Back in September, LWN ran
an
article about the FUSS project, which converted the entire computing
infrastructure for the Italian-speaking schools of Bolzano, Italy to Linux. When that
article was written, the FUSS staff had completed a major push to install
its own Debian-based distribution on over 2600 systems, but the true test -
the beginning of the school year - was still in the future. Now that the
new system has supported a few months of teaching, it seems like a good
time to go back and see how things went. Is Linux truly up to the task of
running a school system?
The FUSS organizers helpfully connected us with several teachers in the
affected schools. These people, in turn, graciously took time
out of their busy schedules to answer a long list of questions - and they
didn't even complain about your editor's difficult Italian. The answers
paint a picture of a not-entirely-smooth transition, but, in the end, the
system appears to be coming together. More importantly, the new system,
based on free software, would appear to have the strong support of the
people who must make use of it to get their jobs done.
School teachers everywhere tend to be busy people who are dedicated to
their work. So your editor did not expect to hear them praise the way free
software may have saved money for their central IT department or to talk
about the ethical aspects of free software. It seemed more likely that
these teachers would grumble about extra work, having to learn an
unfamiliar system, and the glitches which are inevitable with a transition
of this size. This expectation turned out to be only half correct.
There were indeed some complaints. Printing was at the top of
everybody's list; "cups" is indeed a four-letter word in Bolzano at the
moment. One teacher described its administration tools as "delirious."
Other peripheral devices - scanners, for example - were also problematic.
It's not just that there were problems, but that these problems often
required the intervention of the central FUSS staff (who received credit
for much hard work) to resolve. Many of the teachers do not see a
Linux-based network as something they can administer themselves. As one
middle school teacher expressed it:
The FUSS group has done a truly excellent job, they have been well
prepared and quick to come to the school to resolve problems, but
this is insufficient in the long term. The schools need somebody
who works just to keep the system running. If this work gets
dumped onto a teacher (who may lack, as in my case, a technical
background) the system will never work correctly.
(All quotes translated from Italian by your editor).
By most accounts, the key software - OpenOffice in particular - is working
well for both students and teachers. The big exception is documents with
macros; those macros must be rewritten to work on the new system.
When asked what they would most like to see improved, most teachers talked
about printers and related issues. There were also requests for better
ease of use in general, and an interface closer to Windows in particular.
A couple of teachers noted the relative scarcity of documentation in
Italian, and one complained that Linux was bloated and slow.
In the end, though, the transition appears to have been successful, and
most of the
teachers seem happy enough. Not one said that the schools should
go back to the previous, proprietary systems. And these teachers - some of
them at least - are beginning to see the advantages of free software.
Here's a few quotes from various teachers:
Naturally some things still need to be fixed, but we maintain that
the change is important at both technical and cultural levels. The
benefits are not just the savings, but the fact that it opens a way
of access to technology which is more honest and aware.
The biggest advantage is the fact that it is free (libero)
software. This has drawn a fair amount of interest from the
parents of our students. I teach in a middle school and our kids
are between 11 and 14 years old. They still don't really
understand what free software means, but their parents do.
I maintain that it's natural and obvious that the schools, as an
institution, should use free software. The sharing of knowledge,
the freedom of access to information, etc. should be at the base of
any instructional process. It seems to me that the philosophy of
free software rests on the same principles.
The fact that you're not tied to licensing problems lets you move
with a certain confidence; you're forever inspired to look for
something which works better, which is closer to your needs. It's
a great and beautiful thing.
Of course, not everybody is quite so pleased. As one instructor put it:
For a teacher there is no advantage [to Linux]; just problems using
documents produced with other software and only partially
recognized by free software (example: Excel and Word macros, which
I use heavily in my teaching work, must be reconstructed).
How do the students feel about it? As we know, children tend to be more
flexible, and, as a rule, they have smaller investments in old Word
macros. So they seem to have taken the change in stride. Some amusement
can be found in this
article (in Italian); one school opened up a forum where 9-year-olds
could post their impressions of the new systems. Here's a few:
Linux is cool it has programs which Windows doesn't have like
educational games...and it's also FREE (
GRATIS)
!!!!!!!!!!!!!
The names are changed and with Linux I have done well and there
have been some differences. And with Linux the CD's are free
(gratuiti). When is my CD arriving?
There's more things than we had last year. With Linux the programs
are free (liberi).
Changing the names of the programs gave me some trouble at the
beginning but now I'm starting to get used to it. The programs are
much better; there were good things in Paint but more good things
in tuxpaint! With regard to payments the fact that you don't have
to pay is beautiful. And being able to download it at home for
free is even more beautiful!
I think Linux is better than Ms Window because Linux is free
(gratuito) and it turns us into a community.
The theme should be clear by now.
As can be seen from these comments, the students are not yet, in
general, ready to think about where free software comes from and why it
exists. Don't expect any patches from the students in Bolzano in the near
future.
One of the goals of the Linux transition was to give each student a CD with
the software; that way, they could use the same tools at home and at the
school. At this point, however, it seems that, while some students are
using free software at home, most of them have not made that change. Part
of the problem here is that the promised live CD distribution has not yet
been made available. This CD is evidently ready to go, it's just waiting
for the obligatory launch press conference with the education minister.
Once this CD goes out (which could happen within a week), there may be more
students using Linux at home.
Another obvious question which comes up is: will other school systems
follow the FUSS project's example? Bolzano has two parallel school
systems: the Italian-speaking schools (which moved to Linux) and the
German-speaking schools (which did not). If any group of schools were
likely to be inspired by FUSS, one might expect it to be the
German-language schools of Bolzano. Views on whether that might happen
soon were varied, but a number of teachers noted that there is some free
software use in those schools now, and that the German-language schools
were certainly watching to see how things go. Most teachers seem to expect
that change to happen sooner or later.
Finally, your editor asked the teachers if there were anything they would
like to communicate to the free software development community as a whole.
The answers ranged from the short and simple ("Documentation, people,
documentation!") to the lengthy, but most shared the same theme. Thanks
for the work that you do, please continue and make it even better and
easier to use. Oh,
and, if you could, make the printers work please?
Comments (45 posted)
One almost has to pity the crowd of mainstream technical journalists who
clearly follow the linux-kernel mailing list with the hope of obtaining a
good Linus Torvalds quote to write an article around. Working through 300
incomprehensible messages every day is a serious chore - trust your editor
on this. But those reporters found their prize last week, when Linus
let it be known that he was not
much interested in adopting version 3 of the GPL for the kernel. A
quick search on Google News turns up dozens of resulting articles, mostly
with headlines like "No GPLv3 for Linux." That may well be how things turn
out, but there's a few things which should be taken into account when
making predictions about the future of Linux.
One of those is that there will be no GPLv3 at all for another year. What is
being circulated is a draft, and, if the Free Software Foundation is
responsive to comments at all, there are likely to be changes. There is
little point in debating the adoption of a license which does not exist,
which is why most kernel developers have stayed out of the current
discussion. While a certain ZDNet columnist engaged in a humorous
exercise in wishful thinking:
More infighting among the Linux stalwarts and the formation of
polarized factions will turn the Linux community into open source
software version of the Mideast - lots of talk, posturing, and
little progress.
The simple fact is that most developers are taking a quiet "wait and see"
approach for now. And, now or later, there seems to be little appetite for
a big licensing fight.
Another thing to keep in mind is that Linus can change his mind, even after
seemingly painting himself into a corner with an absolute statement. One
of your editor's favorite Linus pronouncements was issued almost exactly
seven years ago. In response to a query on how to set up an i386 box with
4GB of memory, Linus stated:
Oh, the answer is very simple: it's not going to happen.
EVER.
You need more that 32 bits of address space to handle that kind of
memory. This is not something I'm going to discuss further... This
is not negotiable.
Less than one year later, Ingo Molnar's high memory
patch was merged for 2.3.23. The lesson is clear: even when Linus says
"never," the right argument can change his mind. And, in fact, Linus has
left the door open to just that
possibility:
Quite frankly, _if_ we ever change to GPLv3, it's going to be because
somebody convinces me and other copyright holders to add the "or
any later license" to all files, just because v3 really is so much
better. It doesn't seem likely, but hey, if somebody shows that the
GPLv2 is unconstitutional (hah!), maybe something like that happens.
So I'm not _entirely_ dismissing an upgrade, but quite frankly, to
upgrade would be a huge issue. Not just I, but others that have
worked on Linux over the last five to ten years would have to agree
on it.
The door may not be open very far, but neither is it barred shut.
Then, there's the fact that, as Linus points out, it is not just his
decision. Much code in the kernel is explicitly licensed with the FSF's
recommended "or any later version" language; that code will be
distributable (separately from the kernel) under the GPLv3 in any case.
Relicensing the GPLv2-only code, however, would require the assent of every
developer who holds copyrights on that code. Given that copyrights in the
kernel are widely distributed and tracked by nobody, obtaining that
permission would be a significant challenge.
Or would it? Linus added the explicit GPLv2 language for the
2.4.0-test8 release. Another significant kernel contributor (Alan Cox)
is unconvinced that this language will get
in the way:
It isn't clear that this will be a problem. Very few people
specifically put their code v2 only, and Linus edit of the top
copying file was not done with permission of other copyright
holders anyway so really only affects his code if it is valid at
all.
If this view prevails, the number of copyright holders who would have to
agree to a relicensing would be much reduced, and the problem might just
become tractable.
The relicensing discussion is premature now, and it can be expected to fade
away. But it will certainly come
back. The anti-DRM provisions found in GPLv3 resonate strongly with many
developers, and, to many of those, said provisions only clarify a
requirement which, they believe, is already present in GPLv2. To these
developers, locking Linux into a DRM-equipped machine takes away the
freedom that the GPL promised in the first place and is an abuse of the
software they have contributed to the world. The opportunity to end that
abuse with a license change will be appealing; expect to see developers
pushing for that change after the license becomes official.
Linus, however, has made it clear
in the past that locking down systems with signed kernels is just fine
with him. He reiterated that point
recently:
I believe that hardware that limits what their users can do will
die just because being user-unfriendly is not a way to do
successful business. Yes, I'm a damned blue-eyed optimist, but I'd
rather be blue-eyed than consider all uses of security technology
to necessarily always be bad.
So blue-eyed Linus is unlikely to agree to a license change on the basis of the
anti-DRM provisions. But it is possible that other factors could
eventually bring about a change of heart (and license). For example, many
of the changes in GPLv3 are motivated by the requirements of legal systems
in various parts of the world; if GPLv2 turns out to be hard (or
impossible) to enforce somewhere, a shift to GPLv3 could become more
appealing. Such a change,
however, cannot occur before the license moves out of the comment period and
is adopted officially by the FSF. Until then, any predictions on whether
the kernel will ever shift to the GPLv3 should be taken with a grain of salt.
Comments (15 posted)
Last week's Rockbox review
was reasonably well received. Since then, however, a couple of things have
happened - one good, one less so - which make an update in order.
Starting with the good news: the iPod port can now produce audio on the
iPod Nano and 4G Color/Photo models. That means that there is now a
totally free (if still a bit bleeding edge) firmware offering for this
otherwise proprietary, DRM-equipped player. iPods running Rockbox will
have all of the features described last week, including a much wider
variety of codecs. The iPod Rockbox hackers have put a lot of work into
this port, and congratulations are in order.
Support for a full-color "while playing screen" has also been merged since
last week - a development which should reduce the number of people
complaining that the Rockbox interface is ugly.
The bad news relates to the voice menu support which makes Rockbox so
appealing to blind users (and some others as well). The best set of voices
provided for Rockbox, by many accounts, was generated with a copy of ATT
Natural Voices. Recently, the Rockbox developers got a friendly little
cease and desist notice from the folks at Wizzard Software, the company
which distributes that product in the U.S. By distributing the output from
this program, says Wizzard, Rockbox was violating the end user agreement
for the software.
So the ATT voices were pulled from the web site while the EULA was
examined; further research seems to bear out Wizzard's claim. The
licensing for that software is set up to require extra royalties if any
voice output is redistributed or used in a product. So that set of voices
is likely to be gone forever, and the developers are looking for
replacements.
Some efforts are afoot to generate a set of voice files the
old-fashioned way - by recording an actual human and editing the result.
Sort of like Tom Baker making
voice files for British Telecom. That is a labor-intensive way of
solving the problem, however, and keeping the voice files current in such a
fast-moving project involves quite a bit more labor. So an automated means
for generating high-quality voice files would be a welcome contribution to
the project. Perhaps a Festival expert
would like to help them out?
Comments (13 posted)
Page editor: Jonathan Corbet
Security
Your editor recently found a bit of security advice in his mailbox:
A calm, reasoned, policy-based approach that covers all possible
threats is what is needed to ensure that a company's corporate
servers and workstations are protected.
This advice showed up in a message with a
subject line reading "IMAGE
YOUR SYSTEM NOW BEFORE THE KAMA SUTRA WORM HITS." It's a good thing these
folks (a company called Acronis, which will happily sell you the tools to
"image your system") are so calm and reasoned; it might not be fun to be
around if
they were to go into a panic.
Linux users, of course, remain blissfully unaware of the "Kama Sutra" worm
(or "BlackWorm"). At most, it manifests itself as a couple of "give me a
kiss" emails which SpamAssassin quickly learns to kiss off by itself.
Those who work with Windows, however, may well find themselves more aware
of this worm in the near future.
Kama Sutra/BlackWorm, like so many others, spreads via email attachments.
It does
have a couple of interesting features, however. One is that it goes out of
its way to disable antivirus systems on infected systems, making those
systems susceptible to other bits of roving malware which might wander by.
And, on February 3, it will attempt to destroy files on infected
systems. Anybody who is not aware of being infected is likely to find out
fairly abruptly at that point.
Estimates of the number of infected systems run as high as 600,000 as of
January 31. Most of those systems are in the U.S., India, and,
interestingly, Peru; see this page for
details. If you would like more information on this worm, including Snort
signatures for blocking it, see the ISC BlackWorm
page. And, for now, be glad you are running Linux.
Comments (2 posted)
New vulnerabilities
drupal: several vulnerabilities
| Package(s): | drupal |
CVE #(s): | CVE-2005-3973
CVE-2005-3974
CVE-2005-3975
|
| Created: | January 27, 2006 |
Updated: | February 1, 2006 |
| Description: |
Several security related problems have been discovered in drupal, a
fully-featured content management/discussion engine. Several cross-site
scripting vulnerabilities allow remote attackers to inject arbitrary web
script or HTML (CVE-2005-3973). When running on PHP5, Drupal does not
correctly enforce user privileges, which allows remote attackers to bypass
the "access user profiles" permission (CVE-2005-3974). An interpretation
conflict allows remote authenticated users to inject arbitrary web script
or HTML via HTML in a file with a GIF or JPEG file extension
(CVE-2005-3975). |
| Alerts: |
|
Comments (none posted)
gallery: cross-site scripting vulnerability
| Package(s): | gallery |
CVE #(s): | |
| Created: | January 26, 2006 |
Updated: | February 1, 2006 |
| Description: |
Gallery, a web-based photo management system, has an input sanitizing
problem with the user's fullname. An attacker can create a specially
crafted fullname and inject script code into a victim's browser window
in order to compromise the user's gallery. |
| Alerts: |
|
Comments (2 posted)
LibAST: privilege escalation
| Package(s): | libast |
CVE #(s): | CVE-2006-0224
|
| Created: | January 30, 2006 |
Updated: | February 15, 2006 |
| Description: |
Michael Jennings discovered an exploitable buffer overflow in the
configuration engine of LibAST. The vulnerability can be exploited to gain
escalated privileges if the application using LibAST is setuid/setgid and
passes a specifically crafted filename to LibAST's configuration engine. |
| Alerts: |
|
Comments (none posted)
libmail-audit-perl: insecure temporary file creation
| Package(s): | libmail-audit-perl |
CVE #(s): | CVE-2005-4536
|
| Created: | January 31, 2006 |
Updated: | March 20, 2006 |
| Description: |
Niko Tyni discovered that the Mail::Audit module, a Perl library for
creating simple mail filters, logs to a temporary file with a predictable
filename in an insecure fashion when logging is turned on. |
| Alerts: |
|
Comments (none posted)
lsh-utils: local file descriptor leak
| Package(s): | lsh-utils |
CVE #(s): | CVE-2006-0353
|
| Created: | January 26, 2006 |
Updated: | February 1, 2006 |
| Description: |
The lshd SSH2 protocol server has a file descriptor leak.
User shells started by lshd can access randomness generator file descriptors, allowing the server seed file to be truncated.
A denial of service is possible, and session keys may become
vulnerable to cracking. |
| Alerts: |
|
Comments (none posted)
mydns: denial of service
| Package(s): | mydns |
CVE #(s): | CVE-2006-0351
|
| Created: | January 31, 2006 |
Updated: | February 2, 2006 |
| Description: |
MyDNS contains an unspecified flaw that may allow a remote denial of
service. An attacker could cause a denial of service by sending malformed
DNS queries to the MyDNS server. |
| Alerts: |
|
Comments (none posted)
nfs-server: buffer overflow
| Package(s): | nfs-server |
CVE #(s): | CVE-2006-0043
|
| Created: | January 26, 2006 |
Updated: | February 15, 2006 |
| Description: |
The obsoleted nfs-server package has a remotely exploitable buffer overflow
vulnerability in the rpc.mountd service's realpath() function.
Remote attackers can launch a specially crafted mount request,
this leads to a buffer overflow and allows the execution of code
with root privileges. |
| Alerts: |
|
Comments (none posted)
Paros: default administrator password
| Package(s): | paros |
CVE #(s): | CVE-2005-3280
|
| Created: | January 30, 2006 |
Updated: | February 1, 2006 |
| Description: |
Andrew Christensen discovered that in older versions of Paros the database
component HSQLDB is installed with an empty password for the database
administrator "sa". Since the database listens globally by default, an
attacker can connect and issue arbitrary commands, including execution of
binaries installed on the host. |
| Alerts: |
|
Comments (none posted)
mozilla-thunderbird: GUI display truncation vulnerability
| Package(s): | mozilla-thunderbird |
CVE #(s): | CVE-2006-0236
|
| Created: | January 26, 2006 |
Updated: | February 1, 2006 |
| Description: |
Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 have a GUI display truncation vulnerability. A user can be tricked into downloading a maliciously
created attachment with a hidden filename extension and potentially
execute the dangerous payload. |
| Alerts: |
|
Comments (none posted)
trac: cross-site scripting vulnerability
| Package(s): | trac |
CVE #(s): | CVE-2005-4305
|
| Created: | January 26, 2006 |
Updated: | February 1, 2006 |
| Description: |
Trac, a web-based project management and bug
tracking system, has a
cross-site scripting attack vulnerability that may be exploited
for the purpose of execution of
arbitrary JavaScript code. |
| Alerts: |
|
Comments (1 posted)
unalz: arbitrary code execution
| Package(s): | unalz |
CVE #(s): | CVE-2005-3862
|
| Created: | January 30, 2006 |
Updated: | February 1, 2006 |
| Description: |
Ulf Härnhammer from the Debian Audit Project discovered that unalz, a
decompressor for ALZ archives, performs insufficient bounds checking
when parsing file names. This can lead to arbitrary code execution if
an attacker provides a crafted ALZ archive. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2005-3352
|
| Created: | December 14, 2005 |
Updated: | May 10, 2006 |
| Description: |
Versions 1 and 2 of the apache web server suffer from a cross-site scripting vulnerability in the mod_imap module; see this bugzilla entry for details. |
| Alerts: |
|
Comments (none posted)
auth_ldap: format string vulnerability
| Package(s): | auth_ldap |
CVE #(s): | CVE-2006-0150
|
| Created: | January 10, 2006 |
Updated: | February 28, 2006 |
| Description: |
The auth_ldap package is an httpd module that allows user authentication
against information stored in an LDAP database. A format string flaw was
found in the way auth_ldap logs information. It may be possible for a
remote attacker to execute arbitrary code as the 'apache' user if auth_ldap
is used for user authentication. |
| Alerts: |
|
Comments (none posted)
blender: integer overflow
| Package(s): | blender |
CVE #(s): | CVE-2005-4470
|
| Created: | January 6, 2006 |
Updated: | June 15, 2006 |
| Description: |
Damian Put discovered that Blender did not properly validate a 'length'
value in .blend files. Negative values led to an insufficiently sized
memory allocation. By tricking a user into opening a specially crafted
.blend file, this could be exploited to execute arbitrary code with the
privileges of the Blender user. |
| Alerts: |
|
Comments (none posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
ktools: buffer overflow
| Package(s): | centericq |
CVE #(s): | CVE-2005-3863
|
| Created: | December 7, 2005 |
Updated: | August 29, 2006 |
| Description: |
From the Debian-Testing alert: Mehdi Oudad "deepfear" and Kevin Fernandez "Siegfried" from the Zone-H
Research Team discovered a buffer overflow in kkstrtext.h of the ktools
library, which is included in (at least) centericq and motor. |
| Alerts: |
|
Comments (none posted)
ClamAV: arbitrary code execution
| Package(s): | clamav |
CVE #(s): | CVE-2006-0162
|
| Created: | January 13, 2006 |
Updated: | January 25, 2006 |
| Description: |
A vulnerability in ClamAV v0.80 through
0.87.1, allows remote attackers to execute arbitrary code on vulnerable
ClamAV installations. Authentication is not required to exploit this
vulnerability. |
| Alerts: |
|
Comments (none posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
crawl: insecure program execution
| Package(s): | crawl |
CVE #(s): | |
| Created: | January 23, 2006 |
Updated: | January 25, 2006 |
| Description: |
Steve Kemp from the Debian Security Audit project discovered a
security related problem in crawl, another console based dungeon
exploration game in the vein of nethack and rogue. The program
executes commands insecurely when saving or loading games which can
allow local attackers to gain group games privileges. |
| Alerts: |
|
Comments (none posted)
curl: buffer overflow
| Package(s): | curl |
CVE #(s): | CVE-2005-4077
|
| Created: | December 8, 2005 |
Updated: | March 27, 2006 |
| Description: |
The curl file transfer utility has a buffer overflow vulnerability
in the URL authentication code. If an overly long URL is used,
a buffer overflow can result, allowing for local unauthorized access. |
| Alerts: |
|
Comments (none posted)
cyrus-imapd: buffer overflows
| Package(s): | cyrus-imapd |
CVE #(s): | CAN-2005-0546
|
| Created: | February 23, 2005 |
Updated: | April 10, 2006 |
| Description: |
Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system. |
| Alerts: |
|
Comments (none posted)
dia: missing input sanitizing
| Package(s): | dia |
CVE #(s): | CAN-2005-2966
|
| Created: | October 4, 2005 |
Updated: | April 6, 2006 |
| Description: |
Joxean Koret discovered that the SVG import plugin did not properly
sanitize data read from an SVG file. By tricking an user into opening
a specially crafted SVG file, an attacker could exploit this to
execute arbitrary code with the privileges of the user. |
| Alerts: |
|
Comments (none posted)
emacs21: format string vulnerability in "movemail"
| Package(s): | emacs21 |
CVE #(s): | CAN-2005-0100
|
| Created: | February 7, 2005 |
Updated: | May 15, 2006 |
| Description: |
Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could be exploited to
execute arbitrary code with the privileges of the user and the "mail"
group. |
| Alerts: |
|
Comments (none posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
evolution: format string issues
Comments (2 posted)
fetchmail: multidrop bug
| Package(s): | fetchmail |
CVE #(s): | CVE-2005-4348
|
| Created: | December 20, 2005 |
Updated: | May 27, 2006 |
| Description: |
Fetchmail contains a bug which allows a malicious mail server to crash the
client by sending a message without headers. This occurs when running in
multidrop mode. |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflow
| Package(s): | ffmpeg |
CVE #(s): | CVE-2005-4048
|
| Created: | December 15, 2005 |
Updated: | March 17, 2006 |
| Description: |
The avcodec_default_get_buffer() function of the ffmpeg library
has a buffer overflow vulnerability. A user can be tricked into
playing a maliciously created PNG movie, allowing the attacker to
run arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
firefox: multiple vulnerabilities
Comments (none posted)
flyspray: missing input sanitizing
| Package(s): | flyspray |
CVE #(s): | CVE-2005-3334
|
| Created: | January 24, 2006 |
Updated: | January 25, 2006 |
| Description: |
Several cross-site scripting vulnerabilities have been discovered in
flyspray, a lightweight bug tracking system, which allows attackers to
insert arbitrary script code into the index page. |
| Alerts: |
|
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow
| Package(s): | gaim |
CVE #(s): | CAN-2005-2103
|
| Created: | August 10, 2005 |
Updated: | February 27, 2006 |
| Description: |
Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
gdb: multiple vulnerabilities
| Package(s): | gdb |
CVE #(s): | CAN-2005-1704
CAN-2005-1705
|
| Created: | May 20, 2005 |
Updated: | August 11, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer
overflow in the BFD library, resulting in a heap overflow. A review also
showed that by default, gdb insecurely sources initialization files from
the working directory. Successful exploitation would result in the
execution of arbitrary code on loading a specially crafted object file or
the execution of arbitrary commands. |
| Alerts: |
|
Comments (5 posted)
gdk-pixbuf: multiple vulnerabilities
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CVE-2005-3186
CVE-2005-2976
CVE-2005-2975
|
| Created: | November 15, 2005 |
Updated: | March 20, 2006 |
| Description: |
The gdk-pixbuf package contains an image loading library used with the
GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM file
in such a way that it could cause an application linked with gdk-pixbuf to
execute arbitrary code when the file was opened by a victim.
Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM
file in such a way that it could cause an application linked with
gdk-pixbuf to execute arbitrary code or crash when the file was opened by a
victim.
Ludwig Nussel also discovered an infinite-loop denial of service bug in the
way gdk-pixbuf processes XPM images. An attacker could create a carefully
crafted XPM file in such a way that it could cause an application linked
with gdk-pixbuf to stop responding when the file was opened by a victim. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gzip: arbitrary command execution
| Package(s): | gzip |
CVE #(s): | CAN-2005-0758
|
| Created: | August 1, 2005 |
Updated: | January 10, 2007 |
| Description: |
zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|'
and '&' properly when they occurred in input file names. This could be
exploited to execute arbitrary commands with user privileges if zgrep is
run in an untrusted directory with specially crafted file names. |
| Alerts: |
|
Comments (2 posted)
imagemagick: arbitrary command execution
| Package(s): | imagemagick |
CVE #(s): | CVE-2005-4601
CVE-2006-0082
|
| Created: | January 24, 2006 |
Updated: | March 24, 2006 |
| Description: |
Florian Weimer discovered that the delegate code did not correctly
handle file names which embed shell commands (CVE-2005-4601). Daniel
Kobras found a format string vulnerability in the SetImageInfo()
function (CVE-2006-0082). By tricking a user into processing an image
file with a specially crafted file name, these two vulnerabilities
could be exploited to execute arbitrary commands with the user's
privileges. These vulnerability become particularly critical if
malicious images are sent as email attachments and the email client
uses imagemagick to convert/display the images (e. g. Thunderbird and
Gnus). |
| Alerts: |
|
Comments (none posted)
imap: buffer overflow in c-client
| Package(s): | imap |
CVE #(s): | CAN-2003-0297
|
| Created: | February 18, 2005 |
Updated: | April 10, 2006 |
| Description: |
A buffer overflow flaw was found in the c-client IMAP client. An attacker
could create a malicious IMAP server that if connected to by a victim could
execute arbitrary code on the client machine. |
| Alerts: |
|
Comments (none posted)
ipsec-tools: denial of service
| Package(s): | ipsec-tools |
CVE #(s): | CVE-2005-3732
|
| Created: | December 1, 2005 |
Updated: | June 8, 2006 |
| Description: |
ipsec-tools has a remote
denial of service vulnerability in the racoon daemon.
If racoon is running in aggressive mode, it fails to check all peer
payloads during
When the daemon the IKE negotiation phase, allowing a malicious peer
to crash the daemon. One should always be careful around aggressive racoons. |
| Alerts: |
|
Comments (none posted)
kdebase: local root vulnerability
| Package(s): | kdebase |
CVE #(s): | CAN-2005-2494
|
| Created: | September 7, 2005 |
Updated: | August 11, 2006 |
| Description: |
The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
kdelibs: heap overflow
| Package(s): | kdelibs |
CVE #(s): | CVE-2006-0019
|
| Created: | January 19, 2006 |
Updated: | March 17, 2006 |
| Description: |
Konqueror's kjs JavaScript interpreter engine has a heap overflow
vulnerability. Specially crafted JavaScript code could be placed on
a web site, leading to arbitrary code execution.
Other kde applications are also subject to this vulnerability. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kernel: multiple vulnerabilities
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-3356
CVE-2005-4605
CVE-2005-4618
CVE-2005-4639
CVE-2006-0095
CVE-2006-0096
|
| Created: | January 18, 2006 |
Updated: | March 7, 2006 |
| Description: |
The latest set of kernel vulnerabilities includes:
- A reference counting bug in sys_mq_open(), exploitable by a local user to crash the kernel. (CVE-2005-3356)
- A misuse of signed data types in /proc, potentially providing read access to random kernel memory. (CVE-2005-4605)
- An off-by-one error in sysctl(), with the potential for arbitrary code execution. (CVE-2005-4618)
- A buffer overflow in the TwinHan DST
Frontend/Card DVB driver; potential code execution. (CVE-2005-4639)
- A potential key disclosure in dm-crypt. (CVE-2006-0095)
- Missing capability check could (maybe) allow arbitrary users to load new firmware into SDLA WAN cards. (CVE-2006-0096)
|
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-2709
CVE-2005-2973
CVE-2005-3055
CVE-2005-3180
CVE-2005-3271
CVE-2005-3272
CVE-2005-3273
CVE-2005-3274
CVE-2005-3275
CVE-2005-3276
|
| Created: | November 22, 2005 |
Updated: | March 15, 2006 |
| Description: |
Al Viro discovered a race condition in the /proc file handler of
network devices. A local attacker could exploit this by opening any
file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that
interface was shut down. Under certain circumstances this could lead
to a kernel crash or even arbitrary code execution with full kernel
privileges. (CVE-2005-2709)
Tetsuo Handa discovered a local Denial of Service vulnerability in the
udp_v6_get_port() function. On computers which use IPv6, a local
attacker could exploit this to trigger an infinite loop in the kernel.
(CVE-2005-2973)
Harald Welte discovered a Denial of Service vulnerability in the USB
devio driver. A local attacker could exploit this by sending an "USB
Request Block" (URB) and terminating the sending process before the
arrival of the answer, which left an invalid pointer and caused a
kernel crash. (CVE-2005-3055)
Pavel Roskin discovered an information leak in the Orinoco wireless
card driver. When increasing the buffer length for storing data, the
buffer was not padded with zeros, which exposed a random part of the
system memory to the user. (CVE-2005-3180)
A resource leak has been discovered in the handling of POSIX timers in
the exec() function. This could be exploited to a Denial of Service
attack by a group of local users. (CVE-2005-3271)
Stephen Hemminger discovered a weakness in the network bridge driver.
Packets which had already been dropped by the packet filter could
poison the forwarding table, which could be exploited to make the
bridge forward spoofed packages. (CVE-2005-3272)
David S. Miller discovered a buffer overflow in the rose_rt_ioctl()
function. By calling the function with a large "ngidis" argument, a
local attacker could cause a kernel crash. (CVE-2005-3273)
Neil Horman discovered a race condition in the connection timer
handling. This allowed a local attacker to set up an expiration
handler which modified the connection list while the list still being
traversed, which could result in a kernel crash. This vulnerability
only affects multiprocessor (SMP) systems. (CVE-2005-3274)
Patrick McHardy noticed a logic error in the network address
translation (NAT) connection tracker. A remote attacker could exploit
this by causing two packets for the same protocol to be NATed at the
same time, which resulted in a kernel crash. (CVE-2005-3275)
Paolo Giarrusso discovered an information leak in the
sys_get_thread_area(). The returned structure was not properly
cleared, which exposed a small amount of kernel memory to userspace
programs. This could possibly expose confidential data.
(CVE-2005-3276) |
| Alerts: |
|
Comments (2 posted)
kernel multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-3527
CVE-2005-3783
CVE-2005-3784
CVE-2005-3805
CVE-2005-3806
CVE-2005-3808
|
| Created: | January 20, 2006 |
Updated: | April 18, 2006 |
| Description: |
Here's another set of vulnerabilities in the Linux kernel:
- A race condition in the 2.6 kernel could allow a local user to cause a
DoS by triggering a core dump in one thread while another thread has a
pending SIGSTOP (CVE-2005-3527).
- The ptrace functionality in 2.6 kernels prior to 2.6.14.2, using
CLONE_THREAD, does not use the thread group ID to check whether it is
attaching to itself, which could allow local users to cause a DoS
(CVE-2005-3783).
- The auto-reap child process in 2.6 kernels prior to 2.6.15 include
processes with ptrace attached, which leads to a dangling ptrace
reference and allows local users to cause a crash (CVE-2005-3784).
- A locking problem in the POSIX timer cleanup handling on exit on
kernels 2.6.10 to 2.6.14 when running on SMP systems, allows a local
user to cause a deadlock involving process CPU timers (CVE-2005-3805).
- The IPv6 flowlabel handling code in 2.4 and 2.6 kernels prior to
2.4.32 and 2.6.14 modifies the wrong variable in certain circumstances,
which allows local users to corrupt kernel memory or cause a crash by
triggering a free of non-allocated memory (CVE-2005-3806).
- An integer overflow in 2.6.14 and earlier could allow a local user to
cause a hang via 64-bit mmap calls that are not properly handled on a
32-bit system (CVE-2005-3808).
|
| Alerts: |
|
Comments (none posted)
libconvert-uulib-perl: arbitrary code execution
| Package(s): | libconvert-uulib-perl |
CVE #(s): | CAN-2005-1349
|
| Created: | May 20, 2005 |
Updated: | January 27, 2006 |
| Description: |
Mark Martinec and Robert Lewis discovered a buffer overflow in
Convert::UUlib (before 1.051), a Perl interface to the uulib library, which
may result in the execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libdbi-perl: insecure temporary file
| Package(s): | libdbi-perl |
CVE #(s): | CAN-2005-0077
|
| Created: | January 25, 2005 |
Updated: | March 2, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Project
discovered that the DBI library, the Perl5 database interface, creates
a temporary PID file in an insecure manner. This can be exploited by a
malicious user to overwrite arbitrary files owned by the person
executing the parts of the library. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libnet-ssleay-perl: weakened cryptographic operations
| Package(s): | libnet-ssleay-perl |
CVE #(s): | CAN-2005-0106
|
| Created: | May 3, 2005 |
Updated: | January 27, 2006 |
| Description: |
Javier Fernandez-Sanguino Pena discovered that this library used the
file /tmp/entropy as a fallback entropy source if a proper source was
not set in the environment variable EGD_PATH. This can potentially
lead to weakened cryptographic operations if an attacker provides a
/tmp/entropy file with known content. |
| Alerts: |
|
Comments (none posted)
libpam-ldap: authentication bypass
| Package(s): | libpam-ldap |
CVE #(s): | CAN-2005-2641
|
| Created: | August 25, 2005 |
Updated: | October 6, 2006 |
| Description: |
libpam-ldap, the PAM LDAP interface, has a vulnerability in which
it fails to authenticate with an LDAP server which is not configured
properly, allowing an authentication bypass. |
| Alerts: |
|
Comments (none posted)
libTIFF: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2005-1544
|
| Created: | May 10, 2005 |
Updated: | February 18, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
stack based buffer overflow in the libTIFF library when reading a TIFF
image with a malformed BitsPerSample tag. Successful exploitation would
require the victim to open a specially crafted TIFF image, resulting in the
execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libungif: memory corruption
| Package(s): | libungif |
CVE #(s): | CAN-2005-2974
|
| Created: | November 3, 2005 |
Updated: | March 20, 2006 |
| Description: |
The libungif library has a vulnerability in the GIF file
colormap handling code. A maliciously crafted GIF file can
cause out of bounds memory writing and register corruption. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libXpm: new buffer overflows
| Package(s): | libXpm |
CVE #(s): | CAN-2005-0605
|
| Created: | March 4, 2005 |
Updated: | March 8, 2006 |
| Description: |
A new vulnerability has been discovered in libXpm, which is included in
OpenMotif and LessTif, that can potentially lead to remote code
execution. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mailman: denial of service
| Package(s): | mailman |
CVE #(s): | CVE-2005-3573
|
| Created: | December 2, 2005 |
Updated: | March 8, 2006 |
| Description: |
Scrubber.py in Mailman 2.1.4 - 2.1.6 does not properly handle UTF8
character encodings in filenames of e-mail attachments, which allows
remote attackers to cause a denial of service. |
| Alerts: |
|
Comments (none posted)
mod_auth_pgsql: format string flaws
| Package(s): | mod_auth_pgsql |
CVE #(s): | CVE-2005-3656
|
| Created: | January 6, 2006 |
Updated: | February 28, 2006 |
| Description: |
The mod_auth_pgsql package is an httpd module that allows user
authentication against information stored in a PostgreSQL database.
Several format string flaws were found in the way mod_auth_pgsql logs
information. It may be possible for a remote attacker to execute arbitrary
code as the 'apache' user if mod_auth_pgsql is used for user
authentication. |
| Alerts: |
|
Comments (none posted)
mod_python: remote access vulnerability
| Package(s): | mod_python |
CVE #(s): | CAN-2005-0088
|
| Created: | February 10, 2005 |
Updated: | April 10, 2006 |
| Description: |
mod_python has a vulnerability in the publisher handler that may allow
a remote user to use a specially crafted URL to allow access to
objects that should be protected. An information leak can result. |
| Alerts: |
|
Comments (none posted)
mysql: low-impact security fix
| Package(s): | mysql |
CVE #(s): | CAN-2005-1636
|
| Created: | July 20, 2005 |
Updated: | February 22, 2006 |
| Description: |
An update to MySQL version 4.1.12 fixes a low-impact security
problem (bz#158689). |
| Alerts: |
|
Comments (1 posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | January 6, 2006 |
Updated: | March 7, 2011 |
| Description: |
Kurt Fitzner discovered that the NBD (network block device) server did not
correctly verify the maximum size of request packets. By sending specially
crafted large request packets, a remote attacker who is allowed to access
the server could exploit this to execute arbitrary code with root
privileges. |
| Alerts: |
|
Comments (none posted)
ncpfs: multiple vulnerabilities
| Package(s): | ncpfs |
CVE #(s): | CAN-2005-0013
CAN-2005-0014
|
| Created: | January 31, 2005 |
Updated: | May 15, 2006 |
| Description: |
Erik Sjolund discovered two vulnerabilities in the programs bundled
with ncpfs: there is a potentially exploitable buffer overflow in
ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities
using the NetWare client functions insecurely access files with
elevated privileges (CAN-2005-0013). |
| Alerts: |
|
Comments (none posted)
nfs-utils: arbitrary code execution
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-0946
|
| Created: | January 11, 2005 |
Updated: | February 27, 2006 |
| Description: |
Arjan van de Ven discovered a buffer overflow in rquotad on 64bit
architectures; an improper integer conversion could lead to a buffer
overflow. An attacker with access to an NFS share could send a specially
crafted request which could then lead to the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
ntp: uses wrong gid
| Package(s): | ntp |
CVE #(s): | CAN-2005-2496
|
| Created: | August 26, 2005 |
Updated: | August 11, 2006 |
| Description: |
When starting xntpd with the -u option and specifying the
group by using a string not a numeric gid the daemon uses
the gid of the user not the group. This problem is now fixed
by this update. |
| Alerts: |
|
Comments (none posted)
openmotif: buffer overflows
| Package(s): | openmotif |
CVE #(s): | CVE-2005-3964
|
| Created: | December 29, 2005 |
Updated: | July 27, 2006 |
| Description: |
The libUil component of the OpenMotif toolkit has a pair of buffer
overflow vulnerabilities that can possibly be used for the execution
of arbitrary code.
|
| Alerts: |
|
Comments (none posted)
openssh: GSSAPI credential disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2005-2798
|
| Created: | September 7, 2005 |
Updated: | February 3, 2006 |
| Description: |
OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
|
| Alerts: |
|
Comments (none posted)
OpenSSH: double shell expansion
| Package(s): | openssh |
CVE #(s): | CVE-2006-0225
|
| Created: | January 23, 2006 |
Updated: | July 20, 2006 |
| Description: |
OpenSSH has a double shell expansion vulnerability in local to local and
remote to remote copy with scp. |
| Alerts: |
|
Comments (none posted)
otrs: multiple vulnerabilities
| Package(s): | otrs |
CVE #(s): | CVE-2005-3893
CVE-2005-3894
CVE-2005-3895
|
| Created: | December 16, 2005 |
Updated: | February 15, 2006 |
| Description: |
Several vulnerabilities were discovered in the CMS system OTRS. Multiple
SQL injection vulnerabilities in index.pl in Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, multiple cross-site
scripting vulnerabilities in index.pl in Open Ticket Request System (OTRS)
1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, and Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when
AttachmentDownloadType is set to inline, renders text/html e-mail
attachments as HTML in the browser when the queue moderator attempts to
download the attachment. |
| Alerts: |
|
Comments (none posted)
pcre3: arbitrary code execution
| Package(s): | pcre3 |
CVE #(s): | CAN-2005-2491
|
| Created: | August 23, 2005 |
Updated: | March 10, 2006 |
| Description: |
A buffer overflow has been discovered in the PCRE, a widely used library
that provides Perl compatible regular expressions. Specially crafted
regular expressions triggered a buffer overflow. On systems that accept
arbitrary regular expressions from untrusted users, this could be exploited
to execute arbitrary code with the privileges of the application using the
library. |
| Alerts: |
|
Comments (none posted)
perl: setuid vulnerabilities
| Package(s): | perl |
CVE #(s): | CAN-2005-0155
CAN-2005-0156
|
| Created: | February 2, 2005 |
Updated: | August 11, 2006 |
| Description: |
There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access. |
| Alerts: |
|
Comments (none posted)
perl: symlink vulnerability
| Package(s): | perl |
CVE #(s): | CAN-2005-0448
|
| Created: | March 9, 2005 |
Updated: | January 30, 2006 |
| Description: |
The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries. |
| Alerts: |
|
Comments (none posted)
perl: integer overflow
| Package(s): | perl |
CVE #(s): | CVE-2005-3962
CVE-2005-3912
|
| Created: | December 1, 2005 |
Updated: | February 27, 2006 |
| Description: |
Perl has an sprintf integer overflow vulnerability
that may be used for a denial of service, remote code
execution and information leakage. |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
phpMyAdmin: multiple vulnerabilities
| Package(s): | phpmyadmin |
CVE #(s): | CVE-2005-4079
CVE-2005-3665
|
| Created: | December 12, 2005 |
Updated: | November 20, 2006 |
| Description: |
Stefan Esser reported multiple vulnerabilities
found in phpMyAdmin. The $GLOBALS variable allows modifying the global
variable import_blacklist to open phpMyAdmin to local and remote file
inclusion, depending on your PHP version (CVE-2005-4079, PMASA-2005-9).
Furthermore, it is also possible to conduct an XSS attack via the
$HTTP_HOST variable and a local and remote file inclusion because the
contents of the variable are under total control of the attacker
(CVE-2005-3665, PMASA-2005-8). |
| Alerts: |
|
Comments (none posted)
postgresql: database initialization errors
| Package(s): | postgresql |
CVE #(s): | CAN-2005-1409
CAN-2005-1410
|
| Created: | May 4, 2005 |
Updated: | February 28, 2006 |
| Description: |
PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
|
| Alerts: |
|
Comments (none posted)
pound: HTTP Request Smuggling Attack
| Package(s): | pound |
CVE #(s): | CVE-2005-3751
|
| Created: | January 10, 2006 |
Updated: | June 8, 2006 |
| Description: |
HTTP requests with conflicting Content-Length and Transfer-Encoding headers
could lead to HTTP Request Smuggling Attack, which can be exploited to
bypass packet filters or poison web caches. |
| Alerts: |
|
Comments (none posted)
pstotext: remote execution of arbitrary code
| Package(s): | pstotext netpbm |
CVE #(s): | CAN-2005-2471
|
| Created: | August 1, 2005 |
Updated: | March 28, 2006 |
| Description: |
Max Vozeler reported that pstotext calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option. An
attacker could craft a malicious PostScript file and entice a user to run
pstotext on it, resulting in the execution of arbitrary commands with the
permissions of the user running pstotext. See this Secunia advisory for more information. |
| Alerts: |
|
Comments (2 posted)
Py2Play: remote execution of arbitrary Python code
| Package(s): | Py2Play |
CVE #(s): | CAN-2005-2875
|
| Created: | September 19, 2005 |
Updated: | September 6, 2006 |
| Description: |
Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send
malicious Python pickles, resulting in the execution of arbitrary
Python code on the targeted game client. |
| Alerts: |
|
Comments (none posted)
scorched3d: multiple vulnerabilities
| Package(s): | scorched3d |
CVE #(s): | |
| Created: | November 15, 2005 |
Updated: | August 11, 2006 |
| Description: |
Luigi Auriemma discovered multiple flaws in the Scorched 3D game
server, including a format string vulnerability and several buffer
overflows. A remote attacker could exploit these vulnerabilities to crash
a game server or execute arbitrary code with the rights of the game server
user. |
| Alerts: |
|
Comments (none posted)
scponly: privilege escalation
| Package(s): | scponly |
CVE #(s): | CVE-2005-4532
|
| Created: | December 29, 2005 |
Updated: | February 13, 2006 |
| Description: |
The scponly restricted shell has a privilege escalation vulnerability.
Local users can chroot into arbitrary directories, and can gain root
privileges if a directory contains hard links to setuid programs.
Also, scponly does not properly validate command line parameters
to the scp and rsync commands. |
| Alerts: |
|
Comments (none posted)
spamassassin: denial of service
| Package(s): | spamassassin |
CVE #(s): | CVE-2005-3351
|
| Created: | November 9, 2005 |
Updated: | March 7, 2006 |
| Description: |
Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field. |
| Alerts: |
|
Comments (none posted)
squid: authentication handling
| Package(s): | squid |
CVE #(s): | CAN-2005-2917
|
| Created: | September 30, 2005 |
Updated: | March 15, 2006 |
| Description: |
Upstream developers of squid, the popular WWW proxy cache, have
discovered that changes in the authentication scheme are not handled
properly when given certain request sequences while NTLM
authentication is in place, which may cause the daemon to restart. |
| Alerts: |
|
Comments (none posted)
struts: cross-site scripting vulnerability
| Package(s): | struts |
CVE #(s): | CVE-2005-3745
|
| Created: | January 12, 2006 |
Updated: | March 8, 2006 |
| Description: |
The Struts error display system has a cross-site scripting vulnerability.
An attacker may be able to maliciously craft a URL that can trick
a user into thinking they are looking at a trusted site when they are not. |
| Alerts: |
|
Comments (none posted)
sudo: vulnerability via scripts
| Package(s): | sudo |
CVE #(s): | CAN-2005-4158
CVE-2006-0151
|
| Created: | December 16, 2005 |
Updated: | September 1, 2006 |
| Description: |
Perl and Python scripts run via Sudo can be subverted. |
| Alerts: |
|
Comments (none posted)
sudo: missing input sanitizing
| Package(s): | sudo |
CVE #(s): | CVE-2005-2959
|
| Created: | October 25, 2005 |
Updated: | February 19, 2006 |
| Description: |
Tavis Ormandy noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. The SHELLOPTS and PS4 variables are dangerous and are
still passed through to the program running as privileged user. This
can result in the execution of arbitrary commands as privileged user
when a bash script is executed. These vulnerabilities can only be
exploited by users who have been granted limited super user
privileges. |
| Alerts: |
|
Comments (none posted)
sudo: race condition
| Package(s): | sudo |
CVE #(s): | CAN-2005-1993
|
| Created: | June 21, 2005 |
Updated: | February 24, 2006 |
| Description: |
Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump: multiple DoS issues
| Package(s): | tcpdump |
CVE #(s): | CAN-2005-1280
CAN-2005-1279
CAN-2005-1278
|
| Created: | May 2, 2005 |
Updated: | April 10, 2006 |
| Description: |
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote
attackers to cause a denial of service (infinite loop) via a crafted RSVP
packet of length 4. (CAN-2005-1280)
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of
service (infinite loop) via a crafted BGP packet, which is not properly
handled by RT_ROUTING_INFO, or LDP packet, which is not properly
handled by the ldp_print function. (CAN-2005-1279)
The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and
earlier allows remote attackers to cause a denial of service (infinite
loop) via a zero length, as demonstrated using a GRE packet.
(CAN-2005-1278) |
| Alerts: |
|
Comments (none posted)
tetex: integer overflows
Comments (none posted)
texinfo: temporary file vulnerability
| Package(s): | texinfo |
CVE #(s): | CAN-2005-3011
|
| Created: | October 5, 2005 |
Updated: | November 9, 2006 |
| Description: |
Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability. |
| Alerts: |
|
Comments (none posted)
trac: missing input sanitizing
| Package(s): | trac |
CVE #(s): | CVE-2005-4065
CVE-2005-4644
|
| Created: | January 23, 2006 |
Updated: | January 30, 2006 |
| Description: |
Several vulnerabilities have been discovered in trac, an enhanced wiki
and issue tracking system for software development projects. Due to
missing input sanitizing it is possible to inject arbitrary SQL code into
the SQL statements (CVE-2005-4065). A cross-site scripting vulnerability
has been discovered that allows remote attackers to inject arbitrary web
script or HTML (CVE-2005-4644). |
| Alerts: |
|
Comments (2 posted)
ucd-snmp: denial of service
| Package(s): | ucd-snmp |
CVE #(s): | CAN-2005-2177
|
| Created: | August 9, 2005 |
Updated: | January 27, 2006 |
| Description: |
A denial of service bug was found in the way ucd-snmp uses network stream
protocols. A remote attacker could send a ucd-snmp agent a specially
crafted packet which will cause the agent to crash. |
| Alerts: |
|
Comments (none posted)
udev: insecure files in /dev/input
| Package(s): | udev |
CVE #(s): | CVE-2005-3631
|
| Created: | December 20, 2005 |
Updated: | February 28, 2006 |
| Description: |
Richard Cunningham discovered a flaw in the way udev sets permissions on
various files in /dev/input. It may be possible for an authenticated
attacker to gather sensitive data entered by a user at the console, such as
passwords. |
| Alerts: |
|
Comments (none posted)
up-imapproxy: format string vulnerabilities
| Package(s): | up-imapproxy |
CVE #(s): | CAN-2005-2661
|
| Created: | October 10, 2005 |
Updated: | March 7, 2006 |
| Description: |
up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
|
| Alerts: |
|
Comments (none posted)
uw-imap: buffer overflow
| Package(s): | uw-imap |
CVE #(s): | CAN-2005-2933
|
| Created: | October 11, 2005 |
Updated: | April 10, 2006 |
| Description: |
"infamous41md" discovered a buffer overflow in uw-imap, the University
of Washington's IMAP Server that allows attackers to execute arbitrary
code. |
| Alerts: |
|
Comments (none posted)
vixie-cron: crontab allows any user to read another users crontabs
| Package(s): | vixie-cron |
CVE #(s): | CAN-2005-1038
|
| Created: | April 15, 2005 |
Updated: | March 15, 2006 |
| Description: |
crontab in Vixie cron 4.1, when running with the -e option, allows local
users to read the cron files of other users by changing the file being
edited to a symlink. NOTE: there is insufficient information to know
whether this is a duplicate of CVE-2001-0235. See also this Security Focus
report. |
| Alerts: |
|
Comments (none posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
wine: Windows WMF vulnerability
| Package(s): | wine |
CVE #(s): | CVE-2006-0106
|
| Created: | January 13, 2006 |
Updated: | January 25, 2006 |
| Description: |
H D Moore discovered that Wine implements the insecure-by-design
SETABORTPROC GDI Escape function for Windows Metafile (WMF) files. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xloadimage: buffer overflows
| Package(s): | xloadimage |
CVE #(s): | CAN-2005-3178
|
| Created: | October 10, 2005 |
Updated: | May 15, 2006 |
| Description: |
Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
xorg-x11: heap overflow
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2005-2495
|
| Created: | September 12, 2005 |
Updated: | March 8, 2006 |
| Description: |
The pixmap memory allocation code in the X.Org X window system is
vulnerable to an integer overflow, a local user can use this to
execute arbitrary code with elevated privileges. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
xpdf: heap overflows
| Package(s): | xpdf gpdf kpdf poppler |
CVE #(s): | CVE-2005-3624
CVE-2005-3625
CVE-2005-3626
CVE-2005-3627
|
| Created: | January 11, 2006 |
Updated: | March 10, 2006 |
| Description: |
Xpdf, the associated poppler library, and other applications using that library are susceptible to a new set of buffer overflows discovered by Chris Evans and infamous41md. These overflows could be exploited, via a malicious PDF file, to execute arbitrary code on the target system. |
| Alerts: |
|
Comments (none posted)
xpdf: denial of service
| Package(s): | xpdf kpdf |
CVE #(s): | CAN-2005-2097
|
| Created: | August 9, 2005 |
Updated: | August 2, 2006 |
| Description: |
A flaw was discovered in Xpdf in that could allow an attacker to construct
a carefully crafted PDF file that would cause Xpdf to consume all available
disk space in /tmp when opened. |
| Alerts: |
|
Comments (none posted)
xpdf: integer overflows
| Package(s): | xpdf, poppler, cupsys, tetex-bin |
CVE #(s): | CVE-2005-3624
CVE-2005-3625
CVE-2005-3626
CVE-2005-3627
|
| Created: | January 5, 2006 |
Updated: | November 30, 2006 |
| Description: |
xpdf has a number of integer overflows.
A remote attacker can trick a user into opening a maliciously
crafted pdf file, allowing the attacker to execute code with the
privileges of the local user.
This also affects the Poppler library, cupsys and tetex-bin. |
| Alerts: |
|
Comments (none posted)
zlib: buffer overflow
| Package(s): | zlib |
CVE #(s): | CAN-2005-1849
|
| Created: | July 21, 2005 |
Updated: | April 11, 2006 |
| Description: |
zlib has a vulnerability that can cause code that executes it to crash
if a corrupted file is opened. |
| Alerts: |
|
Comments (none posted)
Resources
Version 4.00 of the Nmap security scanner is out. There is a long list of
changes and new features; click below for the full announcement. "
A popular open source security scanner recently went proprietary,
complaining that their community never contributes much. We are sorry
to hear that, but happy to report that the Nmap community is as
vibrant and productive as ever!" We hope to have a closer look at
this release within the next two weeks.
Full Story (comments: none)
Version 1.7 of John the Ripper, a password cracker, is out. Most of the changes would appear to be performance oriented: John is now a faster Ripper in many situations.
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch remains 2.6.16-rc1. Linus has been busily
merging patches, however, with the apparent aim of releasing -rc2
immediately after this article is published. 2.6.16-rc2 will contain a lot
of fixes, but it also has another set of semaphore-to-mutex conversions, a
USB driver for ET61X151 and ET61X251 camera controllers, a big Video4Linux
update, the
direct migration
patches, and various architecture updates.
The current -mm tree is 2.6.16-rc1-mm4. Recent changes
to -mm include some per-CPU variable tweaks, a representation of system CPU
topology in sysfs, and various fixes. As Andrew puts it: "Things
have been pretty quiet lately - most activity seems to be concentrated
about putting bugs into the various subsystem trees."
The current stable 2.6 release is 2.6.15.2, announced on January 30. It
includes a handful of fixes and a security patch. Expect
another update before too long, however, as a
few "box-killing bugs" are still known to exist in 2.6.15.
The stable kernel team has recently agreed to continue support for the
previous kernel for a little longer. The result is 2.6.14.7, with a handful of important fixes.
Comments (2 posted)
Kernel development news
The Linux networking stack isn't broken. The people who take care
of the stack know what they're doing & do good work. Based on all
the measurements I'm aware of, Linux has the fastest & most
complete stack of any OS.
-- Van Jacobson's linux.conf.au slides
To do this stuff right you want networking experts (not UNIX
interface standards experts) to come up with how to do things,
because folks like POSIX are going to make a rocking implementation
next to impossible.
Only folks like Van Jacobson can take us out of the myopic view we
currently have of how networking receive is done.
-- David Miller
Comments (none posted)
A group of kernel developers has been working for some time to try to help OSDL improve its interactions with the development and vendor communities. The result was a set of proposals presented to the OSDL board. Greg Kroah-Hartman has now
published a summary of the proposals and noted that the OSDL board has agreed to implement the full set. "
There is no Linux technical conference in the US anymore. If this could be addressed with a conference much like ALS used to be, it would be a very good thing. We need to nurture the technical community across the US with regional conferences that are easy to access in order to help seed the creation of new developers for Linux."
Comments (17 posted)
Your editor had the good fortune to see Van Jacobson speak at the 1989
USENIX conference. His talk covered some of the bleeding-edge topics of
the time, including TCP slow start algorithms and congestion avoidance. It
was the "how Van saved the net" talk (though he certainly did not put it
in those terms), and, many years later, the impression from that talk
remains. Van Jacobson is a smart guy.
Unfortunately, attending Van's talk at linux.conf.au this year was not in
the program. Fortunately, David
Miller was there and listening carefully. Van has figured out how the
next round of networking performance improvements will happen, and he has
the numbers to prove it. Expect some very interesting (and fundamental)
changes in the Linux networking stack as Van's ideas are incorporated.
This article attempts to cover the fundamentals of Van's scheme (called
"channels") based on David's weblog entry and Van's slides
[PDF].
Van, like many others, points out that the biggest impediment to
scalability on contemporary hardware is memory performance. Current
processors can often execute multiple instructions per nanosecond, but
loading a cache line from memory still takes 50ns or more. So cache
behavior will often be the dominant factor in the performance of kernel
code. That is why simply making code smaller often makes it faster. The
kernel developers understand cache behavior well, and much work has gone
into improving cache utilization in the kernel.
The Linux networking stack (like all others) does a number of things which
reduce cache performance, however. These include:
- Passing network packets through multiple layers of the kernel. When a
packet arrives, the network card's interrupt handler begins the task
of feeding the packet to the kernel. The remainder of the work may
well be performed at software interrupt level within the driver (in a
tasklet, perhaps). The core network processing happens in another
software interrupt. Copying the data (an expensive operation in
itself) to the application happens in kernel context. Finally the
application itself does something interesting with the data. The
context changes are expensive, and if any of these changes causes the
work to move from one CPU to another, a big cache penalty results.
Much work has been done to improve CPU locality in the networking
subsystem, but much remains to be done.
- Locking is expensive. Taking a lock requires a cross-system atomic
operation and moves a cache line between processors. Locking costs
have led to the development of lock-free techniques like seqlocks and read-copy-update, but the
the networking stack (like the rest of the kernel) remains full of locks.
- The networking code makes extensive use of queues implemented with
doubly-linked lists. These lists have poor cache behavior since they
require each user to make changes (and thus move cache lines) in
multiple places.
To demonstrate what can happen, Van ran some netperf tests on
an instrumented kernel. On a single CPU system, processor utilization was
50%, of which 16% was in the socket code, 5% in the scheduler, and 1% in
the application. On a two-processor system, utilization went to 77%,
including 24% in the socket code and 12% in the scheduler. That is a worst
case scenario in at least one way: the application and the interrupt
handler were configured to run on different CPUs. Things will not always
be that bad in the real world, but, as the number of processors increases,
the chances of the interrupt handler running on the same processor as any
given application decrease.
The key to better networking scalability, says Van, is to get rid of
locking and shared data as much as possible, and to make sure that as much
processing work as possible is done on the CPU where the application is
running. It is, he says, simply the end-to-end principle in action yet
again. This principle, which says that all of the intelligence in the
network belongs at the ends of the connections, doesn't stop at the
kernel. It should continue, pushing as much work as possible out of the
core kernel and toward the actual applications.
The tool used to make this shift happen is the "net channel," intended to
be a replacement for the socket buffers and queues used in the kernel now.
Some details of how channels are implemented can be found in Van's slides,
but all that really matters is the core concept: a channel is a carefully
designed circular buffer. Properly done, circular buffers require no locks
and share no writable cache lines between the producer and the consumer.
So adding
data to (or removing data from) a net channel will be a fast,
cache-friendly operation.
As a first step, channels can be pushed into the driver interface. A
network driver need no longer be aware of sk_buff structures and
such; instead, it simply drops incoming packets into a channel as they are
received. Making this change cuts the CPU utilization in the two-processor case
back to 58%. But things need not stop there. A next logical step would be
to get rid of the networking stack processing at softirq level and to feed
packets directly into the socket code via a channel. Doing that requires
creating a separate channel for each socket and adding a simple packet
classifier so that the driver knows which
channel should get each packet. The socket code must also be rewritten to do
the protocol processing (using the existing kernel code). That change
drops the overall CPU utilization to
28%, with the portion spent at softirq level dropping to zero.
But why stop there? If one wants to be serious about this end-to-end
thing, one could connect the channel directly to the application. Said
application gets the packet buffers mapped directly into its address space
and performs protocol processing by way of a user-space library. This
would be a huge change in how Linux does networking, but Van's results
speak for themselves. Here is his table showing the percentage CPU
utilization for each of the cases described above:
| Total CPU | Interrupt | SoftIRQ |
Socket | Locks | Sched | App. |
| 1 CPU |
50 |
7 |
11 |
16 |
8 |
5 |
1 |
| 2 CPUs |
77 |
9 |
13 |
24 |
14 |
12 |
1 |
| Driver channel |
58 |
6 |
12 |
16 |
9 |
9 |
1 |
| Socket channel |
28 |
6 |
0 |
16 |
1 |
3 |
1 |
| App. channel |
14 |
6 |
0 |
0 |
0 |
2 |
5 |
The bottom line (literally) is this: processing time for the packet stream
dropped to just over 25% of the previous single-CPU case, and less than 20%
of the previous two-CPU behavior. Three layers of kernel code have been
shorted out altogether, with the remaining work performed in the driver
interrupt handler and the application itself. The test system running
with the full application channel code was able to handle twice the
network bandwidth as an unmodified system - with the processors idle most
of the time.
Linux networking hackers have always been highly attentive to performance
issues, so numbers like these are bound to get their attention. Beyond
performance, however, this approach promises simpler drivers and a
reasonably straightforward transition between the current stack and a
future stack built around channels. A channel-based user-space interface
will make it easy to create applications which can send and receive packets
using any protocol. If Van's results hold together in a "real-world"
implementation, the only remaining question would be: when will it be
merged so the rest of us can use it?
Comments (63 posted)
The kernel needs to count a lot of things. There are counters for
networking statistics, usage of various resources, and so on. One would
ordinarily think that operating a counter would be a relatively
straightforward task, but ordinarily simple things can become complicated
in the kernel context, especially when the number of processors involved
gets large.
In theory, a counter is just a simple integer variable. In an SMP
environment, however, that variable must be protected against concurrent
updates, or it will eventually get corrupted. The tool that kernel hackers
reach for first in this situation is the atomic_t type. Atomic
variables are simple integers with a set of atomic operations. If you have
an atomic_t variable called counter, that counter can be
incremented with a call like:
atomic_inc(&counter);
and its value will be changed in an SMP-safe, interrupt-safe manner. These
operations are
relatively fast, being hand-coded to use the mechanisms provided by each
host architecture. In many cases, an atomic_t counter is the best
solution to the problem.
The problem with atomic_t counters is that they use expensive
locked operations, and they require that the current CPU obtain exclusive
cache access for the variable. A frequently-modified atomic counter can
cause a cache line to bounce constantly between CPUs, impacting the
performance of the entire system. As an example, consider this patch set from Ravikiran
Thirumalai. He replaced a single counter (the memory_allocated
field of the proto structure) in the networking code with a more
SMP-friendly counter, and reported a 5% improvement in an Apache benchmark
on an eight-processor system. 5% is a nice improvement for changing a
single counter, but it seems that perhaps even better results could be had.
Ravikiran replaced the atomic_t counter with the
percpu_counter type. These counters use per-CPU variables to hold
a CPU-local count. Modifying that count is fast, since it is local to the
given CPU, no locking is required, and no cache lines need be moved from
other processors. If any given processor's count exceeds a given
threshold, its value is added to a (spinlock-protected) global count, and
the CPU-local count is set back to zero. Queries of the counter look only
at the global count. The result is a counter which is somewhat
approximate, but quite fast. In many cases, an "almost right" count is
entirely good enough.
Per-CPU counters become increasingly inaccurate as the number of processors
grows, however. Each processor has a certain residual count which has not
yet been folded into the global count. In situations where counters tend
to increase, the result will be a global count which underestimates the
real value, and which is increasingly wrong on larger systems. Per-CPU
counters are also memory-intensive, partly due to inefficiencies in how
per-CPU variables are allocated.
So the discussion wandered toward another
possibility implemented with the somewhat obscure local_t
type. This type is apparently intended to function as a sort of
atomic_t which is only visible to a single CPU; it is currently
only used in two places in the kernel: to manage module reference counts
and in the x86-64 architecture code. It supports a set of
operations similar to atomic_t: local_set(),
local_read, local_add(), etc. There is also a set of
variants (cpu_local_set(), ...) intended for use with a local_t
declared as a per-CPU variable. The default implementation uses
atomic_t for 32-bit systems and a strange three-variable
structure for 64-bit systems. All architectures are encouraged to
reimplement the type in a more efficient, interrupt-safe manner, however,
and that has been done for several of them.
The local_t solution would set up two counters for each CPU, a
flag saying which of the two is in use, and a global count. For many operations,
they would behave just like percpu_counter, and they could yield
the same approximate answer. Should a precise count be needed, however,
the "which counter" bit would be flipped and all of the per-CPU offsets
summed. The result would be an exact count at the time the bit was
flipped, at the cost of taking a spinlock and iterating through the array.
All of this starts to look a little elaborate, however, and that may be the
point where kernel developers lose interest. A counter should only be so
complex, and making the code more twisted can only improve things to a
point. Sooner or later, people will decide that there are more important
things to be working on.
Comments (10 posted)
The software suspend story seems to repeat itself endlessly. Developers
debate multiple implementations while no decision gets made and software
suspend in Linux continues to fall short of what it could really be. One
place where this discussion might actually come to a head soon is in the storage
and retrieval of the suspend image - the copy of system memory which is
stored on disk while the system is down. Two approaches are being pushed;
they reveal two very different views of the problem.
One approach is the user-space interface, currently being developed by
Rafael Wysocki. Rafael's patch is similar in spirit to the user-space
patch covered here last
September. It no longer uses /dev/kmem, however; instead, it
sets up a dedicated device for the software suspend operations. A
user-space program can then invoke a set of ioctl() operations to
freeze the system, allocate swap space, and move memory pages to their
resting place - possibly compressing or encrypting them on the way. The documentation file provided with the patch
gives a good introduction to the interface and how it should be used.
In the other corner we have Nigel Cunningham, who has recently broken out
the modules mechanism from
his Suspend2 patch set. Rather than move image writing and reading support
to user space, this patch sets up a complex kernel interface for plugins
which take on parts of that task. There are two types of plugins: "filter"
plugins which transform the image data (performing encryption, say) and
"writer" plugins which handle the actual storage I/O. Parts of the code
anticipate "misc" and "checksum" plugins as well, but those are not
currently supported.
The plugin API is somewhat complex. Each
plugin has eleven methods to provide to the core suspend code; these handle
memory allocation, configuration, initialization and cleanup. Filter
plugins must define three more methods to handle data passing through for
processing. And writer modules have an additional 21 methods to provide
for dealing with various parts of that task. There are, it seems, a lot of
things that have to be done to get an image written to (and read from)
persistent storage.
The two patches are clearly incompatible - there is no point in setting up
an elaborate in-kernel interface if the whole process is to be moved out of
the kernel altogether, and vice-versa. So, before merging either of these
patches, somebody will have to make a decision. Anyone looking for tea
leaves to read might take a hint from the fact that the user-space patches
are currently in the -mm tree. As the reiser4 folks (among others) know,
however, the road from -mm to mainline can be long and perilous.
Comments (3 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
- Junio C Hamano: GIT 1.1.5.
(January 28, 2006)
Device drivers
Memory management
Networking
Architecture-specific
Security-related
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
The testing of
SUSE Linux 10.1 is in
the final stages. Following the recent release of its second beta, three
more development releases are scheduled to appear over the next three weeks
before the new version is declared stable. It will then be formally
released - after a delay required to package the usual SUSE retail boxes
and to update the printed documentation. This means that, barring some last
minute package upgrades and bug fixes, the latest SUSE beta is close to
what the final release will look like. So what can we look forward to in
March? And how does the result of this intensive development process
compare with the upcoming Fedora Core 5, due for release at roughly the
same time as SUSE 10.1?
Having recently investigated
the second test release of Fedora 5, my testing of SUSE Linux 10.1 beta2
started with a deficit on the first impressions barometer. Firstly, unlike
Fedora Core, SUSE doesn't offer a DVD edition of its beta releases, so
testers need to download and burn five CD images (or three if a basic
installation with KDE and/or GNOME is sufficient). Yes, there are smaller
delta ISOs, but these are only really useful on a SUSE installation since
they require the "deltarpm" package, only available in SUSE Linux.
Secondly, the Fedora developers usually produce comprehensive and
well-written release notes, accessible also from within the installation
program, with details about the changes and any known issues users might
experience. This is especially important during beta testing in order to
prevent testers from reporting known issues as bugs and to waste time
discussing them on mailing lists. Yes, SUSE does provide a changelog, but
it is just a dry list of package and feature updates in chronological
order, while the beta2 release notes, barely a page long, mention little
beyond the origin of Agama, an African lizard that gave the
release its code name.
On to the installation. Unlike Anaconda in Fedora 5, the SUSE installer has
been subjected to only light modifications. The first obvious one is a
screen allowing the user to perform a media check to ensure that the
installation CD/DVD images are not defective. The second notable change is
the removal of a "default" when choosing the desktop environment.
Historically, SUSE has always given clear preference to KDE over GNOME, but
Novell, with its eye on the enterprise desktop and with many GNOME
applications under its umbrella, wants to see the simpler interface of
GNOME promoted to at least equal status. As such, the user has to make an
explicit decision between GNOME and KDE (or choose a text-only or minimal
graphical system). In the partitioning stage, formatting partitions with
the XFS file system is no longer supported and the choice of journaling
file systems is limited to ReiserFS (default) and ext3.
One of the applications frequently mentioned in SUSE's release announcements
and developer blogs, even more so than in Fedora's, is NetworkManager. This
is a Red Hat-initiated GNOME program that should, at least in theory, take
the pain out of re-configuring networks on mobile computers that access the
Internet in varied locations. On the latest SUSE release, this is not
turned on by default (at least it wasn't on the desktop system I installed
SUSE on), but it can be enabled during installation. In this case it will
seamlessly integrate into the system trays of both the GNOME panel and KDE
Kicker. Although still considered a work in progress, NetworkManager is a
promising tool with a potential to beat other operating systems in ease of
network re-configuration. Incidentally, an excellent article about the
present status and features of this application was recently published in
Red
Hat Magazine.
On the desktop, in sharp contrast with Fedora Core 5, there is little
evidence of any significant changes - except perhaps for the presence of
the Beagle desktop search tools, which now installs by default. Naturally,
most applications have been updated to their latest versions; among the major
components, SUSE's second beta ships with kernel 2.6.16-rc1, X.Org 6.9, KDE
3.5.1, OpenOffice.org 2.0.1rc2, Firefox 1.5 and Apache 2.2.0. Xen has also
been updated to 3.0. Interestingly, the developers have decided to stay
with the stable GNOME 2.12, instead of moving on to the current beta
release of 2.14 - wisely so, given the fact that SUSE 10.1 will be
finalized before March 15th, the expected release date of the new GNOME. As
in Fedora 5, SUSE's latest beta also includes glibc 2.3.90 and GCC 4.1.0 -
both are testing versions, but both carry major enhancements that are
likely to shape the development work of other distributions throughout
2006.
All in all, there isn't much new in SUSE 10.1 to get terribly excited about.
Sure, there is the usual: a cutting-edge kernel, update packages and
improved hardware support, but it seems that most of the work has been put
into general polish of the product, rather than major feature enhancements.
It is entirely possible that SUSE Linux will be used as a basis for the new
versions of both SUSE Linux Enterprise Server (SLES) and Novell Linux
Desktop (NLD), as the current stable releases of both have now become
somewhat long in the tooth.
How do Fedora 5 and SUSE 10.1 compare at this late stage of development? To
tell the truth, there isn't much to justify recommending one over another.
If anything, in terms of features and available packages, the two
distributions have been converging - they both ship with five CDs worth of
programs and both seem to copy the best features from each other (e.g.
Beagle, introduced into SUSE several releases ago is now part of Fedora
Core, while the Red Hat-sponsored NetworkManager is being talked up by SUSE
as a major new feature). After the recent simplifications of Anaconda,
Fedora is perhaps easier to install, but it still lacks a comprehensive
YaST-like central administration tool. The convenience of YaST is perhaps
one point that could sway certain users to SUSE. On the other hand, some
might consider the presence of a modular X.Org 7.0 and familiar SELinux in
Fedora an advantage over the monolithic X.Org 6.9 and less widely-used
AppArmor in the latest SUSE. In the end, however, the choice of one over
the other will probably come down to personal preference, rather than major
differences in features or quality.
Comments (7 posted)
New Releases
The second alpha release of NexentaOS (Debian on top of the Solaris kernel)
is out. Lots of work has been done on this release - it has 829 additional
packages. Highlights include wireless network support, KDE, Mono, Java,
and more.
Full Story (comments: none)
SUSE Linux 10.1 Codename "Agama Lizard" Beta2 is ready for testing. Click
below to see some known issues. SUSE Linux 10.1 supports the Intel and AMD
x86 and x86-64 platforms as well as the PowerPC platform.
Full Story (comments: none)
Distribution News
The Ubuntu Distro Sprint is currently underway at a hotel in London. This
is where developers are squashing bugs, updating packages, writing
documentation, and otherwise working on the Dapper Drake, aka Ubuntu 6.04.
Here's a summary of the activities during
day 1
& 2 and
day 3.
Comments (none posted)
Ben Collins has made his
daily kernel
builds available to Ubuntu users. These kernels are for test purposes
and should not be considered stable. The primary purpose of these kernels
is finer grained regression analysis between major kernel uploads.
Full Story (comments: none)
The opensuse.org website has been updated to MediaWiki version 1.5, which
allows the hosting of localized instances. The wiki is currently available
in English, Spanish, French and German. Further translations are planned.
Full Story (comments: none)
Distribution Newsletters
The Debian Weekly News for January 31, 2006 covers the donation of two MIPS
boards, more GPLv3 discussion, Debian Day call for papers, the removal of
debmake, more ways for volunteers to contribute to Debian, Debian archive
key maintenance, launchpad for Debian?, and other topics.
Full Story (comments: none)
This week the
Fedora Weekly
News covers Red Hat Magazine January 2006, Fedora Projects Weekly
Report 2006-01-30, Fedora Reloaded Episode 4 Podcast, Fedora Core 5 Test 2
Screencast, My desktop OS: Fedora Core 3: Feedback, Unofficial Fedora Core
Starter Guide, and several other topics.
Comments (none posted)
The
Gentoo
Weekly Newsletter for January 30, 2006 looks at modular X as it moves
into testing, an end of life announcement for old-style configuration
Apache packages, Gentoo's PHP Herd meeting, MySQL packages that support
SLOTing will be moving into testing, and more.
Comments (none posted)
The
DistroWatch
Weekly for January 30, 2006 is out. "
We'll start with news about
rPath, a Linux distribution and company, formally launched last week after
concluding a round of venture capital financing. Which Windows applications
would you most like to see running under Linux? That's what Novell wants to
know -- with some preliminary results of the survey already available -- in
order to help with porting them to our favourite operating system. This
will be followed by more news about Xandros, Morphix, and SUSE, as well as
a link to a mouthwatering bunch of KDE 4 screenshots. In our First Look
series, we'll check out the progress the developers of Symphony OS have
made during the last three months."
Comments (none posted)
Package updates
Updates for Fedora Core 4:
SDL (enable ALSA
output by default),
system-config-soundcard
(add log for kudzu, text clean-up),
iptraf
(fix bad display of frames).
Comments (none posted)
Updates for Mandriva Linux 2006.0:
dynamic
(call scripts correctly when hardware is plugged/unplugged),
gthumb (bug fix),
libgphoto (bug fix),
mozilla-thunderbird (bug fixes)
Updates for Multi Network Firewall 2.0: mdkonline (connect to mandrivaonline.com not
mandrivaonline.net),
Comments (none posted)
Newsletters and articles of interest
NewsForge
hears
from a long-time Windows user who finds Ubuntu's Breezy Badger to be a
pretty good replacement. "
Ubuntu's pre-installed GNOME applications
were suitable for my needs. OpenOffice.org allowed me to manipulate all my
Word, Excel, and PowerPoint files without any difficulty. It lacks some of
the extra features of the commercial competition, but I didn't suffer at
all in my early use. Switching from Quickbooks to GnuCash was more
difficult. GnuCash has fewer familiar features than Quickbooks, but free
software fits into my budget nicely."
Comments (none posted)
Distribution reviews
Linux.com
reviews
OpenWrt, the GPLed Linux distribution for wireless routers. "
Now
you have OpenWrt on your router - so what? OK. You're cool. You have Linux
running on your router. So what? So a lot more than I ever would have
imagined, that's for sure. Putting OpenWrt on your router is like adding
the magic sauce that can turn your ordinary router into something
special. A lot of different something specials, actually."
Comments (none posted)
Page editor: Rebecca Sobol
Development
Sylpheed-Claws is a branch of the
Sylpheed project,
a light weight email client which we explored
last August
on the LWN development page.
Sylpheed-Claws started as the bleeding-edge version of Sylpheed, in order to act as a testbed for new features for Sylpheed. The idea was to regularly resync with Hiroyuki's main branch, and vice-versa. Sylpheed-Claws then evolved into the stable extended version of Sylpheed, and is now an entity in its own right, mainly due to different goals and the fact that syncing both codebases doesn't happen anymore.
Sylpheed-Claws is being developed by
this group
of programmers.
The Features
document contains a lengthy list of capabilities that have been added
to Sylpheed-Claws, here is a sampling of some of the more interesting
additions:
- A plugin mechanism.
- Sorting, filtering, spell checking, and improved search capabilities.
- Automatic message saving.
- Font configuration.
- More sophisticated color support.
- Hiding of previously seen messages.
- Support for IMAP over an SSH tunnel.
- Extended folder properties.
- An ignore thread option.
- Online and offline modes.
- A built-in man page.
- Numerous GnuPG encryption capabilities.
- SSL certificate management abilities.
- Support for multiple attachments.
- Import functions for Mutt and Pine address books.
- LDAP dynamic query support.
- Much more.
Some of the plugin extensions include: AntiVirus, HTML viewer,
image viewer, MathML viewer, PGP, SpamAssassin, tool scripts and more.
The Sylpheed-Claws
users manual
and FAQ
explain the project's features in more detail.
Version 2.0.0 of Sylpheed-Claws
was announced
on January 30, it includes:
- A rewritten manual.
- An icon legend window.
- Support for printing of attached images.
- Several new command line features.
- GUI improvements.
- A quick mail retrieval feature.
- Improvements to the compose window.
- Better quick search capabilities.
- Support for wildcard searches in the LDAP address book.
- The merging of redundant plugins.
- New tool scripts.
- New translations.
- A long list of bug fixes.
Sylpheed-Claws shows how an open-source project such as Sylpheed
can be used as a starting point for an improved application.
those wishing for a more full-featured email client can use Sylpheed-claws,
and the original Sylpheed project can benefit from the back porting of
desired enhancements.
Source code and packages for a number of Linux distributions and other
platforms are available
here.
Comments (4 posted)
System Applications
Database Software
A status update is available for version 2.0 of the
Firebird database.
"
Currently we are preparing the Beta 2 release. The CVS tree has been tagged and the Release Notes are being updated. The binaries will be packaged soon. It was intended to release it earlier, but there were a few issues that needed fixing first. Also the final V1.5.3 release also needed to be done.
If nothing critical is reported in the near future, we expect that the next official build will be Release Candidate 1."
Comments (none posted)
The January 29, 2006 edition of the PostgreSQL Weekly News is online
with the latest PostgreSQL database information.
Full Story (comments: none)
Interoperability
Version 3.0.21b of Samba has been announced.
"
This is the latest stable release of Samba. This is the
version that production Samba servers should be running
for all current bug-fixes. This release addresses several
crash bugs in smbd and over 30 fixes for bugzilla reports."
Full Story (comments: none)
Libraries
Version 0.9.1 of libcmml is available, it is a maintenance release.
"
libcmml is a C library that provides a complete programming
interface including functions, data structures, and sloppy or
strict error handling to parse a XML file in CMML. CMML is the
Continuous Media Markup Language defined as part of the Continuous
Media Web project."
Full Story (comments: none)
Networking Tools
Version 1.3.5 of iptables has been announced.
"
The netfilter coreteam proudly presents: iptables version 1.3.5.
The 1.3.5 version contains accumulated bugfixes to the last 1.3.4
version. It also fixes some compilation problems with old kernel
headers."
Full Story (comments: none)
Version 4.00 of the Nmap Security Scanner
has been announced.
"
Nmap has undergone many substantial changes since our last major release (3.50 in February 2004) and we recommend that all current users upgrade." See the
ChangeLog file
for more information. SecurityFocus also has a recent
interview
with the Nmap author. (Thanks to Fyodor.)
Comments (none posted)
OpenSSH 4.3 is out. This is primarily a bugfix release, and it deals with
one security-related issue (which has already been addressed by most
distributors). There is a new, experimental tunneling feature as well,
however, which can be used to construct true virtual private networks with
OpenSSH.
Full Story (comments: 8)
Desktop Applications
Audio Applications
Version 2.4.4 of Ecasound, a multi-track audio
processing package, is available.
"
A severe bug related to audio routing in the engine has been fixed.
It is now possible to set initial values for any MIDI-CC controlled effect
parameters. Many minor bugfixes and improvements have been made to the
Ecasound Control Interface implementation. Some improvements have been
also made to the ecasignalview utility."
Full Story (comments: none)
Version 0.9.65 of the Rivendell radio automation system has been
released.
"
This is a bugfix release of Rivendell. Among the issues corrected
are: RDLogManager issues, including a problem with autofill events when
the associated traffic or music import source has no matching events.
Problems with Services whose name contained one or more spaces."
Full Story (comments: none)
Version 0.9.1 of Sweep, an audio file editor, is available.
"
The previous release (0.9.0) had a bug that prevented sweep from
populating the ALSA devices in settings. The bug was only apparent
when you built with ALSA and didn't have a previous installation
of sweep that used ALSA.
If you installed sweep 0.9.0 and had problems getting any sound
output then please upgrade to 0.9.1."
Full Story (comments: none)
Desktop Environments
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The KDE project has announced the immediate availability of KDE 3.5.1.
This is a maintenance release. "
KDE, including all its libraries and
its applications, is available for free under Open Source licenses. KDE can
be obtained in source and numerous binary formats from http://download.kde.org/ and can also
be obtained on CD-ROM or with any of the major GNU/Linux."
Full Story (comments: none)
Electronics
A new CDROM ISO image of the
gEDA Suite,
a collection of electronics tools, is available. See the
change log for details.
Comments (none posted)
Version 20060125 of
Layout Editor,
an IC fabrication CAD package, is available.
Comments (none posted)
Version 1.0.rc1b of the
Robowerk
cross-platform Robot Simulator
has been announced.
"
Robowerk is an application that simulates and controls robots. Robowerk specializes in walking robots with two or more legs."
Comments (none posted)
Graphics
GnomeDesktop
details
the next wave of changes that are being added to Inkscape, an SVG editor.
New features will include
a new outline mode, a selected style indicator, removal of overlaps,
snapping improvements, connector improvements, a move of swatches to the main interface, improvements to the transformation dialog,
retention of transformation rotation centers between sessions,
rendering speed improvements, and more.
Comments (none posted)
Imaging Applications
Nathan Harrington uses Perl scripts and ImageMagick to create mosaics
in an IBM developerWorks
article.
"
Use simple Perl scripts to automate the image manipulation, text creation, and compositing of arbitrary mosaic images. Learn how to use ImageMagick, GD, and The Gimp to create your own mosaic images suitable for static display and dynamic content. Explore the capabilities of ImageMagick and open source graphical editing tools."
Comments (none posted)
Interoperability
The January 29, 2006 edition of the
Wine Weekly Newsletter
is available. Topics include:
WineTools & Wine, SCSI Tape Drive Support, JACK Audio Driver,
Overriding Executables With Winecfg and Hook Problems.
Comments (none posted)
Music Applications
Version 0.23 of liblo is out with bug fixes and more. The code
is being managed by a new maintainer.
"
Liblo, the Lite OSC library, is an implementation of the Open Sound
Control protocol for POSIX systems*. It is written in ANSI C99 and
released under the GNU General Public Licence. It is designed to make
developing OSC applictions as easy as possible."
Full Story (comments: none)
Office Applications
MozillaZine
covers
the release of
SeaMonkey 1.0.
"
Robert Kaiser writes: "The SeaMonkey
Council is proud to announce SeaMonkey 1.0, the first end-user release of their
internet suite. SeaMonkey is available as a free download from its
mozilla.org-hosted website, features a state-of-the-art web browser, a
powerful email client, a WYSIWYG web page composer and a feature-rich IRC
chat client. For web developers, mozilla.org's DOM inspector and JavaScript
debugger tools are included as well.""
Comments (none posted)
Office Suites
KDE.News
announces the release of the first KOffice 1.5 beta. 1.5 is a major release, adding OpenDocument as the default file format, much improved accessibility features, a new scripting framework, Kexi 1.0 (a database access application), and more.
Comments (11 posted)
Release 0.2 of tcluno has been announced.
"
Tcluno is a set of Tcl packages, which provide acccess to OpenOffice.org using
the urp socket interface.
Since release 0.1 the C/C++ part has been eliminated and the packages are Tcl
only now."
Full Story (comments: none)
The January, 2006 edition of the OpenOffice.org Newsletter is online
with the latest OpenOffice.org news.
Full Story (comments: none)
PDA Software
Version 2.7 of
GPE,
a GTK+ environment for PDA devices,
is available.
"
It took a little bit longer than expected, but now all important bits are in
place: GPE 2.7 is finished.
This is the first release of a new - more strictly defined -
type."
Comments (1 posted)
Web Browsers
MozillaZine
covers the migration of Mozilla Newsgroups to Giganews.
"
The previously announced Mozilla Newsgroups Migration has been completed. The
new newsgroups are hosted by Giganews. For more information, refer to the FAQ
and the list of new newsgroups."
Comments (none posted)
Languages and Tools
Caml
The January 24-31, 2006 edition of the Caml Weekly News is online
with new Caml language articles.
Full Story (comments: none)
Lisp
Version 2.38 of GNU CLISP, an open-source
Common Lisp implementation, is available.
"
This version can
generate standalone executables, makes the berkeley-db module
compatible with Berkeley DB 4.4, and provides a few fixes."
Full Story (comments: none)
Version 0.9.9 of Steel Bank Common Lisp is out.
"
This version provides experimental support for the Windows operating
system, adds some optimizations and fixes a few bugs."
Full Story (comments: none)
Perl
The January 1-24, 2006 edition of the
Perl 6 Summary covers the latest Perl 6 development news.
Comments (none posted)
Simon Cozens
discusses the latest edition of the book
Advanced Perl Programming in an O'Reilly article.
"
Around Easter last year, I finished writing the second edition of Advanced Perl Programming, a task that had been four years in the making. The aim of this new edition was to reflect the way that Perl programming had changed since the first edition. Much of what Sriram wrote in the original edition was still true, but to be honest, not too much of it was useful anymore--the Perl world has changed dramatically since the original publication.
The first edition was very much about how to do things yourself; it operated at a very low level by current Perl standards. With the explosion of CPAN modules in the interim, "advanced Perl programming" now consists of plugging all of the existing components together in the right order, rather than necessarily writing the components from scratch. So the nature of the book had to change a lot."
Comments (none posted)
PHP
Version 0.9 of the PHP OpenID library, an OpenID consumer
library for PHP, is available.
"
This release completes the port and includes an
OpenID server implementation and much-improved example code."
Full Story (comments: none)
Python
O'ReillyNet
looks
at the Python class library, Pyparsing. "
Pyparsing provides a
basic framework for creating recursive-descent parsers, taking care of the
overhead functions of scanning the input string, handling expression
mismatches, selecting the longest of matching alternatives, invoking
callback functions, and returning the parsed results. This leaves
developers free to focus on their grammar design and the design and
implementation of corresponding token processing. Pyparsing's nature as a
combinator allows developers to scale their applications from simple
tokenizers up to complex grammar processors. It is a great way to get
started with your next parsing project!"
Comments (none posted)
The January 30, 2006 edition of Dr. Dobb's Python-URL! is out.
Take a look for new Python language article links.
Full Story (comments: none)
Ruby
The January 29th, 2006 edition of the
Ruby Weekly News looks at the latest discussions
from the ruby-talk mailing list.
Comments (none posted)
Scheme
developerWorks
covers
metaprogramming. "
Metaprogramming -- programming with code
generators or writing programs that themselves write code -- has numerous
useful attributes, such as simplifying code maintenance and making it
easier to craft boilerplate code. The first article of this series
explained why metaprogramming is necessary, looked at some of the
components of metaprogramming, showed how to build a code generator, and
introduced language-sensitive macro programming. In this article, learn
techniques and applications of metaprogramming in the Scheme programming
language, and see how macros are programmed and how they can make your
large-scale programming tasks significantly easier."
Comments (1 posted)
Tcl/Tk
The January 30, 2006 edition of Dr. Dobb's Tcl-URL! is online
with the latest Tcl/Tk news and resources.
Full Story (comments: none)
XML
Uche Ogbuji
works with Flickr on O'Reilly.
"
Flickr probably needs no introduction for readers of this column. It's a hugely popular social-network site owned by Yahoo, focusing on sharing of photographs. It embodies most of the the current web buzzwords, including tagging, web feeds, AJAX, and accessibility to scripts. Flickr provides a set of HTTP-based APIs for accessing features both as a publisher and as a viewer of pictures. You get to choose between XML-RPC, REST (simple XML over HTTP), or SOAP, and the available functions cover every corner of the core Flickr service. In this article I'll look at some Python libraries for integrating with Flickr (all code tested with Python 2.4.2)."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Here's
a ZDNet weblog entry trashing the anti-DRM provisions in the GPLv3 draft. "
Though Stallman may wish otherwise, most of the world still uses primarily proprietary software. That means there are plenty of options should Stallman create a situation where GPLed code can't be used by businesses or individuals who want DRM (which in 10 years, will be most businesses and MOST users)."
Comments (27 posted)
Linus is not planning on using the GPL3 license for the Linux kernel,
according to
this article on eWeek.
"
In a message to the Linux Kernel Mailing List on Jan. 25, Linus Torvalds made it plain that the Linux operating system is going to stay under General Public License 2 and not migrate to GPL 3.
Torvalds announced this in response to a discussion on the list of Linux developers, which had been started by Jeff Merkey. The former Novell and Canopy Group developer, Merkey is best known in Linux circles for his attempt to buy a non-GPLed version of the Linux code."
Comments (64 posted)
According to
this
entry in Jonathan Schwartz's weblog, Sun is considering GPLv3 for
OpenSolaris. "
We also recognize that diversity and choice are
important - which is why we've begun looking at the possibility of
releasing Solaris (and potentially the entire Solaris Enterprise System),
under dual open source licenses. CDDL (which allows customer IP to safely
comingle with Solaris source code) and under the Free Software Foundation's
GPL3. It's early days, but we're looking at two things as we make that
decision."
Comments (2 posted)
eWeek has posted
a lengthy
interview with Lee Thompson, the VP of architecture at E-Trade.
"
So we're now at summer of 2002, and at this point, I realized, this
is a much, much bigger phenomenon than simply taking [down the] dramatic
cost of the data center, which it definitely was - millions
and millions and millions of dollars came out of our expenses to run our
facility.... However, something else was also going on, and I did a deep
dive on open source at this particular time. I started running lots of
different distros. I ended up running Gentoo. Personally, I run the Gentoo
distro."
Comments (none posted)
The SCO Problem
Groklaw
covers a stock option deal at SCO.
"
It's raining stock options on that happy band in Lindon. On January 23, SCO
granted executives Darl McBride, Chris Sontag, Ryan Tibbits, Sandy Gupta, Tim
Negris, Jeff Hunsaker, and Bert Young a combined total of 400,000 stock
options at $3.78. Gupta got as many as Darl, 80,000, but he has to wait
a year for them to be exercisable, as do all the rest, except for McBride.
His options appear to be immediately exercisable. Oh, they all fully vest
immediately "upon the occurrence of certain specified events.""
Comments (1 posted)
Companies
Linux Journal
covers
the Novell
Cool Solutions
survey. "
On an individual basis, many Linux users for years have
been requesting a Linux port of QuickBooks or Photoshop, to no avail. The
standard response from developers and vendors has been "there isn't enough
of a user base to make Linux ports worthwhile". With this survey Novell is
hoping that many voices united finally will motivate the application
vendors."
Comments (42 posted)
ZDNet UK
reports
that, as the result of a software patent ruling, Microsoft is forcing
Office users to upgrade to a new, non-infringing version. "
The
question for companies, though, is if they are exposing themselves to
potential legal liability if they don't quickly move to the new
software. Microsoft promises to indemnify customers from third-party patent
claims, but [Gartner analyst Michael] Silver said the license terms also require customers to
'immediately' move to any new noninfringing version that Microsoft
releases."
Comments (1 posted)
Legal
NewsForge has
some
notes on the GPLv3 conference from Benjamin Mako Hill. "
The GPL
is so widespread that it is frequently referred to as "the Constitution of
the free software movement." As it introduces changes, any discussion draft
creates a potentially dangerous moment for the free software
movement. While this danger is real, it does not exist to the extent or for
the reasons that many in the community believe. In a way, the GPLv3 is both
more and less important than many of us think."
Comments (none posted)
Groklaw
reposts
an entry from Simon Phipps' blog. "
DRM - the imposition of
restrictions on usage of content by technical means - is far more than
that. It's like checking the lift ticket, yes, but also the guy checks you
are only wearing gear hired from the resort shop, skis with you down the
slope and trips you if you try any manoeuvers that weren't taught to you by
the resort ski instructor; then as you go down the slope he pushes you away
from the moguls because those are a premium feature and finally you get to
run the gauntlet of armed security guards at the bottom of the slope
checking for people who haven't paid."
Comments (8 posted)
Interviews
The People Behind KDE have
interviewed Tom Chance.
"
Which section of KDE is underrated and could get more
publicity? There are lots of KDE applications that aren't shipped as
part of KDE and that don't get a lot of attention because they're generally
not used by computer science geeks. But I've come to depend upon Kile,
which makes writing essays much easier than a cumbersome word processor;
KDissert is a very nice little mind mapping tool; RSIBreak keeps me from
wearing out my wrists before I hit the age of 30. But really KDE as a whole
needs more publicity. People ought to see how well applications can fit
together, how working with remote files becomes painless, and so
on." (Found on
KDE.News)
Comments (none posted)
Resources
Here's an
article on
functional programming on Linux Journal. "
In computer science,
we enjoy using mathematic models, but the science still works if you
violate the math. And, much to the dismay of purely functional programming
enthusiasts, we almost always do. However, when we embrace the math,
sometimes the loss in flexibility is more than compensated for by the
increase in functionality."
Comments (18 posted)
HowToForge
sets up
chrooted ssh sessions. "
This tutorial describes how to install
and configure OpenSSH so that it will allow chrooted sessions for
users. With this setup, you can give your users shell access without having
to fear that they can see your whole system. Your users will be jailed in a
specific directory which they will not be able to break out of. This setup
is based on a Debian Sarge (Debian 3.1) system, and the chrooted SSH will
be installed in such a way that it will still use the configuration files
of the standard OpenSSH Debian package which are in /etc/ssh/, and you will
be able to use the standard OpenSSH Debian init script
/etc/init.d/ssh. Therefore you do not have to create your own init script
and configuration file."
Comments (none posted)
Linux.com has
another
list of favorite sysadmin tools. "
If the Internet is the
Information Superhighway, then Perl is the Fix-a-Flat and the spare tire --
and the spare drive-shaft, should you need it. Anything you can do in a
shell or sed or awk script, you can do in Perl. With the -ne options, you
can iterate automatically over every line of input in a pipe chain."
Comments (7 posted)
Reviews
NewsForge
looks
at open source games. "
Open source games do exist, and the
development scene is active and creative. You can get a taste of this by
visiting sites devoted to Linux gaming, such as The Linux Game Tome, which highlights
updated open source game projects every day. You can usually find a couple
of announcements for new open source game projects every week."
Comments (none posted)
NewsForge
looks at the Gentium font, which is available under the
SIL Open Font Licence.
"
Gentium is something new in fonts. Its design is a mixture of the practical and aesthetically pleasing. It supports the diacritical marks needed to render a wide range of Latin and Greek characters, yet it is also designed for readability, compactness, and visual appeal. What is really unusual is that its designer, Victor Gaultney, has released it under a free licence and is developing it as a free and open source project."
Comments (19 posted)
Linux.com
reviews SARA, a network auditing tool.
"
If you are an old school Linux or Unix user, you probably remember the System Administrator's Tool for Scanning Networks (SATAN). In 1995, SATAN brought browser-based network auditing to the world. Despite its initial splash, SATAN fell to the wayside due to lack of updates. Thanks to the kind folks at the Advanced Research Corp., SATAN is back, in the form of the Security Auditor's Research Assistant (SARA), a kinder, gentler, easier to use, and more updated auditing tool."
Comments (1 posted)
Linux.com
reviews
vile, the "vi like emacs" editor. "
vi has several clones, such
as calvin, Elvis, nvi, viper, and Vim, but vile isn't another vi clone,
according to its maintainer, Thomas Dickey. It has the most common vi
commands, but doesn't look quite like vi. vile is an editor that works and
feels like vi but, like Emacs, incorporates features for editing multiple
files in multiple windows."
Comments (9 posted)
Miscellaneous
NewsForge
reports that the ReactOS project, which is working to make a free version of Windows, has suspended work and started an audit as a result of some possibly tainted code making its way into their repository. "
Jeremy White, founder and chief executive officer of CodeWeavers, which develops a commercial product based on Wine, said a number of developers from ReactOS have contributed to Wine, but several have been banned from contributing to the project because of concerns about code they offered. This was not necessarily because the code included something stolen or illegal, but because Alexandre Julliard, chief technology officer for Codeweavers, reviews the contributed code and was concerned about what the banned individuals had claimed as their own."
Comments (2 posted)
NewsForge
reports
that the Secure Shell protocol is one step closer to becoming an Internet
Engineering Task Force (IETF) standard. "
IETF standards define a
number of protocols that make the Internet what it is today. For example,
TCP/IP, the Simple Mail Transfer Protocol (SMTP), the Post Office Protocol
(POP), and the Hypertext Transfer Protocol (HTTP) are all standards that
most users depend on every day. Without adherence to these standards it
would be difficult for users and devices to communicated effectively using
different mail clients and servers, Web browsers, and network
adapters."
Comments (7 posted)
NewsForge
looks
at free software advocacy and the Canadian election. "
Mathieu
Allard, the free software advocate who ran for the New Democrats in the
riding of Saint Boniface, Manitoba, finished third in the Canadian national
election on January 23. Since he was not elected, he is returning to his
job as executive assistant to Christine Melnick, the Minister of Housing
and Social Services in the Manitoba provincial government. He plans to look
for new ways to promote the use of free software in government."
Comments (5 posted)
ZDNet
reports
on election results at Linux Australia. "
Incumbents Jon Oxer and Pia
Waugh have retained their respective positions as president and vice
president of Australia's peak Linux body for another year."
Comments (1 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Electronic Frontier Foundation announced effort to overturn a
patent ruling.
"
The Electronic Frontier Foundation (EFF)
filed a friend-of-the-court brief with the United States
Supreme Court Thursday, asking justices to overturn a court
ruling in a patent case with dangerous implications for
free speech and consumers' rights. The Public Patent
Foundation, the American Library Association, the American
Association of Law Libraries, and the Special Library
Association joined EFF on the brief.
At issue is a case involving online auctioneer eBay and a
company called MercExchange."
Full Story (comments: none)
After seeing how getting an iPod from his daughter
made
U.S. Senator Stevens more aware of fair use rights, the folks at IPac
came up with an idea:
give each Senator an
iPod. "
Plus, we're going to pre-load each one with examples of
the cultural richness made possible by sharing and collaboration - public
domain content, Creative Commons content, and audio messages about the
importance of balanced copyright policy. It will be engraved with the words
'listen to the people.'" Needless to say, they are looking for
donations to make this happen.
Comments (19 posted)
The Electronic Frontier Foundation has sent out a press release
concerning Google's Cache feature and copyrights.
"
A federal district court in Nevada has
ruled that Google does not violate copyright law when it
copies websites, stores the copies, and transmits them to
Internet users as part of its Google Cache feature. The
ruling clarifies the legal status of several common search
engine practices and could influence future court cases,
including the lawsuits brought by book publishers against
the Google Library Project."
Full Story (comments: 3)
The
Open Voting
Consortium seeks to make U.S. elections open and transparent. From a
recent news item: "
The Open Voting Consortium and California Clean
Money campaign sponsored a highly successful Open House acquainting rank
and file California Democrats with Open Voting and consolidating support
for the already well known Clean Money issue. The event was held at the
Manhattan Beach Marriot where the California Democratic Party held its
Executive Committee meeting on January 27th and 28th." (Thanks to
Jay R. Ashworth)
Comments (none posted)
Norbert Bollow, founder of the Truth50 campaign against software patents,
is challenging the legitimacy of the Microsoft-sponsored EV50 European
of the Year award.
"
Norbert Bollow
launched www.truth50.com, a Web site on which people can sign a bundle of
open letters (http://www.truth50.com/en/open-letters.html) to European
political leaders and others involved with an EU-related award, including
Microsoft's CEO Steve Ballmer. Truth50 will at a future point in time
deliver those letters along with lists of the names of the people who
signed. The campaign demands a verification or a retaking of the
Microsoft-sponsored public poll in which the "EV50 European of the Year
2005" was elected."
Full Story (comments: none)
Commercial announcements
Fonality has
announced the joining of its board by Larry Augustin.
"
Fonality, the leader in affordable IP-PBX systems for small businesses, today announced that Open Source pioneer Larry Augustin has joined its board of directors and will assist the company with its corporate strategy in the Open Source IP telephony market. Fonality's PBXtra IP-PBX is based on the Open Source Asterisk platform and, since it began shipping in October 2004, has placed millions of calls and has
been deployed by hundreds of businesses with thousands of lines."
Comments (none posted)
Nokia has
announced
that the company will release the source code for its Python for S60
Platform software package. The source code for Python for S60 Platform
will be posted by Nokia to SourceForge.net. Further information and a link
to the project can be found
here.
Comments (5 posted)
Novell has announced it will bundle support and training offerings with its
SUSE Linux Enterprise Server. "
With this new offering, Novell(R)
solution provider partners, the company's primary channel to the
mid-market, can now deliver a comprehensive Linux solution, including 24x7
support and online assistance, to their customers."
Full Story (comments: 7)
The OpenVZ project has announced improved features and performance of its
operating system level server virtualization software technology with
availability of beta level software based on the Linux kernel 2.6.15.
Full Story (comments: none)
Beginning in March, customers of Open-Xchange, Inc. will have full access
to and seamless integration with Linux-based Logon, File and Print services
for Microsoft Windows workstations through Open-Xchange Server 5 giving
customers the option to fully replace Microsoft Exchange as well as
Microsoft Windows Server.
Full Story (comments: none)
Oracle Corporation has
announced the achievement of a new database speed record running on
a Linux system.
"
Running on NEC's Express5800/1160Xe Server, corresponding to
"NX7700i/3040H-16" server in the Japanese market, with 8 Intel(R) Itanium 2
1.6 GHz processors, Oracle Database 10g on Red Hat Enterprise Linux v4
operating system, achieved 254,471 tpmC (transactions per minute) with a
price-performance ratio of $5.32/tpmC."
Comments (none posted)
FSMLabs has
announced the availability of ARINC 653 for its RT Linux Pro embedded
platform.
"
Designed for avionics control and advanced hardware-in-loop simulation,
ARINC 653 provides a fully protected and partitioned scheduling environment
configured using a standard XML format. The ARINC scheduler has been added to
FSMLabs' industry leading Process Space Development Domain (PSDD) product
which executes real-time threads in the address space of Linux or BSD
processes."
Comments (none posted)
The samba4WINS project aims to improve the standalone capabilities of Samba.
"
Until now Samba3 offers the possibility to start a WINS server but
it cannot synchronize in a ring with other WINS servers, an ability that
is requested in many complex networks.
Even after complete migration to Linux/Unix/Samba Windows servers are
still inevitable in those networks. This remarkable cost factor will be
abolished with samba4WINS."
Full Story (comments: none)
Sleepycat Software, Inc. has
announced version 2.1 of its Berkeley DB Java Edition database.
"
The new version of Sleepycat's pure Java, transactional database features
multi-key secondary databases, multi-threaded performance improvements, and
new controls for optimizing concurrency."
Comments (none posted)
TimeSys has announced the availability of LinuxLink Subscriptions for the
MIPS32(R) 24KE(TM) Core Family.
"
Licensees of a MIPS32 24KE core can choose among a number of
flexible LinuxLink subscription options to receive continuous access
to the latest MIPS Technologies-developed Linux, hundreds of
cross-compiled packages, a processor-optimized cross-development
environment, alerts to relevant updates and Developer Exchange access
to interactive support from TimeSys, MIPS Technologies and the Open
Source community."
Full Story (comments: none)
New Books
O'Reilly has published the book
Google Maps Hacks
by Rich Gibson and Schuyler Erle.
Full Story (comments: none)
Pearson has published the book
How to Break Web Software
by Mike Andrews and James Whittaker.
Full Story (comments: none)
O'Reilly has published the book
PSP Hacks by C.K. Sample, III.
Full Story (comments: none)
O'Reilly has published the book
RFID Essentials
by Bill Glover and Himanshu Bhatt.
Full Story (comments: none)
No Starch Press has published the book
Wicked Cool Perl Scripts
by Steve Oualline.
Full Story (comments: none)
Contests and Awards
MozillaZine
covers
the latest from the
Firefox Flicks Ad Contest.
"
Asa Dotzler writes: "The Firefox Flicks Ad Contest is starting to gain some
serious momentum. The latest developments are the addition of some great new
rewards for Ad Contest winners. We've been working with some friends in the
indy film world to get more outreach going and along the way we've been able
to expand those relationships to include some major visibility opportunities
for the winners. In addition to having your ad included in our world-wide
marketing campaign for Firefox and the prizes we've already talked about,
we're now able to offer some great exposure for entrants with a screening of
top entries at the Vail Film Festival which had more than 10,000 attendees
last year. Firefox Flicks first place winner will automatically qualify as a
Shortlist finalist in the 2006 New York Festivals of Advertising (NYFA)
competition.""
Comments (none posted)
Samba project's Andrew Tridgell
has been awarded a 2005 Free Software Award from the FSF.
"
Andrew Tridge Tridgell was recognized for his work as originator and developer of the Samba project. Samba reverse-engineered Microsoft's version of the Server Message Block (SMB) protocol, which is used for file-sharing and print services. This software enables free operating systems to fit into Microsoft-based environments, encouraging greater use and adoption of free software. Samba has been implemented on millions of servers throughout the world. Tridge also released rsync, a highly respected remote file-distribution system, and contributed code to the Linux kernel."
Comments (none posted)
LinuxQuestions.org has announced that voting is open for its 2005
Members Choice Awards.
"
The Members Choice Awards allow the Linux community to select
their favorite products in a variety of categories. Awards will be given
out in 20 categories, including Distribution of the Year, Browser of the
Year, Office Suite of the Year, Desktop Environment of the Year and
Database of the Year. The polls will close on March 16th and winners will
have the option of receiving their award at the LinuxWorld Conference and
Expo in Boston."
Full Story (comments: none)
The OpenOffice.org Developer Article Contest has begun.
"
OpenOffice.org, with the support of Team OpenOffice.org e.V. and
extra sponsorship from Sun Microsystems, announces its first
Developer Contest starting February 1, 2006. The goal of the
developer contest is to generate more developer documentation. We are
also interested in promoting OpenOffice.org to developers at the same
time."
Full Story (comments: none)
Upcoming Events
The folks at FOSDEM have sent out a reminder for the upcoming event.
"
FOSDEM 2006 is approaching. The event will take place on the 25th and
26th of February in Brussels, Belgium.
The FOSDEM is a free and non-commercial event for the community and
organised by the community. FOSDEM 's goal is to provide Free and
Open Source developers and communities a place to go over the latest
developments in the Free and Open Source arena and to promote the
development and the benefits of Free and Open Source solutions."
Full Story (comments: none)
A
call for papers
has gone out for the 2006 Large Installation System Administration (LISA)
conference. The event takes place on December 38, 2006 in Washington,
D.C., proposals are due by May 23.
Comments (none posted)
rPath has announced the company has been invited to present at an upcoming
Northern Virginia Linux Users Group (NOVALUG) meeting. Matt Wilson, rPath
founding engineer and former OS engineering lead for Red Hat, will
represent rPath to discuss the company's rBuilder and Conary technology to
the group of Linux professionals.
Full Story (comments: none)
LinuxMedNews
covers
events relating to
the ClearHealth electronic medical record system at the SCALE conference.
"
Uversa will offering ClearHealth training and new feature demonstrations in our booth (#38) at the upcoming Southern California Linux Exposition (SCALE) February 11 & 12 at February 11-12, 2006, at The Radisson Los Angeles Airport."
Comments (none posted)
The 2006 USENIX Annual Technical Conference will take place in
Boston, Massachusetts from May 30 to June 3, 2006.
Full Story (comments: none)
| Date | Event | Location |
| February 6 - 7, 2006 | ICMCC Conference on
EHR Standards and Interoperability | (World Forum Convention Center, The Hague)The
Netherlands |
| February 7 - 9, 2006 | OSCMS
Summit | Vancouver, BC, Canada |
| February 8 - 10, 2006 | X Developer's
Conference(XDevConf) | (Sun Campus)Santa Clara, CA |
| February 8 - 10, 2006 | LinuxAsia Conference and
Expo 2006 | (India Habitat Centre)New Delhi, India |
| February 10 - 12, 2006 | CodeCon
2006 | San Francisco, CA |
| February 10, 2006 | SCALE Workshop On
Open Standards For Government Organizations | (Airport Radisson)Los Angeles,
CA |
| February 10, 2006 | PHP Conference UK
2006 | (Keyworth Centre)London, England |
| February 11 - 12, 2006 | Southern California
Linux Expo(SCALE 4x) | (Airport Radisson)Los Angeles, California |
| February 20 - 21, 2006 | EuSecWest/core06
conference | London, England |
| February 24 - 26, 2006 | PyCon
2006 | (Dallas/Addison Marriott Quorum hotel)Addison, TX |
| February 25 - 26, 2006 | FOSDEM
2006 | (ULB Campus)Brussels, Belgium |
| February 26 - 28, 2006 | OSDC::Israel::2006 | (Netanya Academic College)Netanya,
Israel |
| February 27 - March 3, 2006 | SELinux
Symposium and Developer Summit | (Wyndham Hotel)Baltimore, MD |
| February 28 - March 3, 2006 | Black Hat Europe
Briefings and Training 2006 | (Grand Hotel Krasnapolsky)Amsterdam, the
Netherlands |
| March 3 - 4, 2006 | LinuxForum
2006 | Copenhagen, Denmark |
| March 6 - 9, 2006 | O'Reilly
Emerging Technology Conference(ETech) | (Manchester Grand Hyatt)San Diego, CA |
| March 17 - 19, 2006 | Libre
Graphics Meeting 2006 | (Ecole d'Ingénieurs CPE)Lyon, France |
| March 19 - 24, 2006 | Novell BrainShare
2006 | (Salt Palace Convention Center)Salt Lake City, UT |
| March 21 - 23, 2006 | UKUUG Spring
Conference 2006 | Durham, UK |
| March 25, 2006 | Penguin
Day | Seattle, WA |
| March 29 - 31, 2006 | PHP Quebec
2006 | (Plaza Montreal Hotel)Montreal, Canada |
Comments (none posted)
Web sites
KDE.News
covers
the launch of the new
SpreadKDE.org site.
"
The KDE marketing group is pleased to announce the release of SpreadKDE.org, the new home for KDE's promotional activities. Such a hub for marketing activities has been sorely lacking in KDE until now, and we consider this site a to be a key milestone in establishing a solid foundation in growing KDE's promotional activity."
Comments (none posted)
Page editor: Forrest Cook