filters or poison web caches. |
| Alerts: |
|
Comments (none posted)
pstotext: remote execution of arbitrary code
| Package(s): | pstotext netpbm |
CVE #(s): | CAN-2005-2471
|
| Created: | August 1, 2005 |
Updated: | March 28, 2006 |
| Description: |
Max Vozeler reported that pstotext calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option. An
attacker could craft a malicious PostScript file and entice a user to run
pstotext on it, resulting in the execution of arbitrary commands with the
permissions of the user running pstotext. See this Secunia advisory for more information. |
| Alerts: |
|
Comments (2 posted)
Py2Play: remote execution of arbitrary Python code
| Package(s): | Py2Play |
CVE #(s): | CAN-2005-2875
|
| Created: | September 19, 2005 |
Updated: | September 6, 2006 |
| Description: |
Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send
malicious Python pickles, resulting in the execution of arbitrary
Python code on the targeted game client. |
| Alerts: |
|
Comments (none posted)
scorched3d: multiple vulnerabilities
| Package(s): | scorched3d |
CVE #(s): | |
| Created: | November 15, 2005 |
Updated: | August 11, 2006 |
| Description: |
Luigi Auriemma discovered multiple flaws in the Scorched 3D game
server, including a format string vulnerability and several buffer
overflows. A remote attacker could exploit these vulnerabilities to crash
a game server or execute arbitrary code with the rights of the game server
user. |
| Alerts: |
|
Comments (none posted)
scponly: privilege escalation
| Package(s): | scponly |
CVE #(s): | CVE-2005-4532
|
| Created: | December 29, 2005 |
Updated: | February 13, 2006 |
| Description: |
The scponly restricted shell has a privilege escalation vulnerability.
Local users can chroot into arbitrary directories, and can gain root
privileges if a directory contains hard links to setuid programs.
Also, scponly does not properly validate command line parameters
to the scp and rsync commands. |
| Alerts: |
|
Comments (none posted)
smstools: format string attack
| Package(s): | smstools |
CVE #(s): | CVE-2006-0083
|
| Created: | January 9, 2006 |
Updated: | January 11, 2006 |
| Description: |
Ulf Harnhammar from the Debian Security Audit project discovered a
format string attack in the logging code of smstools, which may be
exploited to execute arbitrary code with root privileges. |
| Alerts: |
|
Comments (none posted)
spamassassin: denial of service
| Package(s): | spamassassin |
CVE #(s): | CVE-2005-3351
|
| Created: | November 9, 2005 |
Updated: | March 7, 2006 |
| Description: |
Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field. |
| Alerts: |
|
Comments (none posted)
squid: authentication handling
| Package(s): | squid |
CVE #(s): | CAN-2005-2917
|
| Created: | September 30, 2005 |
Updated: | March 15, 2006 |
| Description: |
Upstream developers of squid, the popular WWW proxy cache, have
discovered that changes in the authentication scheme are not handled
properly when given certain request sequences while NTLM
authentication is in place, which may cause the daemon to restart. |
| Alerts: |
|
Comments (none posted)
sudo: vulnerability via scripts
| Package(s): | sudo |
CVE #(s): | CAN-2005-4158
CVE-2006-0151
|
| Created: | December 16, 2005 |
Updated: | September 1, 2006 |
| Description: |
Perl and Python scripts run via Sudo can be subverted. |
| Alerts: |
|
Comments (none posted)
sudo: missing input sanitizing
| Package(s): | sudo |
CVE #(s): | CVE-2005-2959
|
| Created: | October 25, 2005 |
Updated: | February 19, 2006 |
| Description: |
Tavis Ormandy noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. The SHELLOPTS and PS4 variables are dangerous and are
still passed through to the program running as privileged user. This
can result in the execution of arbitrary commands as privileged user
when a bash script is executed. These vulnerabilities can only be
exploited by users who have been granted limited super user
privileges. |
| Alerts: |
|
Comments (none posted)
sudo: race condition
| Package(s): | sudo |
CVE #(s): | CAN-2005-1993
|
| Created: | June 21, 2005 |
Updated: | February 24, 2006 |
| Description: |
Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump: multiple DoS issues
| Package(s): | tcpdump |
CVE #(s): | CAN-2005-1280
CAN-2005-1279
CAN-2005-1278
|
| Created: | May 2, 2005 |
Updated: | April 10, 2006 |
| Description: |
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote
attackers to cause a denial of service (infinite loop) via a crafted RSVP
packet of length 4. (CAN-2005-1280)
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of
service (infinite loop) via a crafted BGP packet, which is not properly
handled by RT_ROUTING_INFO, or LDP packet, which is not properly
handled by the ldp_print function. (CAN-2005-1279)
The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and
earlier allows remote attackers to cause a denial of service (infinite
loop) via a zero length, as demonstrated using a GRE packet.
(CAN-2005-1278) |
| Alerts: |
|
Comments (none posted)
texinfo: temporary file vulnerability
| Package(s): | texinfo |
CVE #(s): | CAN-2005-3011
|
| Created: | October 5, 2005 |
Updated: | November 9, 2006 |
| Description: |
Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability. |
| Alerts: |
|
Comments (none posted)
ucd-snmp: denial of service
| Package(s): | ucd-snmp |
CVE #(s): | CAN-2005-2177
|
| Created: | August 9, 2005 |
Updated: | January 27, 2006 |
| Description: |
A denial of service bug was found in the way ucd-snmp uses network stream
protocols. A remote attacker could send a ucd-snmp agent a specially
crafted packet which will cause the agent to crash. |
| Alerts: |
|
Comments (none posted)
udev: insecure files in /dev/input
| Package(s): | udev |
CVE #(s): | CVE-2005-3631
|
| Created: | December 20, 2005 |
Updated: | February 28, 2006 |
| Description: |
Richard Cunningham discovered a flaw in the way udev sets permissions on
various files in /dev/input. It may be possible for an authenticated
attacker to gather sensitive data entered by a user at the console, such as
passwords. |
| Alerts: |
|
Comments (none posted)
unzip: race condition
| Package(s): | unzip |
CVE #(s): | CAN-2005-2475
|
| Created: | September 29, 2005 |
Updated: | January 12, 2006 |
| Description: |
Unzip has a race condition vulnerability
in the handling of output files.
During file unpacking, a local attacker can modify the permissions
of arbitrary files in the victim's directory. |
| Alerts: |
|
Comments (none posted)
up-imapproxy: format string vulnerabilities
| Package(s): | up-imapproxy |
CVE #(s): | CAN-2005-2661
|
| Created: | October 10, 2005 |
Updated: | March 7, 2006 |
| Description: |
up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
|
| Alerts: |
|
Comments (none posted)
uw-imap: buffer overflow
| Package(s): | uw-imap |
CVE #(s): | CAN-2005-2933
|
| Created: | October 11, 2005 |
Updated: | April 10, 2006 |
| Description: |
"infamous41md" discovered a buffer overflow in uw-imap, the University
of Washington's IMAP Server that allows attackers to execute arbitrary
code. |
| Alerts: |
|
Comments (none posted)
vixie-cron: crontab allows any user to read another users crontabs
| Package(s): | vixie-cron |
CVE #(s): | CAN-2005-1038
|
| Created: | April 15, 2005 |
Updated: | March 15, 2006 |
| Description: |
crontab in Vixie cron 4.1, when running with the -e option, allows local
users to read the cron files of other users by changing the file being
edited to a symlink. NOTE: there is insufficient information to know
whether this is a duplicate of CVE-2001-0235. See also this Security Focus
report. |
| Alerts: |
|
Comments (none posted)
VMware: arbitrary code execution
| Package(s): | vmware |
CVE #(s): | CVE-2005-4459
|
| Created: | January 9, 2006 |
Updated: | January 11, 2006 |
| Description: |
Tim Shelton discovered that vmnet-natd, the host module providing NAT-style
networking for VMware guest operating systems, is unable to process
incorrect 'EPRT' and 'PORT' FTP requests. Malicious guest operating
systems using the NAT networking feature or local VMware Workstation users
could exploit this vulnerability to execute arbitrary code on the host
system with elevated privileges. |
| Alerts: |
|
Comments (none posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xloadimage: buffer overflows
| Package(s): | xloadimage |
CVE #(s): | CAN-2005-3178
|
| Created: | October 10, 2005 |
Updated: | May 15, 2006 |
| Description: |
Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
xorg-x11: heap overflow
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2005-2495
|
| Created: | September 12, 2005 |
Updated: | March 8, 2006 |
| Description: |
The pixmap memory allocation code in the X.Org X window system is
vulnerable to an integer overflow, a local user can use this to
execute arbitrary code with elevated privileges. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
xpdf: arbitrary code execution
| Package(s): | xpdf |
CVE #(s): | CVE-2005-3193
|
| Created: | December 6, 2005 |
Updated: | January 11, 2006 |
| Description: |
Several flaws were discovered in Xpdf. An
attacker could construct a carefully crafted PDF file that could cause Xpdf
to crash or possibly execute arbitrary code when opened. |
| Alerts: |
|
Comments (none posted)
xpdf: heap overflows
| Package(s): | xpdf gpdf kpdf poppler |
CVE #(s): | CVE-2005-3624
CVE-2005-3625
CVE-2005-3626
CVE-2005-3627
|
| Created: | January 11, 2006 |
Updated: | March 10, 2006 |
| Description: |
Xpdf, the associated poppler library, and other applications using that library are susceptible to a new set of buffer overflows discovered by Chris Evans and infamous41md. These overflows could be exploited, via a malicious PDF file, to execute arbitrary code on the target system. |
| Alerts: |
|
Comments (none posted)
xpdf: denial of service
| Package(s): | xpdf kpdf |
CVE #(s): | CAN-2005-2097
|
| Created: | August 9, 2005 |
Updated: | August 2, 2006 |
| Description: |
A flaw was discovered in Xpdf in that could allow an attacker to construct
a carefully crafted PDF file that would cause Xpdf to consume all available
disk space in /tmp when opened. |
| Alerts: |
|
Comments (none posted)
xpdf: integer overflows
| Package(s): | xpdf, poppler, cupsys, tetex-bin |
CVE #(s): | CVE-2005-3624
CVE-2005-3625
CVE-2005-3626
CVE-2005-3627
|
| Created: | January 5, 2006 |
Updated: | November 30, 2006 |
| Description: |
xpdf has a number of integer overflows.
A remote attacker can trick a user into opening a maliciously
crafted pdf file, allowing the attacker to execute code with the
privileges of the local user.
This also affects the Poppler library, cupsys and tetex-bin. |
| Alerts: |
|
Comments (none posted)
zlib: buffer overflow
| Package(s): | zlib |
CVE #(s): | CAN-2005-1849
|
| Created: | July 21, 2005 |
Updated: | April 11, 2006 |
| Description: |
zlib has a vulnerability that can cause code that executes it to crash
if a corrupted file is opened. |
| Alerts: |
|
Comments (none posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current stable 2.6 release is 2.6.15.1,
announced on January 14.
This one contains a dozen or so patches for kernel crashes and security
problems.
The current 2.6 prepatch is 2.6.16-rc1, announced by Linus on
January 17. The details of what's in this release can be found in last week's summary and
this week's update (see below). In brief: 2.6.16 will include
the OCFS2 filesystem, the swap migration patches, various
new drivers, the mutex
changeover, high-resolution timers, a transparent inter-process communication
(TIPC) protocol implementation, a big netfilter update, a new
batch-level scheduler class, and more.
See the short log file for an overview
(note that "short" is relative) or the
long-format log for the details.
Linus's post-rc1 git repository contains a pile of network driver updates
and a few other fixes. The 2.6.16 merge window has closed, so one would
not expect to see a whole lot of new features going in at this point.
There will apparently be one exception, however: Andrew Morton intends to
merge the openat() series of system calls, along with the
pselect() and ppoll() implementation. These new system
call were covered here last
December.
The current -mm tree is 2.6.16-rc1-mm1. Recent changes
to -mm include a bunch of reiser3 work ("Please test with caution,
but please test."), several more semaphore-to-mutex conversion
patches, multi-column oops stack backtraces for i386, and a new software
suspend API intended to help move some of the image save/restore work to
user space.
Comments (none posted)
Kernel development news
A fair number of patches have been merged since the
looking forward to 2.6.16
article was published. In addition to everything listed there, the
following patches are part of 2.6.16-rc1, starting with user-visible
changes:
- A big XFS update which should improve performance.
- A big direct rendering update. The Video4Linux and DVB code have
also seen large updates.
- An implementation of the Transparent
Inter-Process Communication (TIPC) protocol. TIPC is used for
communication within clusters.
- Harald Welte's massive "x_tables" patch, which unifies much of the
code for various types of tables used in the netfilter code.
- A big PowerPC update including experimental Mac G5 support. There is also
a new virtual "spufs" filesystem providing access to "synergistic
processing units" on the Cell architecture.
- A framework for "serial peripheral interface" (SPI) devices has been added,
along with a handful of drivers.
- A new SCHED_BATCH scheduler class. Processes in this class are
scheduled normally, with the exception that they get no "interactivity"
bonus when they sleep. Unprivileged processes are allowed to move between
SCHED_NORMAL and SCHED_BATCH at will.
- The tmpfs filesystem has acquired a new set of mount options allowing the
system administrator to specify how memory should be allocated across a
NUMA system.
Changes visible to kernel developers include:
- Many parts of the kernel have been converted over to the new mutex type.
- Old-timers who automatically type "make bzImage" will find that it
no longer works; just type "make" instead.
- The device probe() and remove() methods have been moved
from struct device_driver to struct bus_type. The
bus-level methods will override any remaining driver methods.
- When the kernel is configured to be optimized for size, gcc (if it's
version 4.x) is given the freedom to decide whether inline
functions should really be inlined. The __always_inline
attribute now truly forces inlining in all cases. This is an outcome
from the discussion on
inline functions held a couple of weeks ago.
- Another outcome from that discussion: many kernel functions have had
the inline attribute removed. One of the more significant of
these is capable(), which has also been moved to
<linux/capability.h>.
- The old inter_module functions are only built if the one in-kernel
user (the MTD drivers) is present; otherwise they are unavailable.
The merge window for 2.6.16 is effectively closed, so there should not be a
whole lot more in the way of significant changes being merged in this
cycle.
Comments (5 posted)
Last September, this page featured
an article on the ktimers patch
by Thomas Gleixner. The new timer abstraction was designed to enable the
provision of high-resolution timers in the kernel and to address some of
the inefficiencies encountered when the current timer code is used in this mode.
Since then, there has been a large amount of
discussion, and the code has seen significant work. The end product of
that work, now called "hrtimers," was merged for the 2.6.16 release.
At its core, the hrtimer mechanism remains the same. Rather than using the
"timer wheel" data structure, hrtimers live on a time-sorted linked list,
with the next timer to expire being at the head of the list. A separate
red/black tree is also used to enable the insertion and removal of timer
events without scanning through the list. But while the core
remains the same, just about everything else has changed, at least
superficially.
There is a new type, ktime_t, which is used to store a time value
in nanoseconds. This type, found in <linux/ktime.h>, is
meant to be used as an opaque structure. And, interestingly, its
definition changes depending on the underlying architecture. On 64-bit
systems, a ktime_t is really just a 64-bit integer value in
nanoseconds. On 32-bit machines, however, it is a two-field structure: one
32-bit value holds the number of seconds, and the other holds nanoseconds.
The order of the two fields depends on whether the host architecture is
big-endian or not; they are always arranged so that the two values can,
when needed, be treated as a single, 64-bit value. Doing things this way
complicates the header files, but it provides for efficient time value
manipulation on all architectures.
A whole set of functions and macros has been provided for working with
ktime_t values, starting with the traditional two ways to declare
and initialize them:
DEFINE_KTIME(name); /* Initialize to zero */
ktime_t kt;
kt = ktime_set(long secs, long nanosecs);
Various other functions exist for changing ktime_t values; all of
these treat their arguments as read-only and return a ktime_t
value as their result:
ktime_t ktime_add(ktime_t kt1, ktime_t kt2);
ktime_t ktime_sub(ktime_t kt1, ktime_t kt2); /* kt1 - kt2 */
ktime_t ktime_add_ns(ktime_t kt, u64 nanoseconds);
Finally, there are some type conversion functions:
ktime_t timespec_to_ktime(struct timespec tspec);
ktime_t timeval_to_ktime(struct timeval tval);
struct timespec ktime_to_timespec(ktime_t kt);
struct timeval ktime_to_timeval(ktime_t kt);
clock_t ktime_to_clock_t(ktime_t kt);
u64 ktime_to_ns(ktime_t kt);
The interface for hrtimers can be found in
<linux/hrtimer.h>. A timer is represented by struct
hrtimer, which must be initialized with:
void hrtimer_init(struct hrtimer *timer, clockid_t which_clock);
Every hrtimer is bound to a specific clock. The system currently
supports two clocks, being:
- CLOCK_MONOTONIC: a clock which is guaranteed always to move
forward in time, but which does not reflect "wall clock time" in any
specific way. In the current implementation, CLOCK_MONOTONIC
resembles the jiffies tick count in that it starts at zero
when the system boots and increases monotonically from there.
- CLOCK_REALTIME which matches the current real-world time.
The difference between the two clocks can be seen when the system time is
adjusted, perhaps as a result of administrator action, tweaking by the
network time protocol code, or suspending and resuming the system. In any
of these situations, CLOCK_MONOTONIC will tick forward as if
nothing had happened, while CLOCK_REALTIME may see discontinuous
changes. Which clock should be used will depend mainly on whether the
timer needs to be tied to time as the rest of the world sees it or not.
The call to hrtimer_init() will tie an hrtimer to a specific
clock, but that clock can be changed with:
void hrtimer_rebase(struct hrtimer *timer, clockid_t new_clock);
Most of the hrtimer fields should not be touched. Two of them,
however, must be set by the user:
int (*function)(void *);
void *data;
As one might expect, function() will be called when the timer
expires, with data as its parameter.
Actually setting a timer is accomplished with:
int hrtimer_start(struct hrtimer *timer, ktime_t time,
enum hrtimer_mode mode);
The mode parameter describes how the time parameter should be
interpreted. A mode of HRTIMER_ABS indicates that
time is an absolute value, while HRTIMER_REL indicates
that time should be interpreted relative to the current time.
Under normal operation, function() will be called after (at least)
the requested expiration time. The hrtimer code implements a shortcut for
situations where the sole purpose of a timer is to wake up a process on
expiration: if function() is NULL, the process whose task
structure is pointed to by data will be awakened. In most cases,
however, code which uses hrtimers will provide a callback
function(). That function has an integer return value, which
should be either HRTIMER_NORESTART (for a one-shot timer which
should not be started again) or HRTIMER_RESTART for a recurring
timer.
In the restart case, the callback must set a new expiration time before
returning. Usually, restarting timers are used by kernel subsystems which
need a callback at a regular interval. The hrtimer code provides a
function for advancing the expiration time to the next such interval:
unsigned long hrtimer_forward(struct hrtimer *timer, ktime_t interval);
This function will advance the timer's expiration time by the given
interval. If necessary, the interval will be added more than once
to yield an expiration time in the future. Generally, the need to add the
interval more than once means that the system has overrun its timer
period, perhaps as a result of high system load. The return value from
hrtimer_forward() is the number of missed intervals, allowing code
which cares to detect and respond to the situation.
Outstanding timers can be canceled with either of:
int hrtimer_cancel(struct hrtimer *timer);
int hrtimer_try_to_cancel(struct hrtimer *timer);
When hrtimer_cancel() returns, the caller can be sure that the
timer is no longer active, and that its expiration function is not running
anywhere in the system. The return value will be zero if the timer was not
active (meaning it had already expired, normally), or one if the timer was
successfully canceled. hrtimer_try_to_cancel() does the same,
but will not wait if the timer function is running; it will, instead,
return -1 in that situation.
A canceled timer can be restarted by passing it to
hrtimer_restart().
Finally, there is a small set of query functions.
hrtimer_get_remaining() returns the amount of time left before a
timer expires. A call to hrtimer_active() returns nonzero if the
timer is currently on the queue. And a call to:
int hrtimer_get_res(clockid_t which_clock, struct timespec *tp);
will return the true resolution of the given clock, in nanoseconds.
Comments (9 posted)
The folks at IBM would like to add a "container" capability to the Linux
kernel. Containers are a way of walling a group of processes off from the
rest of the system; a process within a container will only see its fellow
inmate processes and whatever resources are made accessible to that
container. This feature has some obvious security-related applications.
IBM's plans, evidently, also include the ability to pack up a container and
move it to another physical host without disrupting the processes trapped
inside.
The patches which have been circulating so far fall short of the final plan,
but they already disturb enough code to have attracted some skeptical
criticism. In particular, the 34-part PID virtualization patch
creates a simple container type, and implements a separate process ID space
within containers. But, as we'll see, doing even that much involves some
significant kernel changes.
The containers themselves are fairly simple. The patches create a virtual
file called /proc/container. If a process writes a string to that
file, a new container is created for that process, using the string as its
name. The namespace is global, so every container on the system must have
a unique name. Any child processes created by the newly-contained process
will also be trapped within the container, with no way out.
At this point, being inside a container does not affect a process's life
that much. The one thing that does change, however, is that each container
has its own process ID (PID) space. Processes within the container can
only see others in the same container. There is nothing particularly
controversial about that behavior, but the developers have another
objective in mind: they want to be able to change the PIDs of contained
processes without the processes themselves noticing. In particular, they
would like to be able to migrate a container to a different system, which
will certainly assign new PIDs to every process within the container. Code
written for Unix-like systems does not normally expect its PID to change
over time, however; so switching PIDs underneath a process could lead to all
kinds of strange behavior. To avoid this problem, the plan is that PIDs remain
constant within the container, even if those PIDs change in the real world.
Implementing constant PIDs (from a viewpoint inside the container) is not a
straightforward task; it involves adding a whole new virtualization layer
inside the kernel. There are two types of PIDs now, "real" PIDs and the
virtual PIDs used by contained processes. Any place in the kernel which
deals with PID values must become aware of which type of PID it is using,
and convert to the other type when necessary. So, as a general rule, any
code which exchanges PIDs with user space must use the virtual variety,
while PIDs handled within the kernel are real.
The PID logic is complicated by a few little details, like: what happens
when containers are nested? A process living within a container has a real
PID and a virtual PID associated with the container. If that process
creates a container of its own, it will acquire yet another PID associated
with the new container. So it is not possible to simply convert a real PID
to a virtual PID; such questions require a "context" so that the kernel
knows which virtual PID is wanted.
The result of all this is that PID handling within the kernel changes
significantly. Code which used to get the current process's PID with
current->pid must now use tsk_pid(current) for the
real PID, or tsk_vpid(current) for the virtual PID - and it must
know which one it wants. In situations where more than one virtual PID
might be appropriate, tsk_vpid_ctx() must be used to supply the
context. Much of the patch set is concerned simply with
making these conversions; for good measure, it also renames the pid
field of struct task_struct to catch any code still trying to
access it directly.
Behind all of this is a concept called "pidspaces." The patch carves up
the global PID space takes the upper 9 bits of the 32-bit PID value and
puts the pidspace number there. A virtual PID as seen within a container
is turned into a real kernel PID by stuffing the pidspace number in those
upper bits. Since the contained processes only see virtual PIDs, they
never see the pidspace number, and they will not notice if that number
changes.
All of this code seems to work, but there is a certain amount of opposition
to merging it. As Alan Cox put it:
This is an obscure, weird piece of functionality for some special
case usages most of which are going to be eliminated by Xen. I
don't see the kernel side justification for it at all.
The developers answer that the ability to checkpoint and restart process
trees, possibly moving them in between, will be highly useful. Some other
virtualization projects also require this capability - not everybody wants
to use Xen. So the pressure for
PID virtualization probably won't just go away.
What might happen is that the hiding of current->pid might be
taken out, greatly reducing the size of the patch. Another idea which has
been floated is to eliminate, to the greatest degree possible, the use of
PIDs within the kernel. Almost any in-kernel use of a PID can be replaced
with a direct pointer to the task structure. If a PID eventually is
reduced to little more than a process-identifying cookie used for
communication with user space, it will be easier to virtualize without
complicating large amounts of kernel code.
Comments (8 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
- Junio C Hamano: GIT 1.1.2.
(January 14, 2006)
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Networking
Architecture-specific
Security-related
Page editor: Jonathan Corbet
Distributions
News and Editorials
After several weeks of delay, the second development release of
Fedora Core 5 was finally made
available on January 16th. This is a much anticipated version - not only
will this be Fedora's first new release after switching to a longer,
9-month release cycle, it is likely that much of the distribution's current
core will form the basis of the upcoming release of Red Hat Enterprise
Linux (RHEL) 5. As such, Fedora 5 is expected to be well-tested and
relatively bug-free, with fewer experimental features, but better stability
and reliability. According to Fedora's
release schedule, Test2
will be followed by Test3 in about a month's time before the final release
on March 15th.
What's new in Fedora Core 5? Users performing a new installation will
immediately notice that the Anaconda installer has been given a major
interface overhaul. The informational pane on the left of the installation
screens has been removed and many of the installation dialogs have been
simplified, with more advanced options hidden behind an extra click. The
screens providing partitioning and package selection dialogs have also been
modified, while the option to set SELinux functionality has been moved into
the post-installation setup. Personally, I can't say I like the changes.
Anaconda, a de facto standard among Linux installers, has been barely
touched for years, so why the sudden need for a major interface surgery?
The core system components have been upgraded. Test2 comes with kernel
2.6.15, a development release of glibc 2.4, as well as a CVS build of the
yet-to-be released GCC 4.1. The upgrade to glibc 2.4 is particularly
significant since Fedora Core 5 will be the first distribution shipping with the
new major version of the GNU C library. Although it is still in heavy
development, we know that the new glibc will no longer be compilable with
GCC 3.x, it won't support LinuxThreads (only Native Posix Thread Library),
and all non-desktop CPUs will be moved to an unsupported ports add-on. As
for the GCC 4.1 series, one of the most important improvements in its code
is the introduction of fstack-protector, a feature whose purpose is to
assign a random and verifiable value to the stack of key functions. This
feature will make it harder for remote attackers to exploit
buffer overflows.
On the desktop, a current development release of GNOME 2.14, combined with a
brand new desktop theme, wallpaper and screensaver, represent a major
visual change from the previous test release. With GNOME 2.14, much effort
has been focused on the Evolution mail client, which is undergoing subtle
interface changes, including dialog simplification and general improvements
in consistency and polish. There has been a lot of emphasis on reduction of
load times and memory footprints of both the GNOME desktop and its
applications. The users of GnomeMeeting and Eye Of GNOME will also notice
substantial interface changes, while much of Gedit's code has been
rewritten under a new Multiple Documentation Interface specification. The
Nautilus search engine has also been enhanced. Coincidentally, GNOME 2.14
final is scheduled to be released on March 15, exactly the same day as
Fedora Core 5 - a fact that will almost certainly give rise to a few heated
debates on the Fedora mailing lists and forums.
As for the main applications, Firefox 1.5 and OpenOffice.org 2.0.1 feature
prominently on the desktop, but other recent additions to Fedora Core, such
as the Beagle desktop search tool (version 0.1.4), F-Spot photo manager
(0.1.5) and Tomboy note-taking utility, are also being pushed under the
spotlight. On the other hand, Mono, a software suite for developing .NET
client and server applications and which was added to the Fedora tree only
recently, is not even mentioned in the release announcement - despite the
fact that its sudden presence in Fedora caused a stir on many Linux news
sites just last week. Although Mono is now an integral part of Fedora Core,
Red Hat has stated that the product, which is developed by Novell (Red
Hat's main commercial competitor) will not be included in the next release
of the company's enterprise range of products.
Another new piece of software in Fedora Core 5 is "Package Updater", or
pup for short. This is an application with a very simple interface
- it lists all available updates after checking with the main update
server, and allows the user to receive the latest security and bug fixes.
There is nothing else to it - no intuitive way to configure the location of
the update server or to prevent certain applications from being replaced
with newer versions. Following the installer, this is another area which
the Fedora development team decided to simplify in order to appease the
non-technical computer user and perhaps to reduce the cost of technical
support further down the line. Of course, power users can still reach for
the command line to run yum and customize the package update
options, but those who are not prepared to read the man pages are now
expected to use pup.
Overall, I found that using this test release of Fedora Core was mostly a
positive experience. Although I disliked the simplification effort in the
installer and some of the applications, if it proves to be a successful way
of bringing more users and companies to Linux, then I am all for it. On the
application side, I haven't had any major problems during the two days of
testing, but some users on the Fedora test list reported crashes in
Evolution and GNOME Terminal, as well as a non-operational Nautilus CD
Burner. At one time, while running Beagle and pup, my system
became unresponsive and had to be rebooted, but I wasn't able to reproduce
this later. A large number of updates have appeared on the Fedora
development server since the release so it is likely that some of these
bugs are fixed already. A decent release overall, but it still needs a fair
amount of testing before it can be declared stable.
Comments (7 posted)
New Releases
Flight CD 3, milestone CD images of K/Ubuntu's Dapper Drake release, are
available for testing and bug busting. The Edubuntu release should be
available soon. Click below for a list of notable changes in this
release.
Full Story (comments: 6)
The Fedora Project has announced the second release of the Fedora Core 5
development cycle, available for the i386, x86_64, and PPC/PPC64
architectures. Please note that Fedora Core 3
has now been transfered the the Fedora Legacy
Project.
Full Story (comments: 7)
The latest Fedora Core 4 netdev kernel, kernel-2.6.14-1.1656_FC4.netdev.8
is now available. Click below for a list of patches that have been applied
to this kernel package.
Full Story (comments: none)
ITJungle
covers
the release of Service Pack 3 for SUSE Linux Enterprise Server 9.
"
SLES 9 SP3 also has the AppArmor security program that Novell bought
when it acquired Immunix, a provider of application security software for
Linux, last May. SLES 9 SP3 has AppArmor woven in as well as Linux
application security profiles for selected applications; the exact number
was not revealed in the SP3 release notes. As the company revealed when it
took the AppArmor product open source as an openSUSE project earlier this
week, the full AppArmor code and a more complete set of application
security profiles--some made by Novell, some made by application providers
through the openSUSE community--are expected to be embedded into the future
SLES 10 operating system, which is expected some time in May of this
year."
Comments (none posted)
Distribution News
The
AGNULA project, whose goal is to put
together a "reference multimedia distribution" based on Debian, has sent
out a terse announcement saying that the Italian agency which has funded
the project for the last few years has moved on to other things. As a
result, AGNULA is now a 100% volunteer project. Projects like AGNULA are
important - few people would say that the Linux multimedia experience is in
no need of improvement. Hopefully they will be able to carry their work
forward.
Full Story (comments: none)
Watch for some
major bug busting in the
unstable tree. "
This note is just some advance notice so that folks
who don't want to risk any negative consequences, whatever they end up
being, can ensure they don't have any RC bugs that are weeks old. Note that
the RMs have declared it open season on NMUs, so do look at packages you
care about even if you don't maintain them."
Here's a note about how the mirrors will be
split. "First, the executive summary for mirror operators reading
this: we'll be switching the primary mirror stuff for Debian to be for a
small number of architectures rather than all of them; initially this will
just be i386, but will probably expand to include amd64."
There are currently two proposals in discussion on debian-vote. This post contains links for those interested in
keeping up with the discussion.
Comments (none posted)
Ubuntu has made a transition from Bugzilla to Launchpad's Malone bug
tracker. All bugs are still available for browsing in Bugzilla, but logins
are disabled.
Full Story (comments: none)
New Distributions
GnomeDesktop
introduces the
GParted LiveCD, a
small, fast, Slackware-based live CD that syncs its releases with GParted.
Comments (none posted)
Distribution Newsletters
The Debian Weekly News for January 17, 2006 is out, with a look at a
proposed a license sufficient for Debian and FreeBSD for the Internet
Engineering Task Force that releases RFC documents, the availability of
X.org packages for the Hurd, the status of the m68k port, splitting mirrors
by port, new scripts to discover neglected packages, maintaining packages
by a team, and several other topics.
Full Story (comments: 7)
In an attempt to widen the communications channel, the Fedora Project has
started a series of weekly reports; the
January 16
edition is available now. It contains a terse summary of changes in
rawhide, current known issues, and more.
Comments (none posted)
The
Fedora
Weekly News covers Fedora Initiatives at LinuxWorld, Fedora Projects
Weekly Report, Kadischi Screenshots in osdir.com, Mono and Fedora, Fedora
Directory Server in Media, Fedora Rescue CD in Media, Thunderbird 1.5
Released, and other topics.
Comments (none posted)
The
Gentoo
Weekly Newsletter for the week of January 16, 2006 is out. This
edition covers new baselayout with improved runscripts, Portage changes USE
flags default behavior, PPC development roadmap, AMD64 project update, and
other topics.
Comments (none posted)
The
DistroWatch
Weekly for January 16, 2006 is out. "
Several interesting
announcements at last week's MacWorld provided fuel for many technology web
sites, but an important question remained unanswered: will Linux run on the
new MacBooks? Read on for an expert opinion. A rather quiet week on the
Linux distribution front, but expect things to pick up shortly as the
second test of Fedora Core 5 will be officially out today (Monday), while
the first beta of SUSE Linux 10.1 should appear on mirrors later this
week. Also in this issue: Fedora or Yellow Dog for your Mac, Xandros seeks
beta testers, Debian terminology explained, news from the development of
Dapper Drake, a new SUSE-based distribution for musicians, GParted Live CD
for all your disk partitioning tasks, and a good round-up of popular Linux
live CDs."
Comments (none posted)
Package updates
Fedora Core 4 updates:
system-config-bind (restore pre-FC5 pam
configuration file),
flex (bug fixes),
alsa-lib (new ainit (0.7), fix for SW modems
and root users),
groff (bug fixes, spec
cleanup),
openoffice.org (rebuilt with
alternative -mtune parameters for ix86),
libwpd (update to latest libwpd),
foomatic (fixes a conflict introduced by the
HPLIP update, plus other additions and bug fixes),
tcpdump (bug fix).
One last Fedora Core 3 update: tzdata (meta changes).
Comments (none posted)
Updates available for Mandriva Linux 2006.0:
xorg-x11 (update to upstream 6.9.0 final),
festival (rebuilt to prevent crashes),
klamav (update to v0.32),
OpenOffice.org (fix random crashes).
Updates for Mandriva Corporate Server 2.1: squid (new features).
Comments (none posted)
The January 14 entry on the
slackware-current
changelog shows new linux-2.6.14.6 packages in testing, an upgrade to
x11-6.9.0, and a few other changes.
Comments (none posted)
PostgreSQL has been updated for TSL 3.0 and 2.2, fixing various bugs.
Full Story (comments: none)
Newsletters and articles of interest
Informit.com
looks at some
popular live Linux CD distributions. "
Unfortunately, I can't
cover everyone's favorite distro because I'd end up with a text book rather
than an article, but I'll be looking at several popular distributions
including SimplyMEPIS, SLAX, Damn Small Linux, Knoppix, and Puppy, and on
the Mac side of things, Ubuntu. I'll also take a quick look at LG3D
(Looking Glass 3D) and INSERT (Inside Security Rescue Toolkit). This should
give you a good overview of just what's out there, as well as some of the
cool things you can do with a live Linux CD."
Comments (none posted)
Distribution reviews
Linux.com
reviews
Grafpup, a distribution for graphic designers. "
Based on Puppy
Linux, Grafpup is a small distribution despite its plethora of
tools. Download the 75MB ISO and you'll be amazed at its speed and
simplicity. When running from the live CD, Grafpup loads the entire
operating system into your RAM, ensuring that the applications run
instantly. The first time you run the live CD, Grafpup saves a file called
"pup101" on your hard disk that contains settings for your keyboard layout,
mouse type, and more, so that you don't need to configure your machine each
time you boot. Every successive boot completes in less than 20
seconds."
Comments (none posted)
Linux.com
reviews
the GhostWriter LiveCD. "
GhostWriter is a live CD that provides a
small number of tools for writers of short stories, novels, and
screenplays. But GhostWriter can be used by someone authoring works of
non-fiction as well. It's easy to use and has a small footprint. In fact,
there's nothing to install -- you run GhostWriter off a CD. Unlike some
live CD distros, GhostWriter doesn't have install scripts that let you make
it a desktop distribution, but [author Billy-Bob] Ming has hinted that a
future version might come with such scripts."
Comments (none posted)
NewsForge
reviews
FreeBSD 6.0. "
For software that's been around since the late
'70s, before any of today's more popular operating systems, open source
BSDs (in their current avatars) don't get their due share of hard
disks. FreeBSD, one of the first BSD flavors to emerge from the 386BSD
project, is a Unix-like free operating system based originally on the BSD
branch of 386BSD and later 4.4BSD-Lite. This makes BSD's more like
traditional Unixes than Linux. Late last year FreeBSD unleashed release
6.0, with better support for 64-bit and wireless hardware."
Comments (1 posted)
Page editor: Rebecca Sobol
Development
January 18, 2006
This article was contributed by Carl Bolduc
Introduction
Getting published is a major concern for students conducting
graduate studies in science. I'm a PhD student in molecular biology
and I started using Linux at the beginning of my graduate studies.
Public science research mostly looks like open-source software
development. You work hard and give your methods and results to
everyone through publications in scientific journals. Ironically, the
majority of people working in the field of science use only
proprietary software. I myself work in a Microsoft Windows
environment.
A typical scientific article will require the use of
several tools to reach its final published state.
First, most researchers use Microsoft
Word and Excel for text writing and tables. They also use EndNote to
manage and create the bibliographies you will find in every scientific
article. Finally, scientists use a graphics suite, such as
Adobe's Photoshop, for figures and PDF creation. This software listing scales
up to more than one thousand dollars. It's practically impossible for
the regular student to purchase such a platform. In some laboratories,
when the head researcher is kind enough, you will find a computer
where most of these tools are installed and shared by all members of
the team. But what if you could create your own open-source research
writing box for free? In fact, you can. You can accomplish the entire
array of tasks associated with scientific writing with any good Linux
distribution.
The easiest step
One of the most popular open source application that has boosted the
Microsoft to Linux transition is certainly
OpenOffice.org.
For anybody working in science
reporting, it is a first and easy step that enables you to step out of
proprietary software and remain compatible with Microsoft Office
formats. In addition, several journals will ask that the submissions
should be in the .doc or PDF format. OpenOffice.org saves you a lot of
trouble with its useful PDF export tool.
Although OpenOffice.org can
complete a fair portion of the job, it doesn't contain a bibliographic
manager tool such as EndNote yet. Such a facility is necessary for
academic writer and OpenOffice.org is supposed to fill the blank
with some bibliographic
extensions in its next version.
For now, there is a commercial web-based tool called
WriteNote
which offers a 30 day free trial and enables you to produce a
bibliography with RTF files created by OpenOffice.org.
LaTeX
While OpenOffice.org may be a first step toward writing scientific
articles under Linux, the true power resides inside LaTeX. As it is
mentioned on the latex project website: "LaTeX is a high-quality
typesetting system, with features designed for the production of
technical and scientific documentation". "LaTeX is the de facto
standard for the communication and publication of scientific
documents."
Some of the LaTeX
features include insertion of tables and figures as well as the capacity
to create complex mathematical equations. Additionally, there are
tremendous advantages in learning to write with LaTeX. In fact,
BibTeX could get you out of proprietary software tomorrow.
You can gather your bibliographic references in a simple text file with
the BibTeX syntax and easily insert quotations inside your LaTeX documents,
automatically generating a bibliography at the end of your articles.
While the LaTeX format requires a minimum of learning, you can rely on
the useful
TeXmed
web-based tool to query NCBI PubMed
and generate BibTeX entries for you. You must specify, in your LaTeX
document, a bibliography style to format it according to the journal's
recommendations. In fact, many journals now offer their bibliography
style on their website. If you can't find the format that you need on
the web, you can use
custom-bib to create the style you need.
LyX and friends
LaTeX basics can be learned quite easily, but you might need to read a
lot from the web or buy some books (like I did) to use its full
potential. But do you really need to go through all this trouble?
That's where
LyX comes into play.
LyX is a GUI front end to LaTeX. Though it has its own file format, it can
import and export to LaTeX. LyX looks like a word processor while
taking care of all the formatting, just like LaTeX. LyX is fully
featured and let you insert figures, tables, mathematical equations
and more. Though managing a bibtex text file is very easy, you can
rely on graphical tools here too. Software like gBib and JabRef
will help you deal with your numerous references and even let you
insert them in LyX, just like EndNote does with Word.
Gnuplot
Continuing in your path to build an open-source research writing box,
you need a powerful tool to generate plots from your precious
experiment results. That is where
Gnuplot
enters the scene, with its almost limitless possibilities. Gnuplot is a
command-line plotting utility with easy to learn commands that enable
you to create high quality 2D and 3D plots suitable for scientific
publications. It can output LaTeX and EPS code which can be inserted
in your LaTeX documents. You can check out this
demo
that shows the wide variety of Gnuplot's capabilities.
Inkscape
One thing that was really missing in Linux in the past was a good
vector graphics editor. I had to install Adobe Illustrator under
Wine
to be able to draw high quality figures
showing various metabolic pathways. Now, with
Inkscape,
I have everything that I need to create
high quality vector graphics which can be exported to EPS and inserted
in my LaTeX documents. Inkscape can draw shapes, paths, text and can
also export to PNG.
The Gimp
To complete your open-source research writing box, you need a powerful
image manipulation program to process your photos and to generate
figures from them. That's where
The Gimp comes
into play. With The
Gimp, you can process gel photos, crop the area that you like, obtain
negatives of your originals and add labels where you want,
all with a few mouse clicks.
Linux drawbacks
While this path can be rewarding, a significant effort will be required.
The first thing you need to do is to install a Linux
distribution. This might seem frightening to the newcomer,
but there are powerful Linux distributions such as Mandriva,
Fedora and Ubuntu which are very easy to install and have packaged
most of the tools mentioned it this article.
You also need to learn how to use new software. A few of the
applications mentioned above only have a command-line interface, but
most operations can be performed using GUI-based tools.
There is plenty of
documentation online, and you can always join an IRC
channel to get live help. In a short time, you will become very
functional, and you will reach new levels of productivity.
The worst drawback of using Linux in a Microsoft-based environment may
involve compatibility issues with your coworkers.
Since my
boss insists on working with .doc files, I have to convert my papers to
RTF using latex2rtf
before I send
him anything, even if PDF is the most portable format out there. But
this doesn't stop me from benefiting of the LaTeX functionality.
Finally, you must rely on the Internet for support. Most of the system
administrators in the research field don't know much about Linux (at
least not in Quebec, where I'm working) and won't be able to support
you if you have problems.
Linux superiority
Beside the fact that Linux and all this software is free, there are
many advantages in building an open-source research writing box.
Linux provides a robust environment that is a virtually virus-free.
Interoperability among applications is quite good,
all of the applications mentioned in
this article can share data through the LaTeX and EPS file formats.
With little experience, you will start working faster and more efficiently.
Serious page formatting issues found in Windows-based WYSIWYG software
will be gone.
Finally, you will be able to easily share your work by creating
high quality PDF files.
An example screenshot of my desktop publishing environment can be seen
here.
Comments (40 posted)
System Applications
Database Software
Version 5.1.5-alpha of the MySQL database has been released.
"
This is a new alpha development release, adding new features
and fixing recently discovered bugs."
Full Story (comments: none)
Trudy Pelzer
explains events under MySQL version 5.1.6.
"
In this article, I'll give a preliminary description of a new MySQL feature for scheduling and executing tasks. In version 5.1.6, MySQL has added support for events. That is, you can now say: "I want the MySQL server to execute this SQL statement every day at 9:30am, until the end of the year" -- or anything similar that involves any number of SQL statements, and a schedule.
Note that events are new and still in alpha, so there is still a good chance that we'll have to make adjustments as people experiment with them. This article describes the state of affairs only for the 5.1.6 release of MySQL."
Comments (5 posted)
Embedded Systems
Version 1.1.0 of
BusyBox, a compressed
collection of command line tools for embedded systems, has been released.
"
The new stable release is BusyBox 1.1.0. It has a number of improvements, including several new applets. (It also has a few rough spots, but we're trying out a "release early, release often" strategy to see how that works. Expect 1.1.1 sometime in March.)"
Comments (none posted)
Version 1.0.1 of
KLone,
a small embeddable web server, has been released.
LinuxDevices.com is also running
a review
of KLone.
(Thanks to Steven Dorigotti.)
Comments (none posted)
Web Site Development
Version 2.4 of Campsite, a multi-lingual content management system for news websites, is available.
"
Version 2.4 is a major feature release."
Full Story (comments: none)
Desktop Applications
Audio Applications
The initial version of SilentJack is available.
"
SilentJack is a silence/dead air detector for the Jack Audio
Connection Kit. It monitors the peak levels on a single JACK input
port, and checks to see if they are below a specified theshold.
SilentJack then runs a command after silence has been detected for a
given number of seconds. It then waits for the command the finish,
and waits for a grace period before detecting silence again."
Full Story (comments: none)
Version 0.9.0 of Sweep, a graphical audio file editor, is out.
This is the first release of a new unstable series, it includes a
switch to GTK2, improved mp3 capabilities, translation work, and more.
Full Story (comments: none)
Data Visualization
Version 1.62 of Gmsh, a 3D finite element grid generator,
has been announced.
"
This release adds a new option to draw color gradients in the background, an enhanced perspective projection mode, a new "lasso" selection mode, a new snapping grid when adding points in the GUI, a new extrusion syntax and nicer normal smoothing. This release also contains various small bug fixes and enhancements."
Comments (none posted)
Desktop Environments
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
KDE.News
covers the formation
of the KDE Technical Working Group. "
The first Technical Working
Group for KDE is now being formed, with elections due over the next few
weeks. The Group will help the hundreds of KDE contributors come to
technical decisions and smooth processes such as major releases. It will
also provide technical guidance to KDE contributors."
Comments (none posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
Desktop Publishing
Version 1.3.7 of LyX, a GUI front-end to the TeX typesetting system,
is out. Changes include support for the new file format 245 standard,
improvements to the Windows version and more.
Full Story (comments: none)
Electronics
Version 20060109 of
Covered,
a Verilog code coverage analysis tool, is available.
"
It has been almost a year since the last development release of Covered, but in the meantime there has been a lot of work put into the score command of Covered during this time to fix bugs, add more coverage support for various Verilog constructs, simulate more accurately, remove memory corruption/estrangement and improve the run-time speed of the score command. I think that user's of Covered will appreciate the enhancements. Documentation updates have been made and build problems have been fixed (Covered now compiles cleanly for Fedora Core 3 builds)."
Comments (none posted)
Version 2006-01-13 of
Kicad
an electronic printed circuit board CAD package,
is out with a bug fix and one new feature.
Comments (none posted)
GUI Packages
Release candidate 2 of pyFltk-1.1, a Python binding to FLTK 1.1,
has been announced.
"
This release candidate has been tested with fltk-1.1.6 and requires Python2.4."
Comments (none posted)
Version 3.0.12 of SPTK, the Simply Powerful ToolKit,
has been announced.
"
SPTK 3.0.12 adds support for the database driver messages. These messages may be sent to the driver by the database server on different occasions. These messages may include the extended error information, and the messages created by a stored procedure using (for MSSQL, for instance) PRINT statement."
Comments (none posted)
Mail Clients
Thunderbird 1.5 is out. Changes in this release include improvements to the automatic update system, smarter address auto-completion, on-the-fly spelling checking, better searching, some simple phishing detection (
covered here last October), the ability to delete attachments, and much more; see
the release notes for details. (As seen on
MozillaZine)
Comments (none posted)
Office Applications
Issue 11 of the
Beagle Newsletter has been published.
"
Beagle is a search tool that ransacks your personal information space to find whatever you're looking for. Beagle can search in many different domains."
Comments (none posted)
Version 4.2.5 of HylaFAX, a fax-modem utility,
has been announced.
"
The HylaFAX development team is pleased to announce our 4.2.5 patch level release! This fixes the problems users have been reporting in 4.2.4, which will be removed from the FTP and web sites. As always, our sincerest thanks go to all who participate and provide feedback."
Several security fixes are included in this release.
Comments (none posted)
Office Suites
Bob DuCharme
writes about the conversion of legacy documents to OO.o in an
O'Reilly xml.com article.
"
Like its Microsoft counterpart, OpenOffice has a macro language. You can start up OpenOffice from the Linux or Windows command-line prompt with instructions to to run a particular macro, and you can even pass a filename as a parameter to that macro. Adding the -invisible switch to the command line tells OpenOffice to start up without the graphical user interface (GUI). Put all these together, and you've got a command line that converts a Microsoft Office file to an OpenOffice file (or an Acrobat file) with no use of the GUI. To convert a hundred files, you can use a Perl script or other scripting language to create a batch file or shell script that has the hundred commands necessary to convert those files."
Comments (none posted)
Streaming Media
Version 0.10.2 of Gst-Python,
has been announced.
"
Gst-Python provides Python bindings for the GStreamer project. These bindings provide access to almost all of the GStreamer C API through an object oriented Python API.
This release allow fractions in structures and added vmethods for base classes. "
Comments (none posted)
Web Browsers
The minutes from the January 4, 2006 mozilla.org staff meeting
have been announced.
"
Issues discussed include Upcoming Releases,
Marketing, Thunderbird, 1.9 Roadmap, Firefox 2 Process and Calendar.
The mintues have been posted to the new mozilla.dev.general newsgroup, which is accessible via news.mozilla.org."
Comments (none posted)
Languages and Tools
Caml
The January 10-17, 2006 edition of the Caml Weekly News is out with
new Caml articles. Topics include: Pickling for OCaml?, Marching Tetrahedra
and A bunch of ocaml programs.
Full Story (comments: none)
Java
O'Reilly is running
an article on J2EE exception handling.
"
One common hassle in J2EE development is exception handling: many apps
devolve into a mess of inconsistent and unreliable handling of errors. In
this article, ShriKant Vashishtha introduces a strategy for predictably
collecting your exception handling in one place."
Comments (none posted)
Vladimir Silva
shows how to interface Java to the PAM system in an IBM developerWorks
article.
"
If you are a security developer and need to interface a Java application with the local operating system user registry, what do you do? This article gives you the answer: UNIX/Linux PAM (Pluggable Authentication Module)-compatible systems that use authentication based on the GNU MD5 extensions to the crypt() system call. I'll describe these extensions and show you a Java implementation of MD5 crypt (using FreeBSD as my UNIX)."
Comments (none posted)
Lisp
Version 2.37 of GNU CLISP, a Common Lisp implementation, is out.
"
This version adds new
options to SOCKET-SERVER, changes the way a proxy can be specified for
EXT:HTTP-PROXY, treats named pipes correctly, and fixes a few bugs."
Full Story (comments: 1)
The initial public release of HEUTE is available.
"
HEUTE (Hierarchical Extensible Unit Testing Environment for Common
LISP) is a unit testing framework written in Common Lisp. It features
a hierarchical approach to testing in which a test suite is
represented by a CLOS class, with subclasses corresponding to
sub-suites. A suite is considered passed only when its sub-suites
also pass."
Full Story (comments: none)
Perl
chromatic
looks at the motivation for designing Perl 6 in an O'Reilly article.
"
Perhaps the biggest imperfection of Perl 5 is its internals. Though much of the design is clever, there are also places of obsolescence and interdependence, as well as optimizations that no one remembers, but no one can delete without affecting too many other parts of the system. Refactoring an eleven-plus-year-old software project that runs on seventy-odd platforms and has to retain backwards compatibility with itself on many levels is daunting, and there are few people qualified to do it. It's also exceedingly difficult to recruit new people for such a task."
Comments (none posted)
PHP
Version 4.4.2 of
PHP has been announced.
"
This release address a few small security issues, and also corrects some regressions that occurred in PHP 4.4.1. All PHP 4 users are encouraged to upgrade to this release."
Also, development version 5.1.2 of PHP is out.
"This release combines small feature enhancements with a fair number of bug fixes and addresses three security issues."
Comments (none posted)
Python
Version 1.1 of
pyPdf,
a Python-based PDF toolkit, is out. Changes include a new page rotation
capability, Improved PDF reading support and PDF 1.5 support.
Comments (none posted)
The January 18, 2006 edition of Dr. Dobb's Python-URL! is online
with new Python articles and resources.
Full Story (comments: none)
Ruby
The January 15th, 2006 edition of the
Ruby Weekly News looks at the latest discussions
from the ruby-talk mailing list.
Comments (none posted)
Tcl/Tk
The January 17, 2006 edition of Dr. Dobb's Tcl-URL! is online
with the latest Tcl/Tk articles and resources.
Full Story (comments: none)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
OnLamp has published
a lengthy tome on open source as a purely economic phenomenon. "
An updated open source mentality has profound implications for businesses looking to leverage open source in commercial ventures. Reevaluating the open source equation in economic terms presents a different takeaway. The commoditization of software and a gradual, long-term reduction in price have played far more important roles than previously recognized. Business strategy designed to leverage open source should focus more on economies of scale (in terms of user and developer bases) and less on pleasing a mythical, monolithic community."
Comments (45 posted)
Groklaw
takes a
look at the
Open Source as
Prior Art Project. "
It's easier to want to have something crash
if you are not one of the likely first victims. The US patent system is
broken. Everyone knows it. It's a runaway train. And in my opinion, it's
heading toward FOSS, not because it should, but because some have SCO-like
desires to work the system to target it, to slow down Linux and FOSS
adoption. There haven't been enough trained USPTO examiners. And it's hard
for them to find prior art, for reasons I'll explain."
Comments (none posted)
Groklaw
takes a
look at some reactions to the draft GPLv3, and presents a chart
comparing v2 to v3. "
But if decent businesses want to use the code
-- and that is voluntary -- perhaps they need to consider being more
"freedom friendly" and realize that the GPL community is quite serious
about protecting users' and developers' freedoms, by protecting the code's
freedom. While many businesses are buying into the DRM, cuff-the-customer
balkanization strategy, the GPL stands for users and against the business
mentality of profit at *any* cost to anyone and anything."
Comments (6 posted)
Trade Shows and Conferences
O'Reilly has published
coverage of Steve Jobs' Macworld keynote.
"
When Apple CEO Steve Jobs delivers his Macworld keynote address, it is some of the best theatre you will ever see. This year, in a little over an hour and a half, he reported on Apple sales statistics, introduced the many changes in iLife '06, rushed past the lack of much in the way of improvements to the iWork suite, and introduced the new Intel-based iMac. Almost as an afterthought. he let the audience know that there was one more thing. Nearly 90 minutes into his talk he just casually mentions the PowerBook is being replaced by the Intel-powered MacBook Pro. Pure theatre."
Comments (25 posted)
LinuxWorld.com.au
looks
forward to linux.conf.au, coming up soon in New Zealand. "
Like
last year's conference in Canberra, the show will again play host to Free
and Open Source Software bigwigs including Andrew Tridgell of Samba fame,
Linux International's Jon "maddog" Hall, Ubuntu founder Mark Shuttleworth,
PHP founder Rasmus Lerdorf, and HP's CTO for Open Source and Linux, Bdale
Garbee."
Comments (none posted)
KDE.News has
this report from
the Osnabrueck IV Meeting. "
For the fourth consecutive year a group
of KDE PIM developers followed the gracious invitation of Intevation GmbH
to meet at their headquarters in Osnabrück, Germany on the first weekend in
January. As in the past years, the face-time proved very productive
especially since everyone felt that with KDE 4 the time for more
fundamental changes has come. By the end of the meeting the group had
agreed on a vision and initial architecture for a unified, extensible
storage service for PIM data and metadata, allowing all applications on the
desktop fast and reliable access as well as powerful search
capabilities. This service, codenamed "Akonadi", together with intiatives
like Plasma and Solid will form the basis of an exciting KDE 4
experience."
Comments (none posted)
Companies
eWeek
covers the
appointment of Christine Martino as HP's new VP for Open Source and Linux.
"
Asked what her immediate goals were for HP's open-source and Linux
division, Martino said she is not coming in with a plan to make big
strategy shifts, "as we already have the right strategy, which is borne out
by the fact that we have top market share and the success we have had with
customers," she said. "We offer them choice on the hardware side, a
multiple operating system strategy and a level playing field across all of
those, which works well.""
Comments (17 posted)
News.com
looks
into efforts by SWsoft to get OpenVZ into the Linux kernel. "
In
this, it has a major ally: Red Hat, the top seller of the open-source
operating system, which plans to add the software to its free Fedora
version of Linux for enthusiasts. The companies' move to make OpenVZ
partitioning standard in Linux is timely, said Pund-IT analyst Charles
King." (Thanks to Andrew Kornak)
Comments (none posted)
Business
Here's
a NewsForge report on the possibility that TurboCASH - a GPL-licensed but Windows-only small business accounting program - might move to Linux. "
The debates surrounding these decisions sum up the major problem that the new TurboCASH faces: its 20- year legacy is both its greatest asset and its main liability. For example, it's unlikely that a brand new project would have a debate over FreePascal/Lazarus or Python."
Comments (18 posted)
Linux Adoption
Bellevuelinux.org
presents
twenty-five reasons to switch to Linux. "
(10) Linux is highly
resistant to system crashes and rarely needs rebooting (i.e.,
restarting). This can be very important for large organizations for which
even a few minutes of down time can result in a substantial cost. The
reason is that Linux has been designed from the ground up to be an
extremely stable and robust operating system, incorporating all that has
been learned about attaining these goals from the more than 35 years of
history of Unix-like operating systems."
Comments (none posted)
Legal
Victor Yodaiken
discusses DRM issues in a Groklaw article.
"
We are entering the era of ubiquitous and safety critical computing, but the developers of DRM technologies seem to believe that computers are nothing more than personal entertainment systems for consumers. This belief is convenient, because creating DRM mechanisms that respect security, safety, and reliability concerns is going to be an expensive and complex engineering task."
Comments (none posted)
Here's
an Inquirer article on a company called SoftVault, which is suing a long list of companies for infringement of its DRM patents. If we weren't so opposed to software patents, we might be tempted to see this as a sort of poetic justice.
A look at SoftVault's web site is also instructive: "Access to software programs or digital content, or to a device, is enabled by periodic authorization messages, akin to a 'heartbeat,' exchanged between the server and client agents. As long as these periodic authorization messages continue to be exchanged, access is enabled. If for any reason the authorization messages are terminated, access is disabled. In the case of software or digital content, disabling may involve encrypting or deleting files.
In the case of a device, the disabling logic would essentially turn the device into a 'brick' that is unusable and therefore has no practical resale value."
Comments (5 posted)
Groklaw has
an
excerpt from
Math You Can't Use, a book on copyrights,
patents and software. "
The world of software engineering is in no
way restricted to software companies. Beyond Microsoft or thousands of
smaller software vendors, almost every corporation in the world keeps a
stable of programmers in the basement to write little scripts that move the
company's e-mail and make the "add to cart" button do what it should. I
am a programmer because I write simulations and statistical analyses. Even
you are a software programmer if you use the Record Macro feature of your
spreadsheet or word processor."
Comments (none posted)
Interviews
John Littler
talks
with Aaron J. Seigo about KDE 4. "
Recently at a Linux show, John
Littler saw a preview of a new version of KDE running on a KDE developer's
laptop. The interface looked cleaner than before, and apparently there was
a whole raft of new stuff under the hood. John recently interviewed KDE
developer Aaron J. Seigo about the forthcoming KDE 4 (due in the fall) and
also a little about the recent controversy surrounding the porting of KDE
to operating systems other than Linux."
Comments (none posted)
The People Behind KDE
talk with
Görkem Çetin, leader of KDE Turkey. "
How and when did you
get involved in KDE? I got my first KDE installation when it reached
version 0.3. After doing some translation for KDE in 1998, I took over the
Turkish translation team work and I have been the lead of this group for 7
years now. It was the time when Linux was referred as "multithreaded,
multiplatform, ..." etc. Sounds funny now." (Found on
KDE.News)
Comments (none posted)
Resources
Linux.com
slices and
dices text with awk. "
When it comes to slicing and dicing text,
few tools are as powerful, or as underutilized, as awk. The name "awk" was
coined from the initials of its authors, Aho, Weinberger, and Kernighan --
yes, the same Kernighan of the famous Kernighan and Ritchie "C Programming
Language" book. In the Linux world, every distribution includes the GNU
version, gawk (/bin/awk is usually a symbolic link to /bin/gawk). The GNU
version has a few more features than the original. Let's play with some of
the core features common among POSIX-compliant awks."
Comments (none posted)
Tom Lynema
assembles a Ubuntu-based Linux home media center.
"
Like a lot of people nowadays, I have a growing collection of digital media. My digital media is stored on a home Linux server. Most of the digital media players available today do not support protocols to connect to a Linux server, which make them unsuitable for my use. I realized the best way to connect my digital media library with my home theatre was to build my own Linux home media center (LHMC)."
Comments (12 posted)
Howto Forge presents
a tutorial on setting up Samba under Ubuntu 5.10.
"
This is a detailed description about the steps to set up a Ubuntu based server (Ubuntu 5.10 - Breezy Badger) to act as file- and print server for Windows (tm) workstations in small workgroups. This howto uses the tdb backend for SAMBA to store passwords and account information. This is suitable for workgroups for up to 250 users and is easier to setup than an LDAP backend."
Comments (none posted)
Ryan Mauer
introduces Xen
in a Linux Journal article.
"
In this article, I briefly introduce the concepts of Xen virtualization and Linux clustering. From there, I show you how to set up multiple operating systems on a single computer using Xen and how to configure them for use with clustering."
Comments (none posted)
Reviews
Nathan Willis
examines the recently released Google Talk software.
"
Last month, the Jabber Software Foundation (JSF) released documentation for two extensions to the Jabber (XMPP) protocol, named Jingle Signaling and Jingle Audio. On the same day, Google -- co-creators of the extensions -- released a BSD-style-licensed library called libjingle, the implementation of the extensions that powers the company's Google Talk software. In addition to opening the API used in Google Talk itself, both actions will benefit open source instant messaging clients and perhaps increase the pressure on closed systems like Skype."
Comments (1 posted)
Linux.com has
a review of Krita. "
[Boudewijn] Rempt's guidance has taken the project away from the 'GIMP for KDE' philosophy towards what he describes as a painting model -- namely, simulating the tools, materials, and work flow of a real-world artist, who creates a picture out of physical 'stuff' -- not pixels or shapes -- and puts 'gunk on his paper or canvas and generally pushes that around.'
For starters, this means drawing tools (pens, brushes, and paint) take center stage over the image adjustment tools (histograms, contrast controls, and masks) found in the GIMP. It also requires built-in pressure sensitivity and new ways to model color. The real difference, though, is conceptual. Eventually, Rempt wants Krita to simulate the experience of working with physical media, right down to mixing colors on the artist's palette."
Comments (none posted)
Ryan Mauer
continues
a look at Xen and clustering. "
We ended last time after configuring
our first unprivileged Xen domain. In this article, we complete our cluster
and then test it using an open-source parallel ray tracer. The first thing
we need to do is create additional slave nodes to be used with the
cluster. So, let's get down to business."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Apache Software Foundation has sent out a
a press release that highlights its accomplishments in 2005.
"
In addition to the Apache HTTP Server, recognized ASF projects include
Ant, Axis Web Services, Derby, Forrest, Geronimo, James, Lenya, Lucene, Maven,
mod_perl, MyFaces, Tomcat, SpamAssassin, Struts, Tapestry, and Xerces - from
the core basics to in-demand solutions such as scalable Internet
architectures, Cocoon, DB, Jakarta, and XML. All software developed within
the ASF is free to download, use, modify, and distribute under the Open Source
Apache License."
Comments (none posted)
Florian Mueller, founder of the NoSoftwarePatents.com Web site, tells us
that software patents are once again on the EU agenda. "
[Mueller]
believes that it is "imperative for our movement to influence the new
debate on the community patent on a timely basis, or else we would find it
hard, if not impossible, to stop the avalanche". In his opinion, it is "a
steep challenge" to ensure that a community patent law would simultaneously
address the issue of the EPO's patent granting practice, "because many
politicians believe that the community patent is an important measure from
a competitiveness point of view, and won't like the all-or-nothing notion
of having to solve two huge problems at one fell swoop". But, he adds,
"defining what is patentable would be needed to really make Europe more
competitive"."
Full Story (comments: 4)
Commercial announcements
Aheeva has announced a new version of their Asterisk-based IP Contact Center Software.
"
Aheeva CCS Version 2.0 is smarter IP contact center software, featuring
improved quality monitoring tools, enhanced statistical analysis and
tools to increase agent efficiency. Now supporting SugarCRM, a customer
relationship management solution, Version 2.0 remains a cost-effective
solution based on open source technology."
Full Story (comments: none)
EnterpriseDB
has announced
a new partner program.
"
EnterpriseDB, the worlds leading enterprise-class, open source database company, today launched a formal partner program that enables companies to incorporate the award-winning EnterpriseDB database into their business models. Via the new partner program, Technology Partners, including SugarCRM, JasperSoft, Continuent, and TenFold, will collaborate with EnterpriseDB to certify products with the EnterpriseDB database, Service Partners, including dbConcert, Fusion Technologies, Optaros and Buda Consulting will grow market opportunities by providing professional services supporting EnterpriseDB, and Business Partners, including Contegix, will offer EnterpriseDB as an integral component of solutions for end-user customers."
Comments (none posted)
Mandriva has announced a deal with HP wherein HP will offer systems
preloaded with Mandriva Linux throughout Latin America. "
The first pre-loaded
machines - one targeted to the consumer market and one for the
enterprise - are shipping in Brazil. HP and Mandriva have been
collaborating for several months to certify various system
configurations and optimize performance, as well as expand language
support. Technical support will be offered in both Spanish and
Portuguese for all of Latin America."
Full Story (comments: none)
Lattix, Inc. has announced the release of Lattix LDM for Eclipse.
"
With this new Eclipse plugin, Lattix further extends the
developers' capabilities to visualize and maintain the architecture during
application development by delivering the power of Lightweight Dependency
Models (LDM) to formalize, communicate and control the architecture of
Eclipse projects."
Full Story (comments: none)
The Linux Professional Institute will be offering discounted exams at the
IBM Software University event in Las Vegas, NV on January 19, 2006.
Full Story (comments: none)
MySQL AB
has announced the award of a five-year US government GSA contract.
"
More than 8 million active installations around the world employ MySQL, including thousands of federal, state, and local government organizations such as Los Alamos National Labs, U.S. Census Bureau, U.S. Geological Survey, NASA and the Department of Defense. MySQL database products are recognized for low cost-of-ownership (TCO), as well as superior ease of use, performance and reliability.
MySQL's inclusion on the GSA schedule is enabled by an agreement with Carahsoft Technology, a leading government IT solutions provider based in Reston, Virginia that represents a select group of top tier software and hardware manufacturers."
Comments (none posted)
Novell sent out a reaffirmation of its support for the
OpenDocument format.
"
Novell today reaffirmed its roadmap for
support of the OpenDocument file format in current and future Novell(r)
products, which reinforces Novell's commitment to open standards,
customer choice and flexibility. Novell has delivered OpenDocument
support in its SUSE(r) Linux distribution since March 2005. Novell will
deliver complete OpenDocument support in the next edition of its
enterprise desktop in 2006."
Full Story (comments: none)
Open-Xchange has announced the hiring of Daniel M. Kusnetzky as
the executive vice president of Marketing Strategy.
"
Kusnetzky, most recently vice president of IDC's System Software research,
was responsible for research and analysis on the worldwide market for
operating environments and virtualization software. Prior to his 11 years at
IDC, he spent 15 years with Digital Equipment Corporation, where he was
responsible for program and product management, and marketing in the areas of
client software, server software, and clustered and networked systems.
Kusnetzky appears regularly as a keynote speaker at industry trade shows and
is a noted expert on the open source industry."
Full Story (comments: none)
Penguin Computing has
announced the hiring of Pauline Nist as Senior Vice President of Product Development and Management.
"
Pauline, formerly Vice President of HP's Enterprise, Storage and Servers
business unit, brings over 20 years of in-depth experience in the high
performance computing (HPC) and enterprise markets to this new position."
Comments (none posted)
Linux International president Jon Hall will form a UnifiedRoot Advisory
Board.
"
UnifiedRoot, the company that has created a
new and simplified Internet addressing system for corporate and public
top-level domains (TLDs), has appointed Jon Hall, president of Linux
International, as a founding member of its advisory board. He will assist
UnifiedRoot in the expansion of the advisory board with the specific task of
addressing technical and policy issues."
Full Story (comments: none)
New Books
The book
Embedded Linux System Design and Development by
Amol Lad is available from Auerbach Publications.
Full Story (comments: none)
Pragmatic Bookshelf has published the book
Learn to Program
by Chris Pine.
Full Story (comments: none)
O'Reilly has published the book
Running Linux, Fifth Edition
by Matthias Kalle Dalheimer and Matt Welsh.
Full Story (comments: none)
O'Reilly has published the book
Understanding Linux Network Internals
by Christian Benvenuti.
Full Story (comments: none)
Resources
LinuxUser & Developer magazine has announced three new PDF
articles in the Audio Libre series.
Titles include FAVE raves - a new event for free software creativity,
The 64-bit question - 64 Studio distribution and
Snake dance - the Kamaelia streaming media system.
Full Story (comments: none)
A new issue of the Globus Consortium Journal has been announced.
"
The Globus Consortium (founded by IBM, HP, Sun, Intel, Nortel, Univa and
Cisco) today published the latest issue of the Globus Consortium Journal.
(http://www.globusconsortium.org/journal). The newsletter focuses on open
source Grid computing projects - and this month features developer interviews
with the leaders of the three most important services in the Globus Toolkit
(www.globustoolkit.org)."
Full Story (comments: none)
Contests and Awards
Performance Technologies has
announced
the naming of their NexusWare(TM) Linux-Based Software Suite as Product of
the Year by Internet Telephony Magazine. "
The NexusWare Software
Suite is a development, management and operating system environment which
enables users of Performance Technologies' hardware and platform products
to rapidly develop and deploy value-added capabilities with their
solutions. NexusWare was chosen as an INTERNET TELEPHONY Product of the
Year due to its strong embodiment of Linux and its ability to facilitate
the use of open-source software packages."
Comments (none posted)
Upcoming Events
The tenth plenary of the Austin Group meeting will be held in Ottawa, Canada
on February 21-24, 2006.
Full Story (comments: none)
The selection of papers for EUSecWest (London, U.K. February 20-21, 2006)
and a call for papers for CanSecWest (Vancouver, Canada April 3-7, 2006)
have been announced. CanSecWest papers are due by March 15, 2006.
Full Story (comments: none)
A
Call for Papers has gone out for
FrOSCon 2006.
The event will take place on June 24 and 25, 2006 near Bonn, Germany.
The Deadline for submission is March 15, 2006.
Comments (none posted)
A
call for papers
has gone out for the 2006 GCC and GNU Toolchain Developers' Summit.
The event will be held on June 28 - 30, 2006 in Ottawa, Canada.
Submissions are due by February 15, 2006.
Full Story (comments: none)
Groklaw
has announced a panel discussion that is being put on by the
Hamilton Linux User Group.
"
For those of you near Hamilton, Canada, or those who like to travel, here's some news of an event you might like to attend. Peter Salus, Bob Young, owner of the Hamilton Tiger-Cats, Lulu.com digital publishing, founder of The Center for the Public Domain, and co-founder of Red Hat Software, and EFF's Policy Coordinator, Americas, Ren Bucholz will be the guests at the Hamilton Linux User Group on February 1st. The topic of the panel discussion will be Linux v. SCO and the relevant freedom issues and legalities."
Comments (none posted)
A call for presenters has gone out for LinuxFest Northwest 2006.
The event will take place on April 29, 2006 in Bellingham Wash.
"
This is an annual, International grass roots event put on
by Lugs from the USA and Canada."
Full Story (comments: none)
A Call for Projects has gone out for
LinuxTag 2006.
The event takes place in Wiesbaden, Germany on May 3-6, 2006.
Projects are due by February 3.
Comments (none posted)
A LinuxTag 2006 call for help has been sent to the Linux Audio Users list.
The event will be held in Wiesbaden, Germany on May 3-6, 2006.
"
A booth at LinuxTag is a good opportunity to present Linux Audio to
the people, not only to developers but more to users. The crowd is
mostly industry (producers, technicians, musicians) at the weekdays
and home-recording-users at the weekend. Don't be afraid, there won't
be much questions about setting up drivers for consumer-cards (and If
there are, we usually send them to their distributions booth :-) ).
But there will be a lot people thinking about using your app in
studio! So you definitly don't want to miss this chance!"
Full Story (comments: none)
The Linux Professional Institute will be holding a discounted exam lab
at the daratechPLANT conference in Houston, Texas on January 23-25, 2006.
Full Story (comments: none)
A Call for Location has gone out for the 2006 OpenOffice.org Conference.
"
The first three OpenOffice.org conferences in Hamburg, Berlin
and Koper/Capodistria were a huge success. The highlight so
far was this year's conference which, for the first time, was
organized by a team of volunteer community members. Now we are
wondering if this outstanding event can actually be bettered.
Therefore, we are searching for the perfect location for the
OpenOffice.org Conference in 2006."
Full Story (comments: none)
Online registration for the next SELinux Symposium has been opened.
The event takes place on February 27 - March 3, 2006 in Baltimore, Md.
Full Story (comments: none)
TimeSys has announced a pair of educational webinars for
embedded Linux developers.
"
Each webinar will be led by a Linux development expert using
LinuxLink by TimeSys(TM), a continuously updated, Web-based
resource for embedded Linux development. Webinar hosts will
guide attendees through the process of creating a custom Linux
platform for an embedded development project targeting a
PowerPC or x86 processor..."
The events will take place on January 24 and 31, 2006.
Full Story (comments: none)
| Date | Event | Location |
| January 23 - 28, 2006 | linux.conf.au
2006 | Dunedin, New Zealand |
| January 23 - 25, 2006 | Black Hat Federal
Briefings and Training 2006 | (Sheraton Crystal City)Washington, D.C. |
| January 24 - 26, 2006 | O'Reilly
Emerging Telephony Conference | (San Francisco Airport Marriott)San Francisco,
CA |
| February 6 - 7, 2006 | ICMCC Conference on
EHR Standards and Interoperability | (World Forum Convention Center, The Hague)The
Netherlands |
| February 7 - 9, 2006 | OSCMS
Summit | Vancouver, BC, Canada |
| February 8 - 10, 2006 | X Developer's
Conference(XDevConf) | (Sun Campus)Santa Clara, CA |
| February 8 - 10, 2006 | LinuxAsia Conference and
Expo 2006 | (India Habitat Centre)New Delhi, India |
| February 10 - 12, 2006 | CodeCon
2006 | San Francisco, CA |
| February 10, 2006 | SCALE Workshop On
Open Standards For Government Organizations | (Airport Radisson)Los Angeles,
CA |
| February 11 - 12, 2006 | Southern California
Linux Expo(SCALE 4x) | (Airport Radisson)Los Angeles, California |
| February 20 - 21, 2006 | EuSecWest/core06
conference | London, England |
| February 24 - 26, 2006 | PyCon
2006 | (Dallas/Addison Marriott Quorum hotel)Addison, TX |
| February 25 - 26, 2006 | FOSDEM
2006 | (ULB Campus)Brussels, Belgium |
| February 26 - 28, 2006 | OSDC::Israel::2006 | (Netanya Academic College)Netanya,
Israel |
| February 27 - March 3, 2006 | SELinux
Symposium and Developer Summit | (Wyndham Hotel)Baltimore, MD |
| February 28 - March 3, 2006 | Black Hat Europe
Briefings and Training 2006 | (Grand Hotel Krasnapolsky)Amsterdam, the
Netherlands |
| March 3 - 4, 2006 | LinuxForum
2006 | Copenhagen, Denmark |
| March 6 - 9, 2006 | O'Reilly
Emerging Technology Conference(ETech) | (Manchester Grand Hyatt)San Diego, CA |
Comments (none posted)
Audio and Video programs
Tux Power! is a freely available music compilation from members of
Linuxaudio.org.
"
Linuxaudio.org has released its first compilation CD of music by artists
using libre software - Tux Power! Every single part of the CD was made
on Linux, including all the music, the mastering (with Jamin) and the
artwork (with Scribus)."
Full Story (comments: 6)
Page editor: Forrest Cook