LWN.net Logo

LWN.net Weekly Edition for January 4, 2007

Looking forward to 2007

Predictions, as they say, are hard - especially when they involve the future. It's easy to get them wrong and look like a total fool. Your editor, however, has long since gotten over his fear of coming across as a total idiot in front of large numbers of people; when you have already tipped your hand, there is no point in holding back any longer. So here's a few things which, in your editor's view, might just come to pass in 2007. As always, these predictions come with no warranty whatsoever.

Legal issues

Version 3 of the GPL will be adopted, perhaps after one more draft round. Your editor has no clue of how the FSF will respond to the criticisms of their anti-DRM provisions. If that language remains, uptake of the new license will be somewhat lower; the FSF may try to avoid that scenario by making "distribution on restrictive hardware without the associated keys" an optional permission which can be granted by the copyright holders.

Somebody will be sued for distributing proprietary kernel modules. Threats of lawsuits have been muttered for some time, but the late-2006 discussion on banning those modules made it clear that GPL infringement suits are the strongest weapon available to those who oppose proprietary modules. Given the way the frustration level is rising, it is only a matter of time until somebody uses that weapon.

We will see the end of SCO in 2007. Chances are that the company's case against IBM will not even survive until the planned trial date in the (northern hemisphere) fall. Look for fun around March, when dispositive motions can be heard.

There will be serious talk of patent reform in the U.S. The EFF is unlikely to succeed in its attempt to get the U.S. Supreme Court to throw out patents on software altogether; the current chief justice places a heavy emphasis on deciding no more than the current case requires, and software patents are not at issue in that case. But the pain caused by these patents is severe and growing; something will eventually have to be done. Whether that "something" will help to lift the clouds of legal uncertainty from free software remains to be seen, however.

Development

Linux will have fewer problems with closed hardware one year from now. There is already a clear path to support for most wireless network adapters. On the video front, a palpable determination to address the problem has come together over the last year. The Nouveau project can be expected to make significant progress over the next twelve months, and developers are beginning to talk about a project to support ATI's R500 engine. A decision by AMD to open up ATI's hardware would be a nice bonus. But, either way, the need to solve this problem is well understood, and developers are increasingly interested in attacking it.

Closed hardware problems will not go away, however. The content industry, with Microsoft's help, is pushing for a new generation of hardware which is intended to be "trusted" not to give too much control to its owner. "Trusted content paths" are fundamentally incompatible with free software. So we will continue to have trouble in carrying out straightforward tasks - like watching movies - on our free systems until the industry comes to its senses.

The war on bloat will get serious as people get tired of running out of memory. The increasing use of Linux on small and embedded systems will also create pressure for lower resource usage. Tools are emerging which will help developers track down wasted memory; their employment should lead to leaner systems for all of us.

The previous item notwithstanding, Java will move into the free software community as Sun follows through on its promised code releases. Thus far, the amount of free software written in Java has been relatively small. Once free Java support is available for all Linux systems, the number of developers of free Java code can be expected to grow.

Fedora will come into its own as a free, community-oriented distribution. Fedora's transition from a corporate product into a community product has been slow at best, and it is far from complete. The right things are happening, however; the combination of a more open process, a 100% free software policy, and a high-quality base should lead to good things.

Debian will get the Etch release out this year. Honest. What could possibly go wrong? Thereafter, the Debian developers will go back to arguing about firmware in the kernel.

Free software will move into online gaming as a critical mass of interested developers comes together. Many of the necessary pieces exist now as free software, and the possibility of acquiring some cast-off corporate code still exists. Meanwhile, Second Life has shown the possibilities inherent in hackable online platforms. These environments are too much fun - and too much a part of our future - to leave to the proprietary software companies.

Commerce

The Microsoft/Novell deal will blow over with few consequences. Most of the angry ink has already been spilled, and it still seems unlikely that Microsoft will launch a patent attack against Linux. Novell will have lost credibility in the community, and may yet lose more developers, but it has not really changed the nature of the patent threat.

The "open source" term will take a beating as various semi-open companies try to look like free software operations. Some companies have already needed to be told to take the "open source" label off their code; others will certainly follow. The need felt by these companies to attach non-free provisions to their licenses may lead to the creation of a "shared-source"-like replacement term by the end of the year.

The first round of OLPC systems will be distributed to millions of children in the developing world. That much can be predicted by looking at the project's timeline. Much harder to predict is what will happen when millions of children learn to use systems which are open, Linux-powered, and network-connected. This project may well change the free software community - and the world as a whole.

Desktop Linux will grow as corporate managers realize they already have more desktop systems deployed than they had thought.

As always, these predictions will be reviewed in December of this year.

Comments (29 posted)

Trademarking the snake

A quick search shows that there are almost 200 trademarked terms in the U.S. using the term "Python." This name has been reserved for use with lacrosse sticks, bungee cords, musical instruments, tape libraries, arc welding torches, radio-controlled toys, wire rope, motorcycle exhaust systems, perfumes, cryogenic pipes, floor polishers, carbonated beverages, "providing online adult entertainment by means of a global computer network," orthodontic adhesive, herbicides, garage door openers, and much more. There is also a registration for a programming language. The term "Python," in this context, belongs to the Python Software Foundation (PSF), and has since early 2004.

In November, the PSF announced the adoption of a formal policy for the use of the Python trademark. This policy has version 1.2.2, despite being the first posted policy for the use of this name. The rules disallow calling any other language "Python," so it's no fair slipping in a Perl interpreter; they also forbid using the term "in ways that confuse the community as to whether the Python programming language is open source and free to use."

One clause regarding how the term "Python" can be used has attracted a small amount of attention in the Debian community, however. It reads:

Use of the word "Python" when redistributing the Python programming language as part of a freely distributed application -- Allowed. If the standard version of the Python programming language is modified, this should be clearly indicated. For commercial distributions, contact the PSF for permission.

This rule would appear to take in commercial Linux distributors, all of whom should, from a strict reading, be getting permission from the Foundation. Debian, as a non-commercial distributor, should not be directly affected by this language, but anybody who redistributes Debian on a commercial basis could be.

The question which comes up is: what uses of the word "Python" fall under this policy? Is providing a python command sufficient? How about in the introductory text printed when python is run interactively? Does listing Python in an online package database count? Can the release notes brag about the version of Python shipped? How about running a "now includes Python 3000" Superbowl advertisement? The final case is covered by a separate term which forbids the use of "Python" in advertisements without prior permission. But the real location of the line separating free use from that which requires permission is not entirely clear.

At this time, there would appear to be little cause for concern; the PSF has little interest in harassing people who are using or distributing its code. After inquiring with the PSF, your editor was told that the policy was created as part of the legal requirement that trademarks be enforced if the holder wants to keep them. The PSF has not seen any misuses of the name that it felt the need to crack down on, and it does not feel that noting the inclusion of Python within a commercial product necessarily requires permission. Noting that a product contains Python is acceptable in just about any circumstances. The PSF wants to promote the use and development of Python; it appears to be uninterested in legal silliness.

That said, there are a couple of things which should be kept in mind here:

  • The Python Software Foundation is a corporation, and corporations can change their minds quickly. Should the PSF - speaking entirely hypothetically now - decide to split off "Python Corporation" as a separate, for-profit entity, the approach to trademark policy and enforcement could change overnight.

  • Trademark law (in the U.S., at least) requires the enforcement of trademarks. If a trademark holder can be shown to have overlooked known violations, it can lose its rights to the mark. The law, in other words, can force trademark holders to get into the cease-and-desist business, even if they would rather be writing code.

The number of free software projects with trademarks and associated policies would appear to be growing. The issues surrounding the Firefox trademark have been well discussed here and elsewhere. Xen has a trademark policy which is quite strict on whether a distributor can claim to ship Xen; see the Xen trademark FAQ for a view of their approach to trademark management. There are trademark policies for Perl, MySQL, GNOME, and, of course, Linux. The KDE and OpenOffice.org trademarks have been registered, but there does not appear to be a posted policy for their use. Fortunately, an attempt by Unipress to trademark "emacs" was not successful.

In recent times, there has been some concern over license proliferation, resulting in a determined effort to reduce the number of free software licenses in active use. It makes sense; every software license brings its own set of conditions and interactions to worry about. Every trademark license is unique, however; each one has its own set of quirks, any of which can be changed at any time with no public participation or notification. The continuation of this trend could lead to an increasing series of hassles for distributors; the long-term result could be more software shipped under iceweasel-like names.

It would be nice if free software projects would stop worrying about trademarks and get back to working on the code. Abuses of free project names have been few and far between. This outcome seems unlikely, however. Nobody likes to see their chosen name hijacked, and commercial organizations can be positively paranoid about the idea. So a more realistic solution might be the creation of some sort of standardized free trademark license. A known set of trademark terms, the same for each mark and drafted with an eye toward keeping the associated software free, could do much to make life easier for software distributors. It seems like a better alternative than being neck-deep in iceweasels.

Comments (10 posted)

No free Ryzom; what next?

One month ago, LWN looked at the Free Ryzom Campaign, which was trying to raise enough money to buy (and free) the source to the Ryzom game in bankruptcy court. The Free Software Foundation got into the game (so to speak) with a $60,000 pledge. On December 21, however, the bad news was posted: another bidder had come in with a better offer. The campaign was left with a pile of pledges and nothing to buy.

Whenever a project gets that sort of energy and resources together, it is a shame to just let it all fade away. So the campaign organizers have been discussing possibilities for achieving their goal by other means. One of the immediate outcomes is the creation of the Virtual Citizenship Assocation, which is essentially the Ryzom campaign with the brand names removed. The organization is still soliciting pledges on the chance that the source for an interesting game may come available from somewhere else. One expects, however, that the number of pledges is unlikely to grow quickly until prospective donors can see what the organizers would like to buy.

There is a real chance that a game platform could be obtained this way. The history of free software projects starting with freed corporate code is long; Mozilla, OpenOffice.org, and InterBase are just some of the more prominent examples. The online gaming market is tough, with many failed offerings. Perhaps one of those proprietary failures could yet be turned into a free software success. Beyond that, the possibility of an open-source Second Life is still real.

The history of corporate code offers other lessons, though; among them is the fact that such code can often require a great deal of work. Mozilla treaded water for some time until it decided to simply toss much of its Netscape legacy and start over. It would be a shame to put a large pile of donated money into a code base which, in the end, needs to be thrown out and rewritten properly. It might be better to just start over from the beginning and do it right.

Except that starting from the beginning would not be necessary. The NeL library - the engine at the core of Ryzom - is already free software. Arkhart is a project to develop a GPL-licensed engine and game. The Planeshift engine is also free software - though the associated artwork is not. The WorldForge project has been working in this area for a long time. Other interesting projects exist as well.

There are a couple of conclusions to be drawn from this situation. The first is that we do have the interest - and the ability - to create game engines which can implement compelling virtual worlds. The code and the developers are out there; we don't have to buy that code from a failing company. The other side of the coin, however, is that code is only part of the problem. Top-quality online games need top-quality artwork, sound effects, music, storylines, and more. If our community is going to create a great online virtual world, we must do a better job of soliciting and integrating contributions from artists, writers, and others who are not software developers. Without them, all we have is a pile of code.

So there are a number of challenges to the creation of truly successful, completely free online worlds. But our community has always been good at overcoming challenges. This one, too, will fall, and we will, eventually, have our free online worlds. Your editor's kids think it can't happen too soon.

Comments (7 posted)

Page editor: Jonathan Corbet

Security

A Firefox PDF plugin XSS vulnerability

January 3, 2007

This article was contributed by Jake Edge.

A particularly nasty cross-site scripting (XSS) vulnerability has surfaced that impacts Firefox users who have installed the Adobe Reader (Acrobat/PDF) plugin. Proof of concept exploits have been published on Bugtraq as well as several blogs (here for example). Adobe has fixed the problem in Acrobat version 8; which is only available for Windows, no word yet on a fix for the Linux plugin (which is based on Acrobat version 7).

The technique was first disclosed last week at the 23rd Chaos Communication Congress by Stefano Di Paola and Giorgio Fedon in their Subverting AJAX presentation. Sven Vetsch discovered another wrinkle and publicized it on his blog. The crux of the vulnerability is a link with a URL of the following form:

    http://host/path/to/file.pdf#anystring=javascript:malicious_code_here
The host and path to file are legitimate URL paths to a PDF file that is hosted somewhere on the net, quite possibly at a site that is trusted by the user. The attacker need not have any access to the PDF file, but can have his code executed while appearing to be a simple download from the affected site. It is the ability to turn any PDF hosted on any site into an XSS attack that makes this vulnerability so insidious.

The vulnerability exploits a feature of the Adobe plugin that is not shared with other mechanisms for viewing PDFs from the web (including using the acroread external program that is also supplied by Adobe). Arguments can be passed to the plugin via the information after the '#' and can be used to specify a specific page or search string in the PDF. It can also be used to populate PDF forms using '#FDF=URL' arguments and the information for the forms is retrieved from the URL. Evidently Adobe does not check for FDF or two other similar argument types (which is why 'anystring=' works) and blindly asks the browser to fetch the URL specified. If the URL is javascript code as described above, the plugin does not detect that case and in effect forces the browser to execute it.

Any site hosting a PDF file is vulnerable and there is little that the site can do; there is no indication that the request is anything out of the ordinary because the string after the '#' is not passed as part of the request. Concerned sites could stop hosting PDF files, but that seems rather unlikely. Other server-side solutions are being discussed as there is a concern that users are unlikely to upgrade their browser plugins. Hosting sites would much rather that they be in control of whether their PDF files can appear in links with malicious content. Most XSS problems can be handled by proper server side filtering of user supplied content, but this particular vulnerability is different.

So far there are no reports of other PDF plugins that follow Adobe's lead in retrieving URLs that appear in links to PDF files. In this author's experience, PDF viewing utilities are separate programs that get invoked by the browser after it downloads a PDF file. For xpdf and kpdf (and presumably others), this works just fine but Adobe chose to provide a means of more closely integrating PDF viewing into the browser. Unfortunately, the fact that this plugin is closed source implies that users, especially Linux users, must wait for Adobe to fix the problem. We cannot fix it ourselves.

One could certainly imagine a similar mistake being made by one of the other PDF viewer development teams; Adobe is hardly alone in making bad choices in developing software. However, the fix for an open source PDF viewer would likely be available within hours of the report. Adobe was notified about this problem on 15 October according to the advisory, but there is still no fix for Linux. Disabling the plugin would seem to be prudent.

Fixing the affected software is just the start of the task of fixing the overall problem. As mentioned above, users are not particularly good at picking up security fixes even when they know about them. Getting the message out on this particular problem is a big hurdle. The alternative is to educate users so that they can recognize maliciously crafted links to PDFs and that is almost certainly a harder task.

The potential for a widespread outbreak exploiting this vulnerability is fairly high and this will probably not be the last we will hear about it. It certainly has the possibility of damaging the reputation of PDF amongst even casual web users and that is probably keeping some folks at Adobe awake at nights.

Comments (20 posted)

New vulnerabilities

cacti: multiple vulnerabilities

Package(s):cacti CVE #(s):CVE-2006-6799
Created:January 1, 2007 Updated:January 26, 2007
Description: The network monitoring and graphing frontend Cacti has three vulnerabilities. The cmd.php script allows command line usage and is also installed in a web-accessible location. The cmd.php input is insufficiently sanitized, a passed-in URL can be used to inject arbitrary SQL code. The cmd.php script can be used by a remote attacker to execute arbitrary shell commands via improperly sanitized results from SQL queries.
Alerts:
Gentoo 200701-23 2007-01-26
Debian DSA-1250-1 2007-01-17
Mandriva MDKSA-2007:015 2007-01-15
SuSE SUSE-SA:2007:007 2007-01-12
OpenPKG OpenPKG-SA-2007.001 2007-01-01

Comments (none posted)

denyhosts: denial of service

Package(s):denyhosts CVE #(s):CVE-2006-6301
Created:January 3, 2007 Updated:January 3, 2007
Description: A botched regular expression allows a remote attacker to add arbitrary hosts to the denyhosts blacklist, causing those hosts to be unable to make ssh connections to the target system.
Alerts:
Gentoo 200701-01 2007-01-03

Comments (2 posted)

elog: multiple vulnerabilities

Package(s):elog CVE #(s):CVE-2006-5063 CVE-2006-5790 CVE-2006-5791 CVE-2006-6318
Created:December 28, 2006 Updated:January 3, 2007
Description: elog, a web-based electronic logbook has multiple vulnerabilities that may lead to arbitrary code execution. Log entry editing in HTML has a cross-site scripting vulnerability. A number of format string vulnerabilities may be used for the execution of arbitrary code. There are cross-site scripting vulnerabilities related to the creation of new logbook entries. There is insufficient error handling in config the file parsing that may be used for a denial of service attack.
Alerts:
Debian DSA-1242-1 2006-12-27

Comments (none posted)

mono: source disclosure attack

Package(s):mono CVE #(s):CVE-2006-6104
Created:December 21, 2006 Updated:January 17, 2007
Description: The Mono ASP.NET server XSP has a source disclosure attack vulnerability. A malicious user can use this to acquire the source code of a server-side application.
Alerts:
Gentoo 200701-12 2007-01-16
Fedora FEDORA-2007-067 2007-01-12
Fedora FEDORA-2007-068 2007-01-12
SuSE SUSE-SA:2007:002 2007-01-04
Ubuntu USN-397-1 2006-12-20
Mandriva MDKSA-2006:234 2006-12-20

Comments (none posted)

openser: buffer overflow

Package(s):openser CVE #(s):
Created:December 26, 2006 Updated:January 3, 2007
Description: A buffer overflow was discovered in the "parse_expression" function of the "permissions" module of the SIP router OpenSER, versions up to and including 1.1.0. The OpenSER "permissions" module is used to determine if a SIP call has appropriate permission to be established. The "parse_expression" function is used during parsing of the modules local allow/deny configuration files.
Alerts:
OpenPKG OpenPKG-SA-2006.042 2006-12-26

Comments (none posted)

w3m: denial of service

Package(s):w3m CVE #(s):
Created:December 28, 2006 Updated:January 15, 2007
Description: The W3M textual web browser has a format string vulnerability. If the run-time options -dump or -backend are used, W3M can be made to crash if certain escape sequences occur in the Common Name of a web site X.509 certificate.
Alerts:
Fedora FEDORA-2007-077 2007-01-15
Fedora FEDORA-2007-078 2007-01-15
Gentoo 200701-06 2007-01-12
SuSE SUSE-SA:2007:005 2007-01-10
Ubuntu USN-399-1 2007-01-03
OpenPKG OpenPKG-SA-2006.044 2006-12-28

Comments (none posted)

Updated vulnerabilities

apache: cross-site scripting

Package(s):apache CVE #(s):CVE-2006-3918
Created:August 9, 2006 Updated:April 4, 2008
Description: From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header."
Alerts:
SuSE SUSE-SA:2008:021 2008-04-04
Ubuntu USN-575-1 2008-02-04
SuSE SUSE-SA:2006:051 2006-09-08
Debian DSA-1167-1 2005-09-04
Red Hat RHSA-2006:0619-01 2006-08-10
Red Hat RHSA-2006:0618-01 2006-08-08

Comments (none posted)

apache-mod_auth_kerb: off-by-one error

Package(s):apache-mod_auth_kerb CVE #(s):CVE-2006-5989
Created:November 24, 2006 Updated:January 23, 2007
Description: An off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.
Alerts:
Gentoo 200701-14 2007-01-22
Debian DSA-1247-1 2007-01-08
Red Hat RHSA-2006:0746-01 2006-12-06
Fedora FEDORA-2006-1341 2006-11-29
Mandriva MDKSA-2006:218 2006-11-23

Comments (none posted)

bind: denial of service

Package(s):bind CVE #(s):CVE-2006-4095 CVE-2006-4096
Created:September 7, 2006 Updated:February 1, 2007
Description: Bind has two denial of service vulnerabilities.

Recursive servers queries for SIG records will trigger an assertion failure if more than one RR set is returned.

An INSIST failure can be triggered by sending a large number of recursive queries.

Alerts:
Fedora FEDORA-2007-164 2007-01-31
Gentoo 200609-11 2006-09-15
Slackware SSA:2006-257-01 2006-09-15
Fedora FEDORA-2006-966 2006-09-11
Debian DSA-1172-1 2006-09-09
Mandriva MDKSA-2006:163 2006-09-08
rPath rPSA-2006-0166-1 2006-09-08
Ubuntu USN-343-1 2006-09-07
OpenPKG OpenPKG-SA-2006.019 2006-09-07

Comments (none posted)

bugzilla: multiple vulnerabilities

Package(s):bugzilla CVE #(s):CVE-2006-5453 CVE-2006-5454 CVE-2006-5455
Created:November 10, 2006 Updated:August 28, 2007
Description: Bugzilla has the following vulnerabilities:

Input data passed to various fields is not properly sanitized before being passed back to users.

Users can gain unauthorized access to read attachment descriptions while using diff mode.

HTTP GET and HTTP POST requests can be used to perform unauthorized actions due to improper verification.

Input that is passed to showdependencygraph.cgi is not properly sanitized before being returned to users.

Alerts:
Debian DSA-1208-1 2006-11-11
Gentoo 200611-04 2006-11-09

Comments (none posted)

busybox: insecure password generation

Package(s):busybox CVE #(s):CVE-2006-1058
Created:May 5, 2006 Updated:May 2, 2007
Description: The BusyBox 1.1.1 passwd command does not use a proper salt when generating passwords. This would create an instance where a brute force attack could take very little time.
Alerts:
Red Hat RHSA-2007:0244-02 2007-05-01
Fedora FEDORA-2006-511 2006-05-04
Fedora FEDORA-2006-510 2006-05-04

Comments (2 posted)

bzip2: race condition and infinite loop

Package(s):bzip2 CVE #(s):CAN-2005-0953 CAN-2005-1260
Created:May 17, 2005 Updated:January 10, 2007
Description: A race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. Also specially crafted bzip2 archives may cause an infinite loop in the decompressor.
Alerts:
rPath rPSA-2007-0004-1 2007-01-09
Debian DSA-741-1 2005-07-07
Red Hat RHSA-2005:474-01 2005-06-16
OpenPKG OpenPKG-SA-2005.008 2005-06-10
SuSE SUSE-SR:2005:015 2005-06-07
Debian DSA-730-1 2005-05-27
Mandriva MDKSA-2005:091 2005-05-18
Ubuntu USN-127-1 2005-05-17

Comments (2 posted)

cpio: arbitrary code execution

Package(s):cpio CVE #(s):CVE-2005-4268
Created:January 2, 2006 Updated:March 17, 2010
Description: Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).
Alerts:
CentOS CESA-2010:0145 2010-03-17
Red Hat RHSA-2010:0145-01 2010-03-15
rPath rPSA-2007-0094-1 2007-05-07
Red Hat RHSA-2007:0245-02 2007-05-01
Ubuntu USN-234-1 2006-01-02

Comments (none posted)

vixie-cron: privilege escalation

Package(s):cron CVE #(s):CVE-2006-2607
Created:May 31, 2006 Updated:June 1, 2009
Description: The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root.
Alerts:
Ubuntu USN-778-1 2009-06-01
Red Hat RHSA-2006:0539-01 2006-07-12
Gentoo 200606-07 2006-06-09
SuSE SUSE-SA:2006:027 2006-05-31
rPath rPSA-2006-0082-1 2006-05-25

Comments (1 posted)

cscope: buffer overflows

Package(s):cscope CVE #(s):CVE-2006-4262
Created:October 2, 2006 Updated:June 16, 2009
Description: Will Drewry of the Google Security Team discovered several buffer overflows in cscope, a source browsing tool, which might lead to the execution of arbitrary code.
Alerts:
CentOS CESA-2009:1101 2009-06-16
Red Hat RHSA-2009:1101-01 2009-06-15
Gentoo 200610-08 2006-10-20
Debian DSA-1186-1 2006-09-30

Comments (none posted)

cscope: buffer overflows

Package(s):cscope CVE #(s):CVE-2004-2541
Created:May 22, 2006 Updated:June 19, 2009
Description: A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.
Alerts:
CentOS CESA-2009:1102 2009-06-19
CentOS CESA-2009:1101 2009-06-16
Red Hat RHSA-2009:1102-01 2009-06-15
Red Hat RHSA-2009:1101-01 2009-06-15
Gentoo 200606-10 2006-06-11
Debian DSA-1064-1 2006-05-19

Comments (1 posted)

Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service

Package(s):cyrus-sasl CVE #(s):CVE-2006-1721
Created:April 21, 2006 Updated:September 4, 2007
Description: Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. An attacker could possibly exploit this vulnerability by sending specially crafted data stream to the Cyrus-SASL server, resulting in a Denial of Service even if the attacker is not able to authenticate.
Alerts:
Red Hat RHSA-2007:0878-01 2007-09-04
Red Hat RHSA-2007:0795-01 2007-09-04
SuSE SUSE-SA:2006:025 2006-05-05
Fedora FEDORA-2006-515 2006-05-04
Debian DSA-1042-1 2006-04-25
Mandriva MDKSA-2006:073 2006-04-24
Ubuntu USN-272-1 2006-04-24
Gentoo 200604-09 2006-04-21

Comments (none posted)

dbus: denial of service

Package(s):dbus CVE #(s):CVE-2006-6107
Created:December 15, 2006 Updated:February 12, 2007
Description: Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
Alerts:
rPath rPSA-2006-0233-1 2007-02-09
Red Hat RHSA-2007:0008-01 2007-02-08
Ubuntu USN-401-1 2007-01-04
OpenPKG OpenPKG-SA-2006.041 2006-12-21
Fedora FEDORA-2006-1475 2006-12-19
Mandriva MDKSA-2006:233 2006-12-18
Fedora FEDORA-2006-1464 2006-12-14
openSUSE openSUSE-SU-2012:1418-1 2012-10-31

Comments (none posted)

dovecot: index cache file handling error

Package(s):dovecot CVE #(s):CVE-2006-5973
Created:November 29, 2006 Updated:May 8, 2007
Description: The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable.
Alerts:
Fedora FEDORA-2006-1504 2006-12-27
Fedora FEDORA-2006-1396 2006-12-18
rPath rPSA-2006-0220-1 2006-11-30
Ubuntu USN-387-1 2006-11-28

Comments (none posted)

elinks: arbitrary file access

Package(s):elinks CVE #(s):CVE-2006-5925
Created:November 16, 2006 Updated:October 22, 2009
Description: The elinks text-mode browser has an arbitrary file access vulnerability in the Elinks SMB protocol handler. If a user can be tricked into visiting a specially crafted web page, arbitrary files may be read or written with the user's permissions.
Alerts:
Ubuntu USN-851-1 2009-10-21
Gentoo 200701-27 2007-01-30
OpenPKG OpenPKG-SA-2006.043 2006-12-26
Debian DSA-1240-1 2006-12-21
Gentoo 200612-16 2006-12-14
Debian DSA-1228-1 2006-12-05
Debian DSA-1226-1 2006-12-03
Fedora FEDORA-2006-1278 2006-11-21
Fedora FEDORA-2006-1277 2006-11-21
Mandriva MDKSA-2006:216 2006-11-20
Red Hat RHSA-2006:0742-01 2006-11-15

Comments (none posted)

ffmpeg: buffer overflows

Package(s):ffmpeg CVE #(s):CVE-2006-4799 CVE-2006-4800
Created:September 14, 2006 Updated:May 28, 2007
Description: the AVI processing code in FFmpeg has a number of buffer overflow vulnerabilities. If an attacker can trick a user into loading a specially crafted crafted AVI, arbitrary code can be executed with the user's privileges.
Alerts:
Gentoo 200609-09 2006-09-13

Comments (2 posted)

Mozilla stuff: multiple vulnerabilities

Package(s):firefox thunderbird seamonkey CVE #(s):CVE-2006-6497 CVE-2006-6498 CVE-2006-6501 CVE-2006-6502 CVE-2006-6503 CVE-2006-6504 CVE-2006-6505
Created:December 20, 2006 Updated:March 12, 2007
Description: The Mozilla Project has released new versions of firefox, thunderbird, and seamonkey to address the usual pile of security issues; see this announcement or this CERT advisory for details.
Alerts:
Debian DSA-1265-1 2007-03-10
Debian DSA-1258-1 2007-02-07
Debian DSA-1253-1 2006-01-27
Ubuntu USN-398-4 2007-01-27
SuSE SUSE-SA:2007:006 2007-01-12
Mandriva MDKSA-2007:011 2007-01-11
Mandriva MDKSA-2007:010 2007-01-11
Gentoo 200701-04 2007-01-10
Ubuntu USN-400-1 2007-01-04
Gentoo 200701-03 2007-01-04
Gentoo 200701-02 2007-01-04
Ubuntu USN-398-2 2007-01-03
Ubuntu USN-398-3 2007-01-04
Ubuntu USN-398-1 2007-01-02
Fedora FEDORA-2006-004 2007-01-02
rPath rPSA-2006-0234-2 2006-12-22
SuSE SUSE-SA:2006:080 2006-12-29
Slackware SSA:2006-357-03 2006-12-25
Slackware SSA:2006-357-01 2006-12-25
Slackware SSA:2006-357-02 2006-12-25
rPath rPSA-2006-0234-1 2006-12-22
Fedora FEDORA-2006-1499 2006-12-21
Fedora FEDORA-2006-1491 2006-12-20
Fedora FEDORA-2006-1492 2006-12-20
Red Hat RHSA-2006:0759-01 2006-12-19
Red Hat RHSA-2006:0760-01 2006-12-19
Red Hat RHSA-2006:0758-01 2006-12-19

Comments (none posted)

freeradius: several vulnerabilities

Package(s):freeradius CVE #(s):CVE-2005-4745 CVE-2005-4746
Created:August 8, 2006 Updated:April 24, 2007
Description: Several remote vulnerabilities have been discovered in freeradius, a high-performance RADIUS server, which may lead to SQL injection or denial of service.
Alerts:
Mandriva MDKSA-2007:092 2007-04-23
Debian DSA-1145-1 2006-08-08

Comments (none posted)

freetype: integer overflows

Package(s):freetype CVE #(s):CVE-2006-0747 CVE-2006-1861 CVE-2006-2493 CVE-2006-2661 CVE-2006-3467
Created:June 8, 2006 Updated:June 1, 2010
Description: The FreeType library has several integer overflow vulnerabilities. If a user can be tricked into installing a specially crafted font file, arbitrary code can be executed with the privilege of the user.
Alerts:
Gentoo 201006-01 2010-06-01
Fedora FEDORA-2009-5644 2009-05-28
Fedora FEDORA-2009-5558 2009-05-28
CentOS CESA-2009:0329 2009-05-22
Red Hat RHSA-2009:1062-01 2009-05-22
Red Hat RHSA-2009:0329-02 2009-05-22
Gentoo 200710-09 2007-10-09
Debian DSA-1178-1 2006-09-16
Ubuntu USN-341-1 2006-09-06
Gentoo 200609-04 2006-09-06
rPath rPSA-2006-0157-1 2006-08-25
Mandriva MDKSA-2006:148 2006-08-24
Red Hat RHSA-2006:0635-01 2006-08-21
Red Hat RHSA-2006:0634-01 2006-08-21
Fedora FEDORA-2006-912 2006-08-14
SuSE SUSE-SA:2006:045 2006-08-01
OpenPKG OpenPKG-SA-2006.017 2006-07-28
Ubuntu USN-324-1 2006-07-27
Slackware SSA:2006-207-02 2006-07-27
Mandriva MDKSA-2006:129 2006-07-20
Gentoo 200607-02 2006-07-09
SuSE SUSE-SA:2006:037 2006-06-27
Mandriva MDKSA-2006:099-1 2006-06-13
Mandriva MDKSA-2006:099 2006-06-12
rPath rPSA-2006-0100-1 2006-06-12
Debian DSA-1095-1 2006-06-10
Ubuntu USN-291-1 2006-06-08

Comments (none posted)

ftpd: privilege escalation

Package(s):ftpd CVE #(s):CVE-2006-5778
Created:November 10, 2006 Updated:February 14, 2007
Description: Ftpd is vulnerable to a privilege escalation attack, an incorrect seteuid() call can be used by an FTP user to gain unauthorized access to files or directories.
Alerts:
Gentoo 200611-05:02 2006-11-10
Debian DSA-1217-1 2006-11-20
Gentoo 200611-05 2006-11-10

Comments (none posted)

gcc: file overwrite vulnerability

Package(s):gcc CVE #(s):CVE-2006-3619
Created:September 6, 2006 Updated:March 14, 2008
Description: The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree.
Alerts:
Mandriva MDVSA-2008:066 2007-03-13
Red Hat RHSA-2007:0473-01 2007-06-11
Red Hat RHSA-2007:0220-02 2007-05-01
Debian DSA-1170-1 2006-09-06

Comments (none posted)

gdb: buffer overflow

Package(s):gdb CVE #(s):CVE-2006-4146
Created:September 15, 2006 Updated:June 12, 2007
Description: A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
Alerts:
Red Hat RHSA-2007:0469-01 2007-06-11
Red Hat RHSA-2007:0229-02 2007-05-01
Ubuntu USN-356-1 2006-10-02
Fedora FEDORA-2006-975 2006-09-14

Comments (none posted)

gdm: improper file permissions

Package(s):gdm CVE #(s):CVE-2006-1057
Created:April 19, 2006 Updated:May 2, 2007
Description: The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem.
Alerts:
Red Hat RHSA-2007:0286-02 2007-05-01
Mandriva MDKSA-2006:083 2006-05-09
Ubuntu USN-278-1 2006-05-03
Debian DSA-1040-1 2006-04-24
Fedora FEDORA-2006-338 2006-04-19

Comments (none posted)

gedit: format string vulnerability

Package(s):gedit CVE #(s):CAN-2005-1686
Created:June 9, 2005 Updated:February 5, 2009
Description: A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.
Alerts:
Fedora FEDORA-2009-1189 2009-01-29
Fedora FEDORA-2009-1187 2009-01-29
Debian DSA-753-1 2005-07-12
Mandriva MDKSA-2005:102 2005-06-15
Red Hat RHSA-2005:499-01 2005-06-13
Gentoo 200506-09 2005-06-11
Ubuntu USN-138-1 2005-06-09

Comments (1 posted)

gnupg: stack overwrite

Package(s):gnupg CVE #(s):CVE-2006-6235
Created:December 12, 2006 Updated:March 13, 2007
Description: A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
Alerts:
Fedora FEDORA-2007-316 2007-03-12
Fedora FEDORA-2007-315 2007-03-12
SuSE SUSE-SA:2006:075 2006-12-13
Mandriva MDKSA-2006:228 2006-12-11

Comments (3 posted)

grip: buffer overflow

Package(s):grip CVE #(s):CAN-2005-0706
Created:March 10, 2005 Updated:November 19, 2008
Description: Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:
Fedora FEDORA-2008-9604 2008-11-19
Fedora FEDORA-2008-9521 2008-11-19
Fedora-Legacy FLSA:152919 2005-09-15
Mandriva MDKSA-2005:074 2005-04-20
Mandriva MDKSA-2005:075 2005-04-20
Gentoo 200504-07 2005-04-08
Mandrake MDKSA-2005:066 2005-04-01
Red Hat RHSA-2005:304-01 2005-03-28
Gentoo 200503-21 2005-03-17
Fedora FEDORA-2005-203 2005-03-09
Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

gv: stack-based buffer overflow

Package(s):gv CVE #(s):CVE-2006-5864
Created:November 20, 2006 Updated:April 9, 2007
Description: Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.
Alerts:
Gentoo 200704-06 2007-04-06
Gentoo 200703-24 2007-03-26
Debian DSA-1243-1 2006-12-28
Debian DSA-1214-2 2006-12-27
Mandriva MDKSA-2006:229 2006-12-13
rPath rPSA-2006-0230-1 2006-12-12
Fedora FEDORA-2006-1438 2006-12-11
Fedora FEDORA-2006-1437 2006-12-11
Ubuntu USN-390-3 2006-12-06
Ubuntu USN-390-2 2006-12-06
Mandriva MDKSA-2006:214-1 2006-12-04
Ubuntu USN-390-1 2006-11-30
Gentoo 200611-20 2006-11-24
Debian DSA-1214-1 2006-11-20
Mandriva MDKSA-2006:214 2006-11-17

Comments (none posted)

gzip: multiple vulnerabilities

Package(s):gzip CVE #(s):CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338
Created:September 19, 2006 Updated:January 20, 2010
Description: Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash.

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code.

Alerts:
Debian DSA-1974-1 2010-01-20
Fedora FEDORA-2007-557 2007-05-31
Gentoo 200611-24 2006-11-28
Fedora-Legacy FLSA:211760 2006-11-13
Fedora FEDORA-2006-989 2006-10-10
SuSE SUSE-SA:2006:056 2006-09-26
Gentoo 200609-13 2006-09-23
Trustix TSLSA-2006-0052 2006-09-22
Mandriva MDKSA-2006:167 2006-09-20
Slackware SSA:2006-262-01 2006-09-20
OpenPKG OpenPKG-SA-2006.020 2006-09-20
Debian DSA-1181-1 2006-09-19
rPath rPSA-2006-0170-1 2006-09-19
Ubuntu USN-349-1 2006-09-19
Red Hat RHSA-2006:0667-01 2006-09-19

Comments (1 posted)

gzip: arbitrary command execution

Package(s):gzip CVE #(s):CAN-2005-0758
Created:August 1, 2005 Updated:January 10, 2007
Description: zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names.
Alerts:
OpenPKG OpenPKG-SA-2007.002 2007-01-08
Mandriva MDKSA-2006:027 2006-01-30
Mandriva MDKSA-2006:026 2006-01-30
Fedora-Legacy FLSA:158801 2005-11-14
Fedora-Legacy FLSA:157696 2005-08-10
Ubuntu USN-161-1 2005-08-04
Ubuntu USN-158-1 2005-08-01

Comments (2 posted)

imagemagick: buffer overflows

Package(s):imagemagick CVE #(s):CVE-2006-5868
Created:November 28, 2006 Updated:February 16, 2007
Description: Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.
Alerts:
Red Hat RHSA-2007:0015-01 2007-02-15
Mandriva MDKSA-2006:223 2006-12-01
Ubuntu USN-386-1 2006-11-28

Comments (1 posted)

ImageMagick: buffer overflows

Package(s):ImageMagick CVE #(s):CVE-2006-5456
Created:October 31, 2006 Updated:March 8, 2007
Description: Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.
Alerts:
Slackware SSA:2007-066-06 2007-03-08
rPath rPSA-2007-0029-1 2007-02-08
rPath rPSA-2006-0218-1 2006-11-27
Gentoo 200611-19 2006-11-24
Fedora FEDORA-2006-1285 2006-11-22
Fedora FEDORA-2006-1286 2006-11-22
Debian DSA-1213-1 2006-11-19
SuSE SUSE-SA:2006:066 2006-11-14
Gentoo 200611-07 2006-11-13
Ubuntu USN-372-1 2006-11-01
Mandriva MDKSA-2006:193 2006-10-30

Comments (2 posted)

imlib2: arbitrary code execution

Package(s):imlib2 CVE #(s):CVE-2006-4806 CVE-2006-4807 CVE-2006-4808 CVE-2006-4809
Created:November 6, 2006 Updated:August 13, 2007
Description: M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user were tricked into viewing or processing a specially crafted image with an application that uses imlib2, the flaws could be exploited to execute arbitrary code with the user's privileges.
Alerts:
Mandriva MDKSA-2007:156 2007-08-10
Gentoo 200612-20 2006-12-20
Fedora FEDORA-EXTRAS-2006-004 2006-11-09
Mandriva MDKSA-2006:198-1 2006-11-06
Mandriva MDKSA-2006:198 2006-11-06
Ubuntu USN-376-2 2006-11-06
Ubuntu USN-376-1 2006-11-03

Comments (none posted)

kdegraphics: stack overflow

Package(s):kdegraphics CVE #(s):CVE-2006-6297
Created:December 12, 2006 Updated:January 13, 2007
Description: A stack overflow in the KFILE JPEG (kfile_jpeg) plugin in kdegraphics3, as used by konqueror, digikam, and other KDE image browsers, allows remote attackers to cause a denial of service (stack consumption) via a crafted EXIF section in a JPEG file, which results in an infinite recursion.
Alerts:
Gentoo 200701-05 2007-01-12
Mandriva MDKSA-2006:227 2006-12-11

Comments (none posted)

kdelibs: integer overflow

Package(s):kdelibs CVE #(s):CVE-2006-4811
Created:October 18, 2006 Updated:March 5, 2007
Description: The KDE khtml library can pass untrusted parameters into Qt, allowing a hostile user to trigger an integer overflow there and execute arbitrary code.
Alerts:
Gentoo 200703-06 2007-03-04
Gentoo 200611-02 2006-11-06
Red Hat RHSA-2006:0725-01 2006-11-01
Debian DSA-1200-1 2006-10-30
Slackware SSA:2006-298-01 2006-10-26
rPath rPSA-2006-0195-2 2006-10-18
Mandriva MDKSA-2006:186 2006-10-19
rPath rPSA-2006-0195-1 2006-10-18
Red Hat RHSA-2006:0720-01 2006-10-18

Comments (none posted)

kdelibs: kate backup file permission leak

Package(s):kdelibs kate kwrite CVE #(s):CAN-2005-1920
Created:July 19, 2005 Updated:September 21, 2010
Description: Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information.
Alerts:
Gentoo 200611-21 2006-11-27
Debian DSA-804-2 2005-11-10
Debian DSA-804-1 2005-09-08
Red Hat RHSA-2005:612-01 2005-07-27
Ubuntu USN-150-1 2005-07-21
Mandriva MDKSA-2005:122 2005-07-20
Fedora FEDORA-2005-594 2005-07-19

Comments (1 posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-4623
Created:October 18, 2006 Updated:November 14, 2007
Description: The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data.
Alerts:
Ubuntu USN-489-1 2007-07-19
rPath rPSA-2006-0194-1 2006-10-17

Comments (none posted)

kernel: bridging code buffer overflow

Package(s):kernel CVE #(s):CVE-2006-5751
Created:December 6, 2006 Updated:January 3, 2007
Description: A buffer overflow in the bridging code in kernels through 2.6.18.3 can lead to a denial of service or potential code execution. The 2.6.18.4 kernel contains the fix.
Alerts:
Mandriva MDKSA-2007:002 2007-01-02
SuSE SUSE-SA:2006:079 2006-12-21
Fedora FEDORA-2006-1471 2006-12-18
Fedora FEDORA-2006-1470 2006-12-18
Ubuntu USN-395-1 2006-12-13
Debian DSA-1233-1 2006-12-10
rPath rPSA-2006-0226-1 2006-12-06

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-4535 CVE-2006-4538
Created:September 18, 2006 Updated:January 5, 2009
Description: Sridhar Samudrala discovered a local denial of service vulnerability in the handling of SCTP sockets. By opening such a socket with a special SO_LINGER value, a local attacker could exploit this to crash the kernel. (CVE-2006-4535)

Kirill Korotaev discovered that the ELF loader on the ia64 and sparc platforms did not sufficiently verify the memory layout. By attempting to execute a specially crafted executable, a local user could exploit this to crash the kernel. (CVE-2006-4538)

Alerts:
Red Hat RHSA-2008:0787-01 2009-01-05
Red Hat RHSA-2007:1049-01 2007-12-03
Mandriva MDKSA-2006:182 2006-10-11
Red Hat RHSA-2006:0689-01 2006-10-05
Debian DSA-1184-2 2006-09-26
Debian DSA-1184-1 2006-09-25
Debian DSA-1183-1 2006-09-25
Ubuntu USN-347-1 2006-09-18

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-4572 CVE-2006-4997
Created:November 6, 2006 Updated:January 17, 2007
Description: Some vulnerabilities were discovered in the Linux 2.6 kernel:

There are possibly exploitable bugs in the netfilter for IPv6 code. (CVE-2006-4572)

The ATM subsystem of the Linux kernel could allow a remote attacker to cause a Denial of Service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed. (CVE-2006-4997)

Alerts:
Red Hat RHSA-2007:0013-01 2007-01-17
Red Hat RHSA-2007:0012-01 2007-01-17
Debian DSA-1237-1 2006-12-17
rPath rPSA-2006-0204-1 2006-11-09
Mandriva MDKSA-2006:197 2006-11-03

Comments (none posted)

kernel: denial of service by memory consumption

Package(s):kernel CVE #(s):CVE-2006-2936
Created:July 17, 2006 Updated:November 14, 2007
Description: The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the driver can handle, which causes the data to be queued.
Alerts:
SuSE SUSE-SA:2007:035 2007-06-14
Mandriva MDKSA-2006:151 2006-08-25
Mandriva MDKSA-2006:150 2006-08-25
Ubuntu USN-331-1 2006-08-03
rPath rPSA-2006-0130-1 2006-07-17

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-5757
Created:November 13, 2006 Updated:November 14, 2007
Description: From the MOKB-05-11-2006 advisory: "The ISO9660 filesystem handling code of the Linux 2.6.x kernel fails to properly handle corrupted data structures, leading to an exploitable denial of service condition. This particular vulnerability seems to be caused by a race condition and a signedness issue. When performing a read operation on a corrupted ISO9660 fs stream, the isofs_get_blocks() function will enter an infinite loop when __find_get_block_slow() callback from sb_getblk() fails ("due to various races between file io on the block device and getblk")."
Alerts:
Fedora FEDORA-2007-599 2007-06-21
Fedora FEDORA-2006-1223 2006-11-12
Fedora FEDORA-2006-1221 2006-11-10

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-2935 CVE-2006-4145 CVE-2006-3745
Created:September 1, 2006 Updated:July 30, 2008
Description: Previous versions of the kernel package are subject to several vulnerabilities. Certain malformed UDF filesystems can cause the system to crash (denial of service). Malformed CDROM firmware or USB storage devices (such as USB keys) could cause system crash (denial of service), and if they were intentionally malformed, can cause arbitrary code to run with elevated privileges. In addition, the SCTP protocol is subject to a remote system crash (denial of service) attack.
Alerts:
Red Hat RHSA-2008:0665-01 2008-07-24
SuSE SUSE-SA:2007:053 2007-10-12
SuSE SUSE-SA:2006:064 2006-11-10
Red Hat RHSA-2006:0710-01 2006-10-19
SuSE SUSE-SA:2006:057 2006-09-28
Trustix TSLSA-2006-0051 2006-09-15
Ubuntu USN-346-2 2006-09-14
Ubuntu USN-346-1 2006-09-14
rPath rPSA-2006-0162-1 2006-08-31

Comments (none posted)

koffice: integer overflow

Package(s):koffice CVE #(s):CVE-2006-6120
Created:November 30, 2006 Updated:February 20, 2007
Description: The KOffice office suite has an integer overflow vulnerability. If an attacker can trick a user into opening a specially crafted PowerPoint (PPT) file, KOffice can be caused to crash or possibly execute arbitrary code with the user's privileges.
Alerts:
Red Hat RHSA-2007:0010-01 2007-02-20
Slackware SSA:2006-357-04 2006-12-25
Gentoo 200612-05 2006-12-10
Mandriva MDKSA-2006:222 2006-12-01
Ubuntu USN-388-1 2006-11-29

Comments (none posted)

krb5: local privilege escalation

Package(s):krb5 CVE #(s):CVE-2006-3083
Created:August 9, 2006 Updated:July 7, 2010
Description: Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges.
Alerts:
Mandriva MDVSA-2010:129 2010-07-07
SuSE SUSE-SR:2006:022 2006-09-08
Gentoo 200608-21 2006-08-23
Ubuntu USN-334-1 2006-08-16
Fedora FEDORA-2006-905 2006-08-09
Mandriva MDKSA-2006:139 2006-09-09
Gentoo 200608-15 2006-08-10
rPath rPSA-2006-0150-1 2006-08-09
Red Hat RHSA-2006:0612-01 2006-08-08
Debian DSA-1146-1 2006-08-09

Comments (none posted)

libgadu: memory alignment bug

Package(s):libgadu CVE #(s):CAN-2005-2370
Created:July 29, 2005 Updated:June 25, 2007
Description: Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment error in libgadu (from ekg, console Gadu Gadu client, an instant messaging program) which is included in gaim, a multi-protocol instant messaging client, as well. This can not be exploited on the x86 architecture but on others, e.g. on Sparc and lead to a bus error, in other words a denial of service.
Alerts:
Debian DSA-813-1 2005-09-15
Red Hat RHSA-2005:627-01 2005-08-09
Debian DSA-769-1 2005-07-29

Comments (none posted)

libgd2: denial of service

Package(s):libgd2 CVE #(s):CVE-2006-2906
Created:June 14, 2006 Updated:January 16, 2007
Description: Certain GIF images can cause libgd2 to go into an infinite loop, adversely affecting the performance of image processing applications.
Alerts:
rPath rPSA-2007-0008-1 2007-01-15
Debian DSA-1117-1 2006-07-21
Mandriva MDKSA-2006:113 2006-06-27
Mandriva MDKSA-2006:112 2006-06-27
Ubuntu USN-298-1 2006-06-13

Comments (none posted)

libgsf: heap buffer overflow

Package(s):libgsf CVE #(s):CVE-2006-4514
Created:November 30, 2006 Updated:January 11, 2007
Description: The GNOME library libgsf, which is used for writing structured file formats, has a heap buffer overflow that can be exploited for the purpose of executing arbitrary code.
Alerts:
Red Hat RHSA-2007:0011-01 2007-01-11
SuSE SUSE-SA:2006:076 2006-12-14
rPath rPSA-2006-0232-1 2006-12-14
Gentoo 200612-13 2006-12-12
Fedora FEDORA-2006-1417 2006-12-07
Fedora FEDORA-2006-1399 2006-12-05
Ubuntu USN-391-1 2006-12-04
Mandriva MDKSA-2006:220 2006-11-30
Debian DSA-1221-1 2006-11-30

Comments (none posted)

libmodplug: boundary errors

Package(s):libmodplug CVE #(s):CVE-2006-4192
Created:December 11, 2006 Updated:May 4, 2011
Description: Luigi Auriemma has reported various boundary errors in load_it.cpp and a boundary error in the "CSoundFile::ReadSample()" function in sndfile.cpp. A remote attacker can entice a user to read crafted modules or ITP files, which may trigger a buffer overflow resulting in the execution of arbitrary code with the privileges of the user running the application.
Alerts:
CentOS CESA-2011:0477 2011-05-04
Red Hat RHSA-2011:0477-01 2011-05-02
Ubuntu USN-521-1 2007-09-27
Mandriva MDKSA-2007:001 2007-01-02
Gentoo 200612-04 2006-12-10

Comments (none posted)

libpng: buffer overflow

Package(s):libpng CVE #(s):CVE-2006-3334
Created:July 19, 2006 Updated:December 15, 2008
Description: In pngrutil.c, the function png_decompress_chunk() allocates insufficient space for an error message, potentially overwriting stack data, leading to a buffer overflow.
Alerts:
Gentoo 200812-15 2008-12-14
Mandriva MDKSA-2006:213 2006-11-16
rPath rPSA-2006-0133-1 2006-07-19
Gentoo 200607-06 2006-07-19

Comments (none posted)

libpng: heap based buffer overflow

Package(s):libpng CVE #(s):CVE-2006-0481
Created:February 13, 2006 Updated:December 15, 2008
Description: A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim.
Alerts:
Gentoo 200812-15 2008-12-14
Red Hat RHSA-2006:0205-01 2006-02-13

Comments (1 posted)

libtiff: buffer overflow

Package(s):libtiff CVE #(s):CVE-2006-2193
Created:June 15, 2006 Updated:September 1, 2008
Description: The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters in the DocumentName tag to overflow a buffer, causing a denial of service, and possibly the execution of arbitrary code.
Alerts:
CentOS CESA-2008:0848 2008-08-30
Red Hat RHSA-2008:0848-01 2008-08-28
Fedora FEDORA-2006-952 2006-09-05
SuSE SUSE-SA:2006:044 2006-08-01
Gentoo 200607-03 2006-07-09
SuSE SUSE-SR:2006:014 2006-06-20
Trustix TSLSA-2006-0036 2006-06-16
Mandriva MDKSA-2006:102 2006-06-14

Comments (none posted)

libvncserver: authentication bypass

Package(s):libvncserver CVE #(s):CVE-2006-2450
Created:August 4, 2006 Updated:March 19, 2007
Description: LibVNCServer fails to properly validate protocol types effectively letting users decide what protocol to use, such as "Type 1 - None". LibVNCServer will accept this security type, even if it is not offered by the server.
Alerts:
Gentoo 200703-19 2007-03-18
Gentoo 200608-12 2006-08-07
Gentoo 200608-05 2006-08-04

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

linux-restricted-modules: nVidia driver vulnerability

Package(s):linux-restricted-modules CVE #(s):CVE-2006-5379
Created:November 6, 2006 Updated:January 11, 2007
Description: Derek Abdine discovered that the NVIDIA Xorg driver did not correctly verify the size of buffers used to render text glyphs. When displaying very long strings of text, the Xorg server would crash. If a user were tricked into viewing a specially crafted series of glyphs, this flaw could be exploited to run arbitrary code with root privileges.
Alerts:
Mandriva MDKSA-2007:007 2007-01-10
Gentoo 200611-03 2006-11-07
Ubuntu USN-377-1 2006-11-03

Comments (none posted)

lynx: arbitrary command execution

Package(s):lynx CVE #(s):CVE-2005-2929
Created:November 14, 2005 Updated:September 14, 2009
Description: An arbitrary command execute bug was found in the lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx.
Alerts:
Gentoo 200909-15 2009-09-12
Fedora-Legacy FLSA:152832 2005-12-17
OpenPKG OpenPKG-SA-2005.026 2005-12-03
Fedora FEDORA-2005-1079 2005-11-14
Fedora FEDORA-2005-1078 2005-11-14
Gentoo 200511-09 2005-11-13
Mandriva MDKSA-2005:211 2005-11-12
Red Hat RHSA-2005:839-01 2005-11-11

Comments (none posted)

mysql: format string bug

Package(s):mysql CVE #(s):CVE-2006-3469
Created:July 21, 2006 Updated:July 30, 2008
Description: Jean-David Maillefer discovered a format string bug in the date_format() function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server.
Alerts:
Red Hat RHSA-2008:0768-01 2008-07-24
Slackware SSA:2006-211-01 2006-07-31
Ubuntu USN-321-1 2006-07-21

Comments (none posted)

MySQL: privilege violations

Package(s):mysql CVE #(s):CVE-2006-4031 CVE-2006-4226
Created:August 25, 2006 Updated:July 30, 2008
Description: MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy (CVE-2006-4031).

MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions (CVE-2006-4226).

Alerts:
Red Hat RHSA-2008:0768-01 2008-07-24
Red Hat RHSA-2008:0364-01 2008-05-21
Red Hat RHSA-2007:0152-01 2007-04-03
Red Hat RHSA-2007:0083-01 2007-02-19
Fedora FEDORA-2006-1298 2006-11-27
Fedora FEDORA-2006-1297 2006-11-27
Ubuntu USN-338-1 2006-09-05
Mandriva MDKSA-2006:149 2006-08-24

Comments (none posted)

MySQL: logging bypass

Package(s):mysql CVE #(s):CVE-2006-0903
Created:April 4, 2006 Updated:May 21, 2008
Description: MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
Alerts:
Red Hat RHSA-2008:0364-01 2008-05-21
Ubuntu USN-274-2 2006-05-15
Ubuntu USN-274-1 2006-04-27
Mandriva MDKSA-2006:064 2006-04-03

Comments (2 posted)

nbd: arbitrary code execution

Package(s):nbd CVE #(s):CVE-2005-3534
Created:January 6, 2006 Updated:March 7, 2011
Description: Kurt Fitzner discovered that the NBD (network block device) server did not correctly verify the maximum size of request packets. By sending specially crafted large request packets, a remote attacker who is allowed to access the server could exploit this to execute arbitrary code with root privileges.
Alerts:
SuSE SUSE-SR:2006:001 2006-01-13
Ubuntu USN-237-1 2006-01-06

Comments (none posted)

ncompress: buffer underflow

Package(s):ncompress CVE #(s):CVE-2006-1168
Created:August 10, 2006 Updated:February 21, 2012
Description: The ncompress compression utility has a missing boundary check. A local user can use a maliciously created file to cause a a .bss buffer underflow.
Alerts:
Gentoo 200610-03 2006-10-06
Red Hat RHSA-2006:0663-01 2006-09-12
Mandriva MDKSA-2006:140 2006-08-09
Debian DSA-1149-1 2006-08-10
Red Hat RHSA-2012:0308-03 2012-02-21
Scientific Linux SL-busy-20120321 2012-03-21
Red Hat RHSA-2012:0810-04 2012-06-20
Scientific Linux SL-busy-20120709 2012-07-09
Mageia MGASA-2012-0171 2012-07-19
Mandriva MDVSA-2012:129 2012-08-10
Mandriva MDVSA-2012:129-1 2012-08-10

Comments (none posted)

openldap: security bypass

Package(s):openldap CVE #(s):CVE-2006-4600
Created:September 29, 2006 Updated:June 12, 2007
Description: slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Alerts:
Red Hat RHSA-2007:0430-01 2007-06-11
Red Hat RHSA-2007:0310-02 2007-05-01
Trustix TSLSA-2006-0055 2006-10-06
rPath rPSA-2006-0176-1 2006-09-29
Mandriva MDKSA-2006:171 2006-09-28

Comments (none posted)

openoffice.org: several vulnerabilities

Package(s):openoffice.org CVE #(s):CVE-2006-2198 CVE-2006-2199 CVE-2006-3117
Created:June 30, 2006 Updated:January 4, 2007
Description: Several vulnerabilities have been discovered in OpenOffice.org, a free office suite.
  • It turned out to be possible to embed arbitrary BASIC macros in documents in a way that OpenOffice.org does not see them but executes them anyway without any user interaction. (CVE-2006-2198)
  • It is possible to evade the Java sandbox with specially crafted Java applets. (CVE-2006-2199)
  • Loading malformed XML documents can cause buffer overflows and cause a denial of service or execute arbitrary code. (CVE-2006-3117)
Alerts:
Fedora FEDORA-2007-005 2007-01-03
rPath rPSA-2006-0173-1 2006-09-26
Gentoo 200607-12 2006-07-28
Ubuntu USN-313-2 2006-07-19
Ubuntu USN-313-1 2006-07-11
Mandriva MDKSA-2006:118 2006-07-07
Debian DSA-1104-2 2006-07-06
Red Hat RHSA-2006:0573-01 2006-07-03
SuSE SUSE-SA:2006:040 2006-07-03
Fedora FEDORA-2006-770 2006-07-03
Fedora FEDORA-2006-764 2006-06-30
Debian DSA-1104-1 2006-06-30

Comments (none posted)

OpenSSH: denial of service

Package(s):openssh CVE #(s):CVE-2006-4925 CVE-2006-5052
Created:October 6, 2006 Updated:November 15, 2007
Description: packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.

An unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."

Alerts:
Red Hat RHSA-2007:0703-02 2007-11-15
Red Hat RHSA-2007:0540-04 2007-11-07
Fedora FEDORA-2007-394 2007-04-03
Gentoo 200611-06 2006-11-13
SuSE SUSE-SA:2006:062 2006-10-20
rPath rPSA-2006-0185-1 2006-10-05

Comments (none posted)

openssh: privilege separation issue

Package(s):openssh CVE #(s):CVE-2006-5794
Created:November 8, 2006 Updated:April 5, 2007
Description: From the OpenSSH 4.5 announcement: "Fix a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. This bug is not known to be exploitable in the absence of additional vulnerabilities."
Alerts:
Fedora FEDORA-2007-395 2007-04-03
Fedora FEDORA-2006-1215 2006-11-20
Fedora FEDORA-2006-1214 2006-11-20
SuSE SUSE-SR:2006:026 2006-11-17
Trustix TSLSA-2006-0063 2006-11-15
Red Hat RHSA-2006:0738-01 2006-11-15
rPath rPSA-2006-0207-1 2006-11-09
Mandriva MDKSA-2006:204 2006-11-08
OpenPKG OpenPKG-SA-2006.032 2006-11-08

Comments (none posted)

openssh: remote denial of service

Package(s):openssh CVE #(s):CVE-2006-4924 CVE-2006-5051
Created:September 27, 2006 Updated:September 17, 2008
Description: Openssh 4.4 fixes some security issues, including a pre-authentication denial of service, an unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort could be used to determine the validity of usernames on some platforms.
Alerts:
Debian DSA-1638-1 2008-09-16
Debian DSA-1212-1 2006-11-15
Fedora FEDORA-2006-1011 2006-10-03
Debian DSA-1189-1 2006-10-04
Mandriva MDKSA-2006:179 2006-10-03
Ubuntu USN-355-1 2006-10-02
OpenPKG OpenPKG-SA-2006.022 2006-10-01
Slackware SSA:2006-272-02 2006-09-29
Red Hat RHSA-2006:0698-01 2006-09-28
Red Hat RHSA-2006:0697-01 2006-09-28
Gentoo 200609-17:02 2006-09-27
rPath rPSA-2006-0174-1 2006-09-27
Gentoo 200609-17 2006-09-27

Comments (none posted)

php: several vulnerabilities

Package(s):php CVE #(s):CVE-2006-4481 CVE-2006-4484 CVE-2006-4485
Created:September 8, 2006 Updated:June 13, 2008
Description: The file_exists and imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481).

A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484).

The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).

Alerts:
SuSE SUSE-SR:2008:013 2008-06-13
Mandriva MDVSA-2008:077 2007-03-26
SuSE SUSE-SR:2008:005 2008-03-06
Red Hat RHSA-2008:0146-01 2008-02-28
Fedora FEDORA-2008-1643 2008-02-13
Foresight FLEA-2008-0007-1 2008-02-11
Fedora FEDORA-2008-1122 2008-02-05
Fedora FEDORA-2008-1131 2008-02-05
SuSE SUSE-SR:2008:003 2008-02-07
Mandriva MDVSA-2008:038 2007-02-07
rPath rPSA-2008-0046-1 2008-02-06
Gentoo 200802-01 2008-02-06
rPath rPSA-2006-0182-1 2006-10-05
SuSE SUSE-SA:2006:052 2006-09-21
Red Hat RHSA-2006:0669-01 2006-09-21
Mandriva MDKSA-2006:162 2006-09-07

Comments (1 posted)

php: buffer overflows

Package(s):php CVE #(s):CVE-2006-5465
Created:November 3, 2006 Updated:January 18, 2010
Description: The Hardened-PHP Project discovered buffer overflows in htmlentities/htmlspecialchars internal routines to the PHP Project. Of course the whole purpose of these functions is to be filled with user input. (The overflow can only be when UTF-8 is used)
Alerts:
Mandriva MDVSA-2010:007 2010-01-15
SuSE SUSE-SA:2006:067 2006-11-15
rPath rPSA-2006-0205-1 2006-11-09
Red Hat RHSA-2006:0731-01 2006-11-10
Red Hat RHSA-2006:0730-01 2006-11-06
Debian DSA-1206-1 2006-11-06
Fedora FEDORA-2006-1169 2006-11-06
Fedora FEDORA-2006-1168 2006-11-06
Slackware SSA:2006-307-01 2006-11-06
OpenPKG OpenPKG-SA-2006.028 2006-11-06
Ubuntu USN-375-1 2006-11-02
Mandriva MDKSA-2006:196 2006-11-02

Comments (none posted)

phpbb2: missing input sanitizing

Package(s):phpbb2 CVE #(s):CVE-2006-1896
Created:May 22, 2006 Updated:February 11, 2008
Description: It was discovered that phpbb2, a web based bulletin board, insufficiently sanitizes values passed to the "Font Color 3" setting, which might lead to the execution of injected code by admin users.
Alerts:
Debian DSA-1066-1 2006-05-20

Comments (none posted)

phpbb2: multiple vulnerabilities

Package(s):phpbb2 CVE #(s):CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537
Created:December 22, 2005 Updated:February 11, 2008
Description: The phpbb2 web forum has a number of vulnerabilities including: a web script injection problem, a protection mechanism bypass, a security check bypass, a remote global variable bypass, cross site scripting vulnerabilities, an SQL injection vulnerability, a remote regular expression modification problem, missing input sanitizing, and a missing request validation problem.
Alerts:
Debian DSA-925-1 2005-12-22

Comments (none posted)

postgresql: SQL injection

Package(s):postgresql CVE #(s):CVE-2006-2313 CVE-2006-2314
Created:May 24, 2006 Updated:June 6, 2007
Description: The PostgreSQL team has put out a set of "urgent updates" (in the form of the 7.3.15, 7.4.13, 8.0.8, and 8.1.4 releases) closing a newly-discovered set of SQL injection issues. Details about the problem can be found on the technical information page; in short: multi-byte encodings can be used to defeat normal string sanitizing techniques. The update fixes one problem related to invalid multi-byte characters, but punts on another by simply disallowing the old, unsafe technique of escaping single quotes with a backslash.
Alerts:
Fedora FEDORA-2007-0249 2007-06-06
Trustix TSLSA-2006-0059 2006-10-27
Gentoo 200607-04 2006-07-09
SuSE SUSE-SA:2006:030 2006-06-09
Ubuntu USN-288-3 2006-06-09
Ubuntu USN-288-2 2006-06-09
Mandriva MDKSA-2006:098 2006-06-07
Debian DSA-1087-1 2006-06-03
Ubuntu USN-288-1 2006-05-29
rPath rPSA-2006-0080-1 2006-05-24
Red Hat RHSA-2006:0526-02 2006-05-23
Fedora FEDORA-2006-578 2006-05-23
Fedora FEDORA-2006-579 2006-05-23

Comments (1 posted)

proftpd: denial of service

Package(s):proftpd CVE #(s):CVE-2006-5815
Created:November 17, 2006 Updated:January 24, 2007
Description: A denial of service (DoS) vulnerability exists in the FTP server ProFTPD, up to and including version 1.3.0. The flaw is due to both a potential bus error and a definitive buffer overflow in the code which determines the FTP command buffer size limit. The vulnerability can be exploited only if the "CommandBufferSize" directive is explicitly used in the server configuration.
Alerts:
Mandriva MDKSA-2006:217-2 2007-01-23
Trustix TSLSA-2006-0070 2006-12-08
Slackware SSA:2006-335-02 2006-12-04
Debian DSA-1222-2 2006-12-01
Gentoo 200611-26 2006-11-30
Mandriva MDKSA-2006:217-1 2006-11-30
Debian DSA-1222-1 2006-11-30
Trustix TSLSA-2006-0066 2006-11-28
Debian DSA-1218-1 2006-11-21
Mandriva MDKSA-2006:217 2006-11-20
OpenPKG OpenPKG-SA-2006.035 2006-11-17

Comments (none posted)

proftpd: stack-based buffer overflow

Package(s):proftpd CVE #(s):CVE-2006-6563
Created:December 18, 2006 Updated:February 14, 2007
Description: A vulnerability exists in the FTP server ProFTPD, versions up to and including 1.3.0a. The vulnerability is caused by a stack-based buffer overflow in the "pr_ctrls_recv_request" function of the "Controls" feature. This is an optional feature of ProFTPD server which is by default disabled in OpenPKG and probably other distributions.
Alerts:
Gentoo 200702-02 2007-02-13
Trustix TSLSA-2006-0074 2006-12-22
Mandriva MDKSA-2006:232 2006-12-18
OpenPKG OpenPKG-SA-2006.039 2006-12-18

Comments (1 posted)

quake: buffer overflow

Package(s):quake3-bin CVE #(s):CVE-2006-2236
Created:May 10, 2006 Updated:January 12, 2009
Description: Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server.
Alerts:
Gentoo 200901-06 2009-01-11
Gentoo 200605-12 2006-05-10

Comments (none posted)

rpm: arbitrary code execution

Package(s):rpm CVE #(s):CVE-2006-5466
Created:November 6, 2006 Updated:August 28, 2007
Description: An error was found in the RPM library's handling of query reports. In some locales, certain RPM packages would cause the library to crash. If a user was tricked into querying a specially crafted RPM package, the flaw could be exploited to execute arbitrary code with the user's privileges.
Alerts:
Fedora FEDORA-2007-668 2007-08-27
Gentoo 200611-08 2006-11-13
Mandriva MDKSA-2006:200 2006-11-07
Ubuntu USN-378-1 2006-11-04

Comments (none posted)

shadow-utils: mailbox creation vulnerability

Package(s):shadow-utils CVE #(s):CVE-2006-1174
Created:May 25, 2006 Updated:June 12, 2007
Description: The useradd tool from the shadow-utils package has a potential security problem. When a new user's mailbox is created, the permissions are set to random garbage from the stack, potentially allowing the file to be read or written during the time before fchmod() is called.
Alerts:
Red Hat RHSA-2007:0431-01 2007-06-11
rPath rPSA-2007-0096-1 2007-05-11
Red Hat RHSA-2007:0276-02 2007-05-01
Gentoo 200606-02 2006-06-07
Mandriva MDKSA-2006:090 2006-05-24

Comments (none posted)

squirrelmail: multiple cross-site scripting vulnerabilities

Package(s):squirrelmail CVE #(s):CVE-2006-6142
Created:December 11, 2006 Updated:January 31, 2007
Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the mailto parameter in webmail.php, the session and delete_draft parameters in compose.php, and unspecified vectors involving "a shortcoming in the magicHTML filter."
Alerts:
Red Hat RHSA-2007:0022-01 2007-01-31
Fedora FEDORA-2007-089 2007-01-17
Fedora FEDORA-2007-088 2007-01-17
Debian DSA-1241-1 2006-12-25
rPath rPSA-2006-0231-1 2006-12-12
Mandriva MDKSA-2006:226 2006-12-11

Comments (none posted)

unzip: long file name buffer overflow

Package(s):unzip CVE #(s):CVE-2005-4667
Created:February 6, 2006 Updated:May 2, 2007
Description: A buffer overflow in UnZip 5.50 and earlier allows local users to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Alerts:
Red Hat RHSA-2007:0203-02 2007-05-01
Fedora-Legacy FLSA:180159 2006-04-04
Debian DSA-1012-1 2006-03-21
Mandriva MDKSA-2006:050 2006-02-27
Ubuntu USN-248-2 2006-02-15
Ubuntu USN-248-1 2006-02-13
Fedora FEDORA-2006-098 2006-02-06

Comments (1 posted)

virusscan: DT_RPATH vulnerability

Package(s):virusscan CVE #(s):CVE-2006-6474
Created:December 14, 2006 Updated:January 3, 2007
Description: McAfee VirusScan for Linux has an insecure DT_RPATH vulnerability that may allow a remote attacker to execute arbitrary code.
Alerts:
Gentoo 200612-15 2006-12-14

Comments (none posted)

w3c-libwww: possible stack overflow

Package(s):w3c-libwww CVE #(s):CVE-2005-3183
Created:October 14, 2005 Updated:May 2, 2007
Description: xtensive testing of libwww's handling of multipart/byteranges content from HTTP/1.1 servers revealed multiple logical flaws and bugs in Library/src/HTBound.c
Alerts:
Red Hat RHSA-2007:0208-02 2007-05-01
Ubuntu USN-220-1 2005-12-01
Mandriva MDKSA-2005:210 2005-11-09
Fedora FEDORA-2005-953 2005-10-07
Fedora FEDORA-2005-952 2005-10-07

Comments (1 posted)

xine-lib: buffer overflow

Package(s):xine-lib CVE #(s):CVE-2006-6172
Created:December 5, 2006 Updated:June 5, 2007
Description: A buffer overflow was discovered in the Real Media input plugin in xine-lib. If a user were tricked into loading a specially crafted stream from a malicious server, the attacker could execute arbitrary code with the user's privileges.
Alerts:
Mandriva MDKSA-2007:112 2007-06-04
Gentoo 200702-11 2007-02-27
Debian DSA-1244-1 2006-12-28
Gentoo 200612-02 2006-12-09
SuSE SUSE-SR:2006:028 2006-12-08
Mandriva MDKSA-2006:224 2006-12-05
Ubuntu USN-392-1 2006-12-04

Comments (none posted)

xine-lib: buffer overflow

Package(s):xine-lib CVE #(s):CVE-2006-1664
Created:April 27, 2006 Updated:February 27, 2008
Description: xine-lib does an improper input data boundary check on MPEG streams. A specially crafted MPEG file can be created that can cause arbitrary code execution when the file is accessed.
Alerts:
Gentoo 200802-12 2008-02-26
Gentoo 200604-16 2006-04-26

Comments (none posted)

xine-ui: format string vulnerabilities

Package(s):xine-ui CVE #(s):CVE-2006-2230
Created:June 9, 2006 Updated:January 24, 2007
Description: Several format string vulnerabilities have been discovered in xine-ui, the user interface of the xine video player, which may cause a denial of service.
Alerts:
Gentoo 200701-18 2007-01-23
Debian DSA-1093-1 2006-06-08

Comments (none posted)

xinit: race condition

Package(s):xinit CVE #(s):CVE-2006-5214
Created:October 17, 2006 Updated:August 9, 2007
Description: A race condition allows local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked.
Alerts:
Fedora FEDORA-2007-659 2007-08-08
Fedora FEDORA-2007-1409 2007-08-02
Ubuntu USN-364-1 2006-10-16

Comments (1 posted)

X.org: local privilege escalations

Package(s):xorg-x11 CVE #(s):CVE-2006-4447
Created:August 28, 2006 Updated:April 30, 2007
Description: Several X.org libraries and X.org itself contain system calls to set*uid() functions, without checking their result. Local users could deliberately exceed their assigned resource limits and elevate their privileges after an unsuccessful set*uid() system call. This requires resource limits to be enabled on the machine.
Alerts:
Gentoo 200704-22 2007-04-27
Mandriva MDKSA-2006:160 2006-08-31
Gentoo 200608-25 2006-08-28

Comments (none posted)

X.Org: buffer overflow

Package(s):xorg-x11-server xorg-x11 CVE #(s):CVE-2006-1526
Created:May 3, 2006 Updated:January 10, 2007
Description: There is a buffer overflow in the Xrender extension of the X.Org server; any process which is able to connect to the server may be able to exploit this overflow to run arbitrary code. Since the X server runs as root on most systems, this vulnerability could be exploited to gain root access. See the X.Org advisory for more information.
Alerts:
Fedora-Legacy FLSA:190777 2006-06-06
Trustix TSLSA-2006-0024 2006-05-05
Mandriva MDKSA-2006:081-1 2006-05-04
Ubuntu USN-280-1 2006-05-04
Slackware SSA:2006-123-01 2006-05-04
Red Hat RHSA-2006:0451-01 2006-05-04
SuSE SUSE-SA:2006:023 2006-05-03
Mandriva MDKSA-2006:081 2006-05-02
Gentoo 200605-02 2006-05-02

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2005-0064
Created:January 19, 2005 Updated:March 15, 2007
Description: iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:
Fedora FEDORA-2007-1219 2007-03-14
Gentoo 200506-06 2005-06-09
Red Hat RHSA-2005:026-01 2005-03-16
Red Hat RHSA-2005:066-01 2005-02-15
Red Hat RHSA-2005:057-01 2005-02-15
Red Hat RHSA-2005:053-01 2005-02-15
Red Hat RHSA-2005:034-01 2005-02-15
Fedora-Legacy FLSA:2353 2005-02-10
Fedora-Legacy FLSA:2352 2005-02-10
Gentoo 200502-10 2005-02-09
Red Hat RHSA-2005:049-01 2005-02-01
SuSE SUSE-SR:2005:002 2005-01-26
Red Hat RHSA-2005:059-01 2005-01-26
Mandrake MDKSA-2005:020 2005-01-25
Mandrake MDKSA-2005:019 2005-01-25
Mandrake MDKSA-2005:016 2005-01-25
Mandrake MDKSA-2005:021 2005-01-25
Mandrake MDKSA-2005:018 2005-01-25
Mandrake MDKSA-2005:017 2005-01-25
Fedora FEDORA-2005-061 2005-01-25
Fedora FEDORA-2005-062 2005-01-25
Fedora FEDORA-2005-059 2005-01-25
Fedora FEDORA-2005-060 2005-01-25
Conectiva CLA-2005:921 2005-01-25
Fedora FEDORA-2004-049 2005-01-24
Fedora FEDORA-2004-048 2005-01-24
Gentoo 200501-32 2005-01-23
Gentoo 200501-31 2005-01-23
Gentoo 200501-30 2005-01-22
Gentoo 200501-28 2005-01-21
Fedora FEDORA-2005-052 2005-01-20
Fedora FEDORA-2005-051 2005-01-20
Ubuntu USN-64-1 2005-01-19
Debian DSA-645-1 2005-01-19
Debian DSA-648-1 2005-01-19

Comments (1 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.20-rc3, released by Linus just before he went out to celebrate the new year. It contains the fix for the file corruption bug (see below) and a few hundred other fixes.

Previously, 2.6.20-rc2 was released on December 23 with another big set of fixes.

Just a few patches have been added to the mainline git repository since -rc3 came out. There are currently six entries in the known unfixed regressions list maintained by Adrian Bunk.

The current -mm tree is 2.6.20-rc2-mm1. Recent changes to -mm include a new version of the user-space drivers patch, more paravirtualization hooks, a generic time implementation for x86_64, and a generic GPIO driver core.

For older kernels: 2.6.16.37 was released on December 28 with a long list of fixes.

2.4.34 came out on December 28. It has a number of security fixes and support for the gcc 4.x compilers.

Comments (3 posted)

Kernel development news

Quote of the week

I don't care much, really. But then, I understand how all this stuff works. Try explaining to someone the relationship between pte-dirtiness, page-dirtiness, radix-tree-dirtiness and buffer_head-dirtiness.

-- Andrew Morton

Comments (2 posted)

Device resource management

Writing device drivers can be a tricky task. Simply getting a piece of hardware to operate as desired - perhaps working from erroneous or nonexistent documentation - can be a frustrating process. Beyond that, however, the driver must allocate several different types of resources for the device; these resources can include I/O memory mappings, interrupt lines, blocks of memory, DMA buffers, registrations with multiple subsystems, etc. All of these allocations must be returned to the system when the device (or its driver) goes away. It is not uncommon for driver writers to forget to deallocate something, leading to resource leaks.

The problem can get worse, however, in the face of initialization errors. If the driver is unable to properly set up its device, it must undo any registrations which had been done up to the point of failure. Attempts to handle initialization failures usually take the form of several goto labels within the initialization function or some sort of global "initialization state" variable describing where cleanup should begin. Either way, these paths tend not to be well tested, so the chances of an initialization failure leading to some sort of resource leak are quite good.

Tejun Heo, who has done much to improve the Linux serial ATA subsystem over the last year, has had enough of these sorts of initialization problems. So he has put together a device resource management patch which, if accepted, has the potential to make driver code simpler and more robust. The core idea is simple: every time a driver allocates a resource, the management code remembers the allocation and any information needed to free that allocation. When the driver disconnects from the device, all of the remembered allocations are returned to the system.

This sort of allocation tracking cannot be added to the current API in any sort of coherent way. Tejun's patch, instead, creates new "managed" versions of various allocation functions. The new functions look like the old ones with (1) the addition of "m" (or "devm") to the name, and (2) a struct device argument if the function did not already have one. So, for example, the managed versions of the interrupt allocation functions are:

    int devm_request_irq(struct device *dev, unsigned int irq,
		         irq_handler_t handler, unsigned long irqflags,
		    	 const char *devname, void *dev_id);
    void devm_free_irq(struct device *dev, unsigned int irq, 
                       void *dev_id);

The patch also includes managed functions for dealing with DMA buffers, I/O memory regions, plain memory allocations, and PCI device setup. They allow the driver author to replace a whole set of deallocation calls with a simple call to devres_release_all(), simplifying the code significantly. In fact, even that call is unnecessary; the driver core will call it when the driver detaches from the device.

For more complicated situations, there is also a "group" concept. Groups can be thought of as markers in the stream of allocations associated with a given device. The allocations performed within a specific group can be rolled back without affecting any others. In brief, the group API is:

    void *devres_open_group(struct device *dev, void *id, gfp_t gfp);
    void devres_close_group(struct device *dev, void *id);
    void devres_remove_group(struct device *dev, void *id);
    int devres_release_group(struct device *dev, void *id);

A call to devres_open_group() will create a new group for the given device, identified by the id value. Any allocations performed thereafter will be considered to be a part of that group until devres_close_group() is called. If initialization works as desired, however, devres_remove_group() can be used to get rid of the group overhead while leaving the allocations (and their tracking information) untouched. In the failure path, devres_release_group() will return all allocations belonging to the given group.

There has been very little discussion of this patch set, as of this writing. Driver writers, perhaps, are still recovering from the holiday festivities. It is not too hard to imagine that there could be some discomfort about the extra overhead involved in tracking all of those allocations - especially since things do function normally almost all of the time. In the end, however, the promise of correct operation in a wider range of situations may be enough to motivate the inclusion of the new interface.

Comments (6 posted)

A nasty file corruption bug - fixed

The December 20 LWN Kernel Page contained an article about a file corruption bug generally (but not exclusively) seen with ext3 filesystems. Certain applications which have unusual patterns of access to memory-mapped files could, at times, see gaps where data had not made it all the way to the disk. The rtorrent tool was one such application; other test cases were found (and developed) as the hunt for this problem intensified. The problem is now solved, but it offers some interesting lessons on how this kind of subtle bug can come about - and how to get it fixed.

[Cheezy diagram] In an attempt to explain what was going on, your editor will once again employ his rather dubious artistic skills. To that end, readers are kindly requested to look at the diagram to the right and suspend enough disbelief to imagine that it represents a page in memory - a page containing interesting data, and which represents an equivalent set of blocks found within a file on the disk. The distinction between the page and its component blocks is important, which is why the dotted lines divide up the page. A 4096-byte page in memory is likely represented by eight 512-byte disk blocks (which are, most likely, merged back together by the drive, but we'll pretend that isn't happening).

There are a couple of different kernel data structures which contain information about this page, making the diagram a bit more complicated:

[Second diagram]

The page may be mapped into one or more process address spaces. For each such mapping, there will be a page table entry (PTE) which performs the translation between the user-space virtual address and the physical address where the page actually lives. There is also some other information in the PTE, including a "dirty" bit. When the application modifies the page, the processor will set the dirty bit, allowing the operating system to respond by (for example) writing the page back to its backing store. Note that, if there are multiple PTEs pointing to a single page, they may well disagree on whether the page is dirty or not. The only way to know for sure is to scan all existing PTEs and see if any of them are marked dirty.

The kernel maintains a separate data structure known as the system memory map; it contains one struct page for every physical page known to exist. This structure contains a number of interesting bits of information, including a pointer to the page's backing store (if any), a data structure allowing the associated PTEs to be found relatively easily, and a set of page flags. One of those flags is a dirty bit - another flag which notes that the page is in need of writing to its backing store. (For those following closely, it may be worth pointing out that the red arrow pointing to the page does not actually exist as a pointer field; it is implicit in the structure's position within the memory map).

Finally, there is another set of structures which may be associated with this page:

[Third diagram]

The "buffer head" (or "bh") goes back to the earliest days of Linux. It can be thought of as a mapping between a disk block and its copy in memory. The bh is not central to Linux memory management in the way it once was, but a number of filesystems still use it to handle their disk I/O tracking. Note that there is not necessarily a bh structure for every block found within a page; if a filesystem has reason to believe that only some blocks need writing, it does not need to create bh structures for the rest. Among other things, the bh structure contains yet another dirty flag.

With all of these different flags representing what is essentially the same information, it is not entirely surprising that some confusion eventually came about. The maintenance of redundant data structures can be a challenge in any setting, and the kernel environment adds difficulties of its own.

Deep within the kernel, there is a function called set_page_dirty(); it is used by the memory management code when it notices (via a PTE or a direct application operation) that a page is in need of writeback. Among other things, it copies the dirty bit from the page table entries into the page structure. If the page is part of a file, set_page_dirty() will call back into the relevant filesystem - but only if said filesystem has provided the appropriate method. Many filesystems do not provide set_page_dirty() callback, however; for these filesystems, the kernel will, instead, traverse the list of associated bh structures and mark each of them dirty.

And that is where the problem comes in. The filesystem may well have noticed that a block represented by a given bh was dirty and started I/O on it before the set_page_dirty() call. When the I/O is complete, the filesystem clears the dirty flag in the bh. If the set_page_dirty() call comes while the I/O on the block is active, the filesystem will not notice the fact that the block's data may have changed after it was written. Instead, the block will be marked clean, even though what was written does not correspond to what is currently in memory. File corruption results.

Linus's fix is simple. When the virtual memory subsystem decides that it is time to write a page, a new call to set_page_dirty() is made. That ensures that all buffer heads will be marked dirty at the time the filesystem's writepage() method is called. That change ensures that all blocks of the page will be written; testers have confirmed that it makes the file corruption problems go away. The patch has gone into the mainline git repository; it should show up in the next 2.6.19 stable update as well.

The longer-term solution is to continue pushing buffer heads out of the kernel's I/O paths. As Linus puts it:

The buffer head has been purely an "IO entity" for the last several years now, and it's not a cache entity. Anybody who does writeback by buffer heads is basically bypassing the real cache (the page cache), and that's why all the problems happen.

I think ext3 is terminally crap by now. It still uses buffer heads in places where it really really shouldn't, and as a result, things like directory accesses are simply slower than they should be. Sadly, I don't think ext4 is going to fix any of this, either.

Ted Ts'o responds that a fix for ext4 could yet happen, but it involves other filesystems as well. The ext3 filesystem is probably going to stay with buffer heads, however, meaning that the kernel will have to continue to work with them indefinitely.

Finally, this story illustrates just how hard it can be to track down and fix certain kinds of kernel bugs. Early in the process it was hard for the interested developers to reproduce the problem, so they had to rely on the initial reporters to try out various patches. Those reporters stuck with the process, building and testing a lot of kernels before the problem was flushed out. They deserve much of the credit for the resolution of this problem.

Comments (18 posted)

Asynchronous buffered file I/O

Asynchronous I/O (AIO) operations have the property of not blocking in the kernel. If an operation cannot be completed immediately, it is set in motion and control returns to the calling application while things are still in progress. This functionality allows a suitably-programmed application to keep multiple operations going in parallel without blocking on any of them.

While Linux has long offered a set of system calls for asynchronous I/O, support within the kernel has been spotty and slow in coming. Most char devices do not provide the necessary methods - generally because there is no pressing need for them to support asynchronous operations. Networking supports AIO reasonably well. At the block level, all I/O is asynchronous, but that is not true when dealing with the virtual filesystem layer. Quite a bit of work went into supporting asynchronous direct filesystem I/O, making the big database vendors happy. But most applications do not use direct I/O, and the system as a whole usually benefits from the use of buffered I/O. So asynchronous buffered I/O support is arguably the biggest remaining hole.

Various buffered filesystem AIO patches have been posted over the course of some three years, but none have made it into the kernel. Recently, Suparna Bhattacharya has restarted this work with a new file AIO patch which attempts to add this capability in the least intrusive way possible. This work may now be simple enough that few will be able to find things to object to.

Like previous versions of the patch, the current code adds a special wait queue to each process's task structure. That queue is used for normal synchronous operations, while asynchronous operations each have their own, dedicated queue. The current wait queue is passed into filesystem I/O operations which could block. That enables a couple of special tricks to be performed:

  • The I/O wait code checks to see if an asynchronous wait queue is in use. If so, it simply returns -EIOCBRETRY rather than waiting. This return code indicates that the operation is still in progress; among other things, it is used to ensure that the wait queue entry remains on the queue until the operation completes.

  • Normally, wait queues wake up whatever process is waiting on them. They are, however, rather more general than that. By changing the wakeup function (see this LWN article for information on how to do that), the AIO code can use wait queues as notification service. When a "wakeup" happens on a queue being used for AIO, the kernel, rather than waking up a process, starts up a workqueue with an entry that will take the next step in the I/O operation.

The normal buffered filesystem read code, simplified almost into oblivion, looks something like this:

    for each file page to be read
	get the page into the page cache
	copy the contents to the user buffer

The real code can be found in mm/filemap.c as do_generic_mapping_read(), but the leading comment notes that "this is really ugly." It is one of only three functions so marked in that file, so, trust your editor, and go with the simple version above.

In the pseudocode version, the place where things block is clearly the step where the file page is read into the page cache. If the page is not already cached, the kernel will have to set up a disk I/O operation and wait for it to be carried out. That code proceeds the way it always did, until it gets to the "wait" part, at which point the AIO wait queue will be noticed and the code will return to whatever it was doing before. Once the read completes, the special wakeup function associated with the AIO queue will pick up where things left off.

One might well wonder just how that "pick up" part works. The wakeup function will not be running in the process of the original calling application, and may well not be running in process context at all. So it queues up a workqueue function which will examine the state of the outstanding I/O operation and, if necessary, jump back into the loop above to continue the work. Before doing so, however, the workqueue function carefully tweaks its memory management context so that it shares the original application's address space. That tweak is necessary to make the final line above (copy the page to the user buffer) work as expected. The workqueue function will perform that copy, then proceed on to the next page (if any). Likely as not, that next page will need to be read in from disk, so the workqueue function will, after ensuring that the operation is started, simply quit. This process repeats until all of the requested data has been read, at which point the application can be notified that the operation is complete.

On the write side, one might think that no changes are required - buffered file writes are already asynchronous, with the flush to disk happening in the background. The exception, however, is when O_SYNC is in use. There are situations where applications want to know when the data has found its way to the disk platter, but they still don't want to block waiting for that to happen. A very similar approach is used to make asynchronous O_SYNC writes work, though the patch is a little larger. A couple of the low-level page writeback functions required modifications so that they would pass the relevant wait queue around.

Even with this change in place, writes can still block on occasion. In particular, any operation which requires allocating disk blocks for the file may block while those allocations are performed. This issue can probably be worked around, but that work has not yet been done.

The result of all this is a working asynchronous buffered file I/O capability which makes almost no changes to (and adds little overhead to) the "normal" synchronous code. If no serious objections are raised, the Linux AIO subsystem might just become a little more complete in the near future.

Comments (6 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

Documentation

Filesystems and block I/O

Janitorial

Memory management

Networking

Architecture-specific

Virtualization and containers

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

New special purpose distributions - Firmware Linux and NSLU2-Linux

Two highly specialized Linux distribution projects were added to our Distribution List over the holidays and they are worth a closer look. These aren't your typical desktop distributions, or LAMP server distributions, but they do scratch a particular itch.

The first one we'll cover is Firmware Linux. It was introduced in this comment as an example of a Linux system that does not rely on GNU software, although it's not quite there yet. "Currently, building it still requires four gnu packages (gcc, binutils, make, and bash), but replacements for all four are in the works. (The replacement for gcc/binutils is tcc, which still needs some work, and I'm writing my own shell and when that's ready, my own make.) If your final system doesn't need to be a development environment, then it doesn't have to have any gnu code in it at all."

Firmware Linux is designed to be a build system that produces a bootable single file Linux system for various hardware platforms. Along the way, the build produces a relocatable cross compiler for the target hardware, and also a native build environment. This is a very young project, with only a few months of development so far, however, according to the news page as of changeset 68 it does build a native build environment with a working toolchain.

The second project is a bit more mature and has a family of Linux systems in development. The NSLU2-Linux project exists to discuss, develop and modify the firmware and hardware of the Linksys NSLU2, the Synology DS101, the Iomega NAS100d, the D-Link DSMG600, and other ixp4xx-based devices with large attached storage. SlugOS is the collective name for a group of firmware distributions which are derived from a common source base. The post to the NSLU2 mailing list summarizes the current state of the project. Here are some highlights:

  1. Unslung - a distribution which is targeted to those who wish to continue using the vendor firmware, but add the ability to install Optware packages. Unslung is stable at version 6.8.
  2. Optware - the ever growing set of packages available to users of Unslung and SlugOS.
  3. SlugOS - a distribution based on OpenEmbedded, which completely replaces the vendor firmware with custom firmware and packages designed from the ground up for devices with limited memory and storage. The current stable version is 3.10 and work progresses on SlugOS 4.
  4. NSLU2 is also a fully supported target for Debian Etch.
  5. OpenWRT - work is underway to provide support for the NSLU2, NAS100d, DSMG600 and FSG3 in OpenWRT kamikaze.
  6. Improved infrastructure with a move to OSUOSL for the main project server machine.
  7. Look for NSLU2-Linux at the Fifth Annual Southern California Linux Expo (SCALE 5x).

LinuxDevices covered the Debian etch support in is this November article: "Now, the newly available RC1 release of debian-installer for Etch makes installing Linux on the Slug much easier, according to Debian ARM hacker Martin Michlmayr. For one thing, the generic IXP4xx kernel in Debian ARM now appears to support the device."

There's also an article on SmallNetBuilder, Hacking the Linksys NSLU2 - Debian and more with a look at the project's history.

Comments (5 posted)

New Releases

BLAG-60000 (puente) Beta Released

BLAG Linux and GNU has announced the first beta of BLAG 60000, a new series based on Fedora Core 6, with many new applications. Since September 3rd, 2006, over 50 alpha versions of BLAG-60000 have been spun. Now the first beta is ready for testing.

Full Story (comments: none)

Announcing the Fedora 6 Zod live CD and live CD tools

The first official Fedora live CD has been announced. This live CD is based on packages from the Fedora Core 6 (codenamed "Zod") and Fedora Extras package collections and is such 100% free software. The live CD is currently only available for i386 architectures. Support for other architectures including ppc and x86_64 is planned. Click below for download information.

Full Story (comments: 9)

Kate OS Linux rev adds graphical package manager (DesktopLinux)

DesktopLinux takes a look at the recent release of KateOS 3.2. "The KateOS project team, which maintains a full-featured Linux distribution derived from Slackware Linux, last week released an installation version. KateOS version 3.2 features a 2.6.18 kernel, Xfce as its default desktop, and native support for the KDE and GNOME desktop environments. The latest release also boasts a new graphical package management tool, KatePKG, said to enable easy and intuitive installation, removal, and updating of packages."

Comments (none posted)

KNOPPIX 5.1 released

Version 5.1 of the Debian-based KNOPPIX live CD and DVD is available. It features a 2.6.19 kernel, ntfs-3g and beryl. See the release notes for more information. (Thanks to Phil Lewis)

Comments (1 posted)

Musix 0.79 released

Musix GNU+Linux has released version 0.79. Musix is a free multimedia operating system for music production, graphic design, audio and video edition, and more.

Full Story (comments: none)

Trustix Secure Linux 3.0.5 Beta 3

Trustix Secure Linux 3.0.5 Beta 3 is available. "Thanks to many reports and suggestions, this release contains some critical fixes and improvements in the installer and other software."

Full Story (comments: none)

Amulet launches Japanese Yellow Dog Linux v5.0 for PS3

Terra Soft Solutions and The Research and Development Department of AMULET, Inc (Chiyoda-ku Tokyo) have announced the launch of Japanese Language Package of Yellow Dog Linux v5.0J for the Sony Computer Entertainment PLAYSTATION3, slated to ship January 4, 2007.

Full Story (comments: none)

Distribution News

Debian 'etch' release update - main blockers for release

While it does look like the Debian stable 'etch' release will not happen this year, it is getting closer. Here's an update from Andreas Barth. "There are a few items to resolve so that we could actually release. We need your help there - in whichever area you want to help us, please do so. Please remember: Releasing of Debian is a common effort of the whole community."

Full Story (comments: 6)

Fedora Legacy shutting down

Here's an official announcement from the Fedora Legacy project. "In case any of you are not aware, the Fedora Legacy project is in the process of shutting down. The current model for supporting maintenance distributions is being re-examined. In the meantime, we are unable to extend support to older Fedora Core releases as we had planned. As of now, Fedora Core 4 and earlier distributions are no longer being maintained."

Full Story (comments: none)

OpenPKG Project Policy Changes for Contributions

The OpenPKG project has made some changes to its policies on contributions and asks contributors to explicitly agree to the new OpenPKG Contributor Agreement (OCA) document.

Full Story (comments: none)

openSUSE @ FOSDEM 2007 call for papers/speakers/participants

The openSUSE project has a "devroom" at the Free Open source Software Developers' European Meeting (FOSDEM) taking place February 24 - 25, 2007 in Brussels (Belgium). "For 2007, we dare to challenge all of us, the community, to play a much more active role in making FOSDEM 2007 a great success. Therefore we would like to open a "call for papers" and encourage everyone to send proposals to the opensuse-project@opensuse.org mailing list. Proposals should be submitted by January 15, 2007."

Full Story (comments: none)

Distribution Newsletters

Debian Weekly News

The Debian Weekly News for December 26, 2006 covers the 400,000th bug report, a call for participation in the Debian mini-conf at linux.conf.au, 20,000 submitters for popularity contest, five years of debianforum.de, ARM is now the third most-popular Debian Architecture, installing Debian without a CD-ROM, an Etch-CD with KDE as the default desktop, Etch frozen, Debian powers Australia's largest satellite network, Debian Package of the Day, and much more.

Full Story (comments: 17)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for December 18, 2006 looks at EFIKA overlay opens, Quickstart 0.3 and several other topics.

Comments (none posted)

DistroWatch Weekly, Issue 183

The DistroWatch Weekly for January 1, 2007 is out. "With another exciting year safely behind us, we'll start the first issue of DistroWatch Weekly in 2007 with a statistical look at the popularity of Linux distributions and other interesting data collected here during the past year. The news section will then bring a varied collection of happenings from the distro world, including news about the latest beta release of SimplyMEPIS, updates about the forthcoming Fedora 7, information about the release blockers delaying Debian GNU/Linux 4.0, links to interviews with the developers of Ulteo and SabayonLinux, and alerts to articles of interest to users of PCLinuxOS, openSUSE and Yellow Dog Linux. Finally, we are pleased to announce that the December 2006 DistroWatch donation goes to SabayonLinux."

Comments (none posted)

Package updates

Fedora updates

Updates for Fedora Core 6: frysk (split to several rpms), wget (bug fixes), jpackage-utils (update to latest jpackage-utils), htdig (fixed htfuzzy's sigfaults), gtk2 (bug fixes), evince (fix a copy-and-paste error in the %post script), gnome-applets (bug fix), desktop-printing (bug fix), selinux-policy (bug fix), dvd+rw-tools (bug fix), poppler (solve conflict with xpdf-utils), gnome-python2-extras (rebuild against firefox), scim (bug fixes), frysk (new upstream version), dbus-glib (bug fixes), autofs (bug fixes), xen (update to xen-3.0.3-8.rhel5), libvirt (new upstream release), kernel (update to 2.6.18.6 final), gtk2 (bug fixes), virt-manager (bug fixes), python-virtinst (bug fixes), less (bug fixes), cups (bug fixes), logwatch (bug fixes), m17n-db (bug fix), gphoto2 (update to 2.3.1), hal (bug fix), libgnomeprint22 (bug fix), smartmontools (bug fix), eclipse-cdt (update autotools plug-in to 0.0.6).

Updates for Fedora Core 5: frysk (split to several rpms), dvd+rw-tools (bug fix), frysk (new upstream version), xen (add vmxassist fix), less (bug fixes), gphoto2 (update to 2.3.1).

Comments (none posted)

Mandriva updates

Updates for Mandriva Linux 2007.0: lsb (bug fix).

Comments (none posted)

rPath updates

Updates for rPath Linux 1: httpd, mod_ssl (MIME type and path corrections).

Comments (none posted)

Trustix updates

Updates for Trustix Secure Linux 2.2 & 3.0: hwdata, mysql (various bug fixes).

Comments (none posted)

Ubuntu updates

Updates for Ubuntu 6.10: control-center (upload to edgy-updates).

Comments (none posted)

Newsletters and articles of interest

Red Hat's next Linux due before March (ZDNet)

ZDNet covers the release schedule for Red Hat Enterprise Linux 5. "Red Hat Enterprise Linux 5 had been scheduled to ship by the end of 2006. However, the company began giving itself scheduling wiggle room in September, when Red Hat released the first RHEL 5 beta. A second beta arrived in November. Now Red Hat is being more definitive. "I'm sure we will ship a gold (version) on February 28," Chief Executive Matthew Szulik, referring to the final version, said in an interview after the company reported its quarterly financial results."

Comments (1 posted)

How To Compile A Kernel - The Debian (Sarge) Way (HowtoForge)

HowtoForge builds a custom kernel on a Debian Sarge system. "Each distribution has some specific tools to build a custom kernel from the sources. This article is about compiling a kernel on Debian Sarge systems. It describes how to build a custom kernel using the latest unmodified kernel sources from www.kernel.org (vanilla kernel) so that you are independent from the kernels supplied by your distribution. It also shows how to patch the kernel sources if you need features that are not in there."

Comments (none posted)

Sabayon Linux Interview (KnoLinux)

KnoLinux has an interview with Sabayon Linux developer Christopher Villareal. "Knolinux: Hello Chris, Why did you start working on a new Linux distro? Chris: Let's see, my gnu/linux experience started about 6 years ago when I started out with the major binary distributions. Since then, I got agitated by the fact that I didn't have as much control over the system as I wanted. Then I came to gentoo after trying out some other source distros due to the tools that were available to me. As such, I was doing some searching and found a distro called RR4/RR64 which looked extremely promising. So on Dec. of '05 I joined the forums and started making post. Soon, I got used to helping others and really enjoyed the RR experience and had the pleasure to speak with the Lead on occasion. 6 monthes of hard work, I threw the idea to Fabio (lxnay) to become his co-lead and I really liked the fact of helping people come to an excellent distro. Its all about the community effort, and I wanted to help. Currently I am helping maintain the main chroot environment, our custom overlay, and just managing bugs and interacting with the users through irc, the forums, and jabber."

Comments (none posted)

OpenVZ On Debian Etch For Webservers (HowtoForge)

HowtoForge sets up OpenVZ on a Debian etch system. "This guide is written during an install of a Supermicro machine with 2 dual-core opterons (64-bit), 2 identical disks (for RAID) and a load of memory. Why OpenVZ and not XEN or the recent KVM kernel module? Well, XEN is not very stable for 64-bit architectures (yet), and it comes with quite a bit of overhead (every VM runs its own kernel) due to its complexity. KVM is very simple but restricts you to run a kernel as one process, so the VM cannot benefit from multi core systems."

Comments (none posted)

Distribution reviews

Review: VectorLinux 5.8 (Linux.com)

Linux.com has a review of VectorLinux 5.8. "VectorLinux, a lightweight, fast Linux distribution for the x86 platform, just released its new version 5.8 this week. This user-friendly distribution makes the average computer user's life easy by supplying office software, Web browsing, photo editing, and archiving on top of a fast, clean Xfce window manager."

Comments (none posted)

The well-tempered Debian desktop (DesktopLinux)

Rick Lehrbaum reviews a Debian Etch install on an old Thinkpad. "I began by downloading RC1 of the Debian "testing" net-install CD (aka "etch RC1") iso file from here. It's a quick download, being a 100-150MB file. I like that. After burning the CD from the iso, I popped it into the Thinkpad, and booted it up."

Comments (none posted)

Page editor: Rebecca Sobol

Development

CherryPy reaches the 3.0.0 milestone

CherryPy is a Python-based cross-platform object-oriented web development framework:

[CherryPy]

CherryPy allows developers to build web applications in much the same way they would build any other object-oriented Python program. This usually results in smaller source code developed in less time. CherryPy is now more than three years old and it is has proven very fast and stable. It is being used in production by many sites, from the simplest ones to the most demanding ones.

The basic operation of CherryPy is explained:

Your CherryPy powered web applications are in fact stand-alone Python applications embedding their own multi-threaded web server. You can deploy them anywhere you can run Python applications. Apache is not required, but it's possible to run a CherryPy application behind it (or IIS).

Passing interactive data to CherryPy is simple:

You write request handler classes that you tie together in a tree of objects, starting with a root object. CherryPy maps incoming request URIs to this object tree. The URI '/' represents the 'root' object, '/users/' the 'root.users' object, and so on. Requests are handled by methods inside these request handler classes.

Examples of a simple Hello World program and the passing of GET/POST variables to methods show the simplicity that CherryPy development offers.

CherryPy version 3.0.0 brings the following changes:

  • The speed has been improved by up to 3X.
  • Configuration information can now be attached to page handlers.
  • Configuration scopes now have further separation.
  • Configuration namespace prefixes have been added to the config info.
  • Filters have been replaced by more flexible Tools.
  • There are new and improved built-in tools.
  • Support for custom tools and toolboxes has been added.
  • New Hook and Dispatch methods have been added for dealing with callbacks.
  • URL construction has been improved for better handling of portable URLs.
  • A reworked Autoreload feature fixes some bugs.
  • Improvements have been made to the built-in WSGI server.
  • CherryPy application objects are now WSGI applications.
  • WSGI middleware callables are now supported.
  • The logging system has been improved.
  • CherryPy now works better with the Python interactive interpreter.
  • Support for InternalRedirect situations has been improved.
  • A new engine.drop_privileges function is available for process control.
  • CherryPy now natively supports the mod_python Apache extension.
  • CherryPy can now support multiple HTTP servers simultaneously.
CherryPy 3.0.0 is available for download here, people running older versions should read the How to upgrade to CherryPy 3.0 document.

Comments (1 posted)

System Applications

Database Software

Firebird 1.5.4 announced

Version 1.5.4 of the Firebird DBMS has been announced. "This sub-release introduces a number of bug fixes backported from the Firebird 2.0.x branches."

Comments (none posted)

PostgreSQL Weekly News

The December 25, 2006 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

PostgreSQL Weekly News

The January 1, 2007 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

Embedded Systems

BusyBox 1.3.1 released

Stable version 1.3.1 of BusyBox, a collection of command line utilities for embedded systems, is out. "Closing 2006 with new release. It includes only trivial fixes accumulated since 1.3.0"

Comments (none posted)

Libraries

PyTables 1.4 released

Version 1.4 of PyTables has been announced. "PyTables is a library for managing hierarchical datasets and designed to efficiently cope with extremely large amounts of data with support for full 64-bit file addressing. It is based on the HDF5 library for doing the I/O and leverages the numarray/NumPy/Numeric packages so as to deliver the data to the end user in convenient in-memory containers. This is a new major release of PyTables, and probably the last major one of the 1.x series (i.e. with numarray at the core). On it, we have implemented better code to deal with table buffers, enhanced the capability for reading native HDF5 files, enhanced support for 64-bit platforms (but not with Python 2.5: see ``Special Warning`` section below), better support for AIX, optional automatic parent creation and the traditional amount of bug fixes."

Comments (none posted)

Mail Software

poMMo - The post modern Mass Mailer

Brice Burgess has sent us an announcement for his poMMo mailing list manager project. "poMMo is versatile mass mailing software. It can be used to add a mailing list to your Web site or to organize stand alone mailings. Unique Features such as the ability to mail subsets of your subscribers set it apart from alternatives. poMMo is written in PHP and freely provided under the GPL."

Full Story (comments: none)

Postfix 2.4 Snapshot 20061229 released

Snapshot 20061229 of the Postfix mail transfer agent is out. See the CHANGELOG file for details.

Comments (none posted)

Desktop Applications

Audio Applications

das_watchdog V0.2.5 and jack_capture 0.9.3 announced

New versions of the audio applications das_watchdog and jack_capture have been announced. "Whenever a program locks up the machine, das_watchdog will temporarily sets all realtime process to non-realtime for 8 seconds. You will get an xmessage window up on the screen whenever that happens. ... jack_capture is a program for recording soundfiles with jack."

Full Story (comments: none)

AWN Issue 4 released (KDE.News)

KDE.News has announced issue #4 of the Amarok Weekly Newsletter: "Late but worthy - thats how one can call this issue of AWN. It talks about new or updated Amarok features, and continues to provide tips and links to interesting scripts. As a bonus, kind of New Year gift, we provide you an experimental RSS feed, for your pleasure. Enjoy!"

Comments (none posted)

Desktop Environments

GNOME 2.17.4 released

Version 2.17.4 of the GNOME desktop environment is available. "This is our second development release on our road towards GNOME 2.18.0, which will be released in March 2007. New features are coming in at a nice rate, and that's great. A lot of bug fixes too. And some crashers are appearing here and there: that's the fun of unstable releases!"

Full Story (comments: none)

GARNOME 2.17.4 announced

Version 2.17.4 of GARNOME, the bleeding-edge GNOME distribution, is out. "This release includes all of GNOME 2.17.4 plus a whole bunch of updates that were released after the GNOME freeze date. This is the fourth release in the unstable cycle, with more features, more fixes and yet more madness added. It is for anyone who wants to get his hands dirty on the development branch, or who'd like to get a peek at future features."

Full Story (comments: none)

GNOME migration to Subversion finished

The migration of the GNOME desktop to the Subversion version control system has been completed. "For those that haven't noticed, the subversion migration is now complete. In the end, it took about 49 hours. Apologies for the downtime involved."

Full Story (comments: none)

GNOME Software Announcements

The following new GNOME software has been announced this week and last: You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

KDE Commit-Digest (KDE.News)

The December 24, 2006 edition of the KDE Commit-Digest has been announced. The content summary says: "A new game, KSquares, is imported into KDE SVN, with KLines starting on the (now familiar) path towards scalable graphics and general improvement. Usability and other improvements in Okular. Support for multiple "identies", alongside a festive basket of other enhancements in Mailody. Search support and plugin handling improvements in KGet. In Amarok, the "yauap" engine (a redeveloped GStreamer interface, using D-Bus interaction) progresses, with support for audio CD's. Improved OpenFormula specification compliance in KSpread. A much-enhanced implementation of "run-around text" comes to KWord. A work-in-progress python parser for KDevelop is imported into KDE SVN. Work begins on the Oxygen-themed widget style and window decoration for KDE 4."

Comments (none posted)

KDE Commit-Digest (KDE.News)

The December 31, 2006 edition of the KDE Commit-Digest has been announced. The content summary says: "The KDE Commit-Digest 2006 retrospective. blinKen and KNetWalk become the latest applications to move to scalable graphics. KSquares further develops, with an AI player implemented. More maps and a more sophisticated divisions and capitals implementation in KGeography. Support for password-protected RAR archives in the kio_rar interface. Work to support drag-and-drop of transfers in KGet. Import of "koregressions" test suite for KOffice. Longstanding KWeather and KHTML bugs fixed. Major refactoring in the "sonnet" natural language checker. Version 1.0 of Eigen, the library for vector and matrix math, is released."

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week: You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

The Road to KDE 4: SVG Rendering in Applications (KDE.News)

KDE.News presents a short overview of some of features going into KDE 4. "Since KDE 4 development is in full swing with plans for a KDE 4.0 release sometime later this year, I thought I'd put together a weekly piece entitled The Road to KDE 4. The idea is to have a short overview of one or two of the features that show progress in KDE 4. For my first issue, the goal is to show off some of the great SVG work that has taken place so far."

Comments (31 posted)

Xorg Software Announcements

The following new Xorg software has been announced this week and last: More information can be found on the X.Org Foundation wiki.

Comments (none posted)

Electronics

KJWaves 1.1.0 released

Version 1.1.0 of KJWaves, a Java program for viewing RAW SPICE electronic simulation files, has been announced. "New version allows adding of traces to previous graphs and improves on ability to add current through a component analysis."

Comments (none posted)

Games

Battle for Wesnoth 1.2 released

Version 1.2 of the game Battle for Wesnoth has been announced. "The single player mode has a new tutorial, and 3 new campaigns: Two Brothers, The South Guard, and Under the Burning Suns. The first one was intentionally designed to be easy for beginning players. The last one is set in an environment quite different from that of the typical Wesnoth campaign, and includes a few changes to game rules. The existing campaigns include new scenarios, dialogue, items, and optional bonus victory objectives. Replay of saved games has been improved considerably, allowing one to show single turns at a time, navigate through the replay, and toggle fog-of-war at will." Many more changes have been included.

Comments (none posted)

Imaging Applications

PDFCube 0.0.2 released

Version 0.0.2 of PDFCube is out. "PDF Cube is an OpenGL API-based PDF viewer that adds a compiz/Keynote-like spinning cube tra[n]sition effect to your PDF presentations (including Latex, Beamer and Prosper). You can also zoom on 5 predefined areas of any presentation page with a smooth zooming effect."

Comments (none posted)

Interoperability

Wine 0.9.28 released

Version 0.9.28 of Wine has been announced. Changes include: OpenGL in child windows should work again, Better mouse support in games, Beginnings of new state management in Direct3D, Improved audio and font support on Mac OS and Lots of bug fixes.

Comments (none posted)

Medical Applications

Synapse EMR (LinuxMedNews)

LinuxMedNews reports on the Linux port of Synapse EMR, an electronic medical record system. "Synapse EMR port to Linux has now gone beta. Download from http://www.compkarori.com/emr/linux/. Almost all of the non-Windows specific functionality is now available for the Linux client."

Comments (none posted)

Music Applications

amSynth 1.2.0 released

Version 1.2.0 of amSynth, a virtual music synthesizer, is out. Changes include better graphics, better MIDI all-off handling, a new about dialog, better installation and bug fixes.

Full Story (comments: none)

BEAST/BSE v0.7.1 announced

Version 0.7.1 of BEAST/BSE and BSE-ALSA have been announced, it features a security fix and other improvements. "This is a development version of BEAST/BSE, the BEdevilled Audio SysTem and the Bedevilled Sound Engine. BEAST is a powerful music composition and modular synthesis application released as free software under the GNU GPL and GNU LGPL, that runs under unix. BSE-ALSA is an ALSA driver for BSE."

Full Story (comments: none)

rtsynth 1.9.5 alsa+jack announced

Version 1.9.5 of RTSynth, a midi event triggered real time synthesizer is out with support for dynamically loaded jack drivers, a new --polyvoice command line option and bug fixes.

Full Story (comments: none)

Office Applications

Bruce The Presentation Tool, release 1.2

Release 1.2 of Bruce The Presentation Tool has been announced. "Bruce the Presentation Tool is for Python programmers who are tired of fighting with presentation tools. In its basic form it allows text, code or image pages and even interactive Python sessions. It uses PyGame and is easily extensible to add new page types."

Full Story (comments: none)

Office Suites

OpenOffice.org Newsletter

The December, 2006 edition of the OpenOffice.org Newsletter is out with the latest OO.o office suite articles and events.

Full Story (comments: none)

Science

First public release of ANUGA hydrodynamic modeling

The ANUGA hydrodynamic modeling system has been launched. "ANUGA is a software implementation of a hydrodynamic model which is specifically designed to model wetting and drying processes. ANUGA implements a Finite-Volumes technique for solving the Shallow Water Wave Equations. ANUGA is a joint development project between Geoscience Australia (GA) and the Australian National University (ANU) and is being used to simulate the impact from natural disasters such as tsunami and storm-surge on coastal communities. ANUGA is also suitable for detailed dam-break simulations."

Full Story (comments: none)

Web Browsers

Mozilla Firefox and Thunderbird 1.5.0.9 Released (MozillaZine)

Versions 1.5.0.9 of the Mozilla Firefox web browser and the Mozilla Thunderbird email client have been announced. "Security and Stability updates for Mozilla products based on the Gecko 1.8.0 branch have been released. Firefox 1.5.0.x will be maintained with security and stability updates until April 24, 2007. All users are strongly encouraged to upgrade to Firefox 2."

Comments (none posted)

Mozilla Firefox 2.0.0.1 released (MozillaZine)

Version 2.0.0.1 of the Mozilla Firefox web browser has been announced. "Mozilla Firefox 2.0.0.1, a security and stability update for Firefox 2, has been released. This release addresses several critical security issues. All users are encouraged to upgrade to this release."

Comments (1 posted)

Languages and Tools

Caml

Caml Weekly News

The December 26, 2006 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

Caml Weekly News

The January 2, 2007 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

FORTRAN

Gfortran year end status report

A year end status report for Gfortran, the GNU FORTRAN compiler project, has been published. "Gfortran has achieved many milestones this year and hopefully the contributors can continue to move forward with bug fixes, conformance to Fortran 95 standard, and the implementation of Fortran 2003 features."

Full Story (comments: none)

Haskell

Haskell Weekly News

The January 2, 2007 edition of the Haskell Weekly News is online. This week brings a new release of vty and HsColour, and some interesting discussion over the holiday break.

Comments (none posted)

Java

Review/Preview: 2006 and 2007 in Java (O'ReillyNet)

Chris Adamson looks at recent and upcoming Java developments on O'Reilly. "2006 will be remembered as the year that Sun open-sourced Java under the GPL, that EJB 3.0 finally shipped, and that Google surprised everyone with its Google Web Toolkit. But how will history record the results of these events? For the 2006 year-ender, ONJava editor Chris Adamson looks at the year's events through the lens of how they may play out in 2007."

Comments (8 posted)

JUnit Reloaded (java.net)

Ralf Stuckert discusses the latest changes to JUnit on java.net. "Let's face it, JUnit is the most widely used (unit-) testing tool in the Java world. There are other powerful test frameworks out there, such as TestNG (which is very comprehensive), but they've never enjoyed the broad acceptance JUnit has. With version 4, Kent Beck and Erich Gamma introduced the first significant API changes in the last few years. When the first release candidate was available back in 2005, you could hardly use it in a productive working environment due to the lack of tool support at that time. By now, most build tools and IDEs come with support for JUnit 4, so it's about time to give it a try. This article describes what's different compared to JUnit 3.8.x."

Comments (none posted)

Perl

Weekly Perl 6 mailing list summary (O'Reilly)

The December 17-23, 2006 edition of the Weekly Perl 6 mailing list summary is out with coverage of the latest Perl 6 developments.

Comments (none posted)

Weekly Perl 6 mailing list summary (O'Reilly)

The December 24-30, 2006 edition of the Weekly Perl 6 mailing list summary is out with coverage of the latest Perl 6 developments.

Comments (none posted)

99 Problems in Perl 6 (O'Reilly)

Curtis Poe solves some problems using Perl 6 in an O'Reilly article. "Have you wanted to start playing with Perl 6 but find yourself wondering what to write? I use Pugs, a Perl 6 implementation being written in Haskell and have been tremendously enjoying Perl 6. Like many, I’m impatient, but the work on Perl 6 has been progressing quite well and I’m quite keen to see the alpha. However, if you’re like me, you probably do better with a new language by actually writing something in it. Well, not only do I have something for you to write, you can actually help out the Perl 6 effort!"

Comments (none posted)

Ruby

Looking Ahead at Ruby in 2007 (Linux Journal)

Pat Eyler looks ahead to Ruby developments in 2007 in a Linux Journal article. "Last week, I looked back at Ruby in 2006. This week, it's time to look ahead. Here are 10 Ruby things I think are going to be hot in 2007:"

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The December 29, 2006 edition of Dr. Dobb's Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

Tcl-URL!

The January 2, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

XML

A Theory of Compatible Versions (XML.com)

XML.com presents an article by David Orchard entitled A Theory of Compatible Versions. "Creating XML languages that are compatible and extensible is a difficult problem. This week David Orchard argues for a theory of compatibility in which he describes some of the conditions for creating compatible XML languages."

Comments (none posted)

Debuggers

A New Approach To Debugging

Robert O'Callahan talks about the Amber debugger project in his web log. "I have built a system, which I'm calling Amber, to record the complete execution history of arbitrary Linux processes. The history is recorded using binary instrumentation based on Valgrind. The history is indexed to support efficient queries that debuggers need, and then compressed and written to disk in a format optimized for later query and retrieval. The history supports efficient reconstruction of the contents of any memory location or register at any point in time. It also supports efficient answers to "when was the last write to location X before time T", "when was location P executed between times T1 and T2", and other kinds of queries. I can record the 4.1 billion instructions of a Firefox debug build starting up, displaying a Web page, and exiting; the compressed, indexed trace is about 0.83 bytes per instruction executed." (Thanks to Jerome Lacoste.)

Comments (3 posted)

IDEs

eric3 3.9.3 released

Version 3.9.3 of eric3, an IDE for Python and Ruby, is available. "This release fixes a few bugs and enhances compatibility with subversion 1.4."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

A cost analysis of Vista content protection

Peter Gutmann has posted a lengthy look at the costs of the DRM features built into Windows Vista. Reading it is a sort of Alice-in-Wonderland experience, highly recommended. "If a graphics chip is integrated directly into the motherboard and there's no easy access to the device bus then the need for bus encryption is removed. Because the encryption requirement is so onerous, it's quite possible that this means of providing graphics capabilities will suddenly become more popular after the release of Vista. However, this leads to a problem: It's no longer possible to tell if a graphics chip is situated on a plug-in card or attached to the motherboard, since as far as the system is concerned they're both just devices sitting on the AGP/PCIe bus. The solution to this problem is to make the two deliberately incompatible, so that HFS can detect a chip on a plug-in card vs. one on the motherboard."

Comments (67 posted)

Predictions for 2007 (and how I did on 2006) (LinuxWorld)

Don Marti takes a look at his predictions for 2006 and makes some new predictions for 2007. ""Platforms get granular for self-defense. Tired of worms that attack software you don't use, but that you need to patch anyway because it's part of the 'platform'? In 2006, you'll get better dependency checking to deploy just what you need, and update services that are smart enough not to bug you about software you don't need to update because you don't have it." Partial hit. The hot distribution was Ubuntu, which borrows its easier to manage approach from Debian. Package management is getting better all the time, but there still aren't enough tools to detect software that isn't being used and encourage new sysadmins to remove it."

Comments (13 posted)

The Ultimate Distro (Linux Journal)

Glyn Moody examines the advantages of distribution forks in a Linux Journal article. "This is one of free software's greatest and least-appreciated strengths: the fact that it can continue to evolve in an almost organic fashion, untrammelled by constraints of economics, or even feasibility. It is this fecundity that drives free software forward unstoppably, and that distinguishes it from the sterile code monster that is Windows, which, trapped within the carapace of its closed source, only slouches towards Redmond to be born every five years or so." The article mentions the Linux distribution timeline, which gives a graphical representation of distribution forks.

Comments (23 posted)

Companies

Jeremy Allison Has Resigned from Novell to Protest MS Patent Deal (Groklaw)

Groklaw reports that Samba hacker Jeremy Allison has left Novell in protest. "Whilst the Microsoft patent agreement is in place there is *nothing* we can do to fix community relations. And I really mean nothing. We can pledge patents all we wish, we can talk to the press and "community leaders", we can do all the right things w.r.t. all our other interactions, but we will still be known as GPL violators and that's the end of it."

Comments (39 posted)

Financial firms back Microsoft Linux deal (The Register)

The Register reports on some recent high profile SUSE Linux subscription customers. "Three big financial firms have come out of the closet and confirmed they have taken delivery of SUSE Linux subscriptions from Microsoft. Deutsche Bank, Credit Suisse and AIG Technologies have all signed up to the Franken-deal in the belief that it will make it easier to run Linux-based systems alongside Microsoft software."

Comments (none posted)

Red Hat results kicks rump, takes names (Linux-Watch)

Linux-Watch looks at Red Hat's financial results. "Red Hat Inc. on Dec. 21 announced its financial results for its fiscal year 2007 third quarter. The Raleigh, NC-based Linux company's numbers were, in a word, great. The total revenue for the quarter was $105.8 million, an increase of 45 percent from the year-ago quarter and 6 percent from the prior quarter. Subscription revenue was $88.9 million, up 48 percent year-over-year and 5 percent sequentially."

Comments (5 posted)

Linux at Work

Linux powers controllable Christmas lights for charity (Linux.com)

Joe 'Zonker' Brockmeier takes a look at a web-controlled Christmas light display that is powered by Linux. "During the holiday season, Komarnitsky says that he runs four Linux servers to keep up with the load -- one for each webcam, and one that serves up the pages to the public. Komarnitsky says that the entire system is run by Linux, with the exception of the laptop that displays messages typed in by users. Komarnitsky uses three D-Link DCS-6620G webcams, one of which was donated by D-Link."

Comments (none posted)

Legal

Apple, Google, Napster Face Intertainer Patent Suit (Bloomberg)

Bloomberg briefly reports on a software patent suit filed against Apple, Google, and Napster. "Culver City, California-based Intertainer's investors include Microsoft Corp., the world's biggest software maker, and Intel Corp., the world's biggest semiconductor maker." The patent in question would appear to be #6,925,469, which covers distribution of "digital media content" in very general terms.

Comments (6 posted)

Interviews

Ubuntu Founder On Microsoft "Challenge" (Red Herring)

The Red Herring interviews Mark Shuttleworth. "Microsoft and others, a lot of them say that free software and open source is all about copying what was being done before in proprietary software, and for a lot of time that was true. The world we are seeing is that, as soon as the free software reaches a point where it's as good as the proprietary software, suddenly all the innovation shifts to the free software."

Comments (2 posted)

Resources

Bandwidth Monitoring Tools for Ubuntu Users (Ubuntu Geek)

Ubuntu Geek takes a look at a number of network bandwidth monitoring tools. "Here is the list of bandwidth monitoring tools for your network bandwidth: bmon, bwbar, bwm, bwm-ng, iftop, iperf, ipfm, speedometer, cbm, ibmonitor, pktstat, mactrack, MRTG, Cacti. Now we will see each tool separately."

Comments (none posted)

Linux Gazette #134 is out

The January edition of Linux Gazette is available. Articles include Fun with FUSE, Mounting remote resources as filesystems via FUSE (Filesystem in Userspace), Away Mission -- OracleWorld '06, San Francisco, Installing Mandriva, OSI, GAP, and "Exhibit B" licences, Perl One-Liner of the Month: The Count of Corpus Christi (TX), and much more.

Comments (none posted)

Reviews

The Buzz About Aldrin (Linux Journal)

Dave Phillips reviews Aldrin on Linux Journal. "For the past month I've been building and playing with Leonard 'paniq' Ritter's Aldrin, a music production system that combines a tracker-style composition interface with audio synthesis and processing modules called machines. Users of the famous Buzz music software will probably recognize Aldrin's design at once. In fact, it may be fair to describe Aldrin as Leonard Ritter's interpretation of the original Buzz."

Comments (none posted)

A Good Beginning (And Some Holiday DSP) (Linux Journal)

Dave Phillips looks at DSP software in the Linux Journal. "[Sonic Visualizer] truly emphasizes visualization, with data view formats such as various spectrograms, amplitude waveform, piano roll (for MIDI plot), chronogram, pitch envelope, and power curve. The user scrolls through the views with the Navigate cursor (the pointing hand) and uses the Select tool (the arrow) to make selections within the view. Edits are limited to cut/copy/paste, but the program isn't intended for audio processing. It is primarily a tool for audio analysis and visualization, and an excellent tool at that. Highly recommended for serious research and viewing enjoyment."

Comments (none posted)

Low-cost laptop could transform learning (Yahoo)

Yahoo has an AP article on the OLPC project. "Nicholas Negroponte, who launched the project at the Massachusetts Institute of Technology's Media Lab two years ago before spinning One Laptop into a separate nonprofit, said he deliberately wanted to avoid giving children computers they might someday use in an office. 'In fact, one of the saddest but most common conditions in elementary school computer labs (when they exist in the developing world), is the children are being trained to use Word, Excel and PowerPoint,' Negroponte wrote in an e-mail interview. 'I consider that criminal, because children should be making things, communicating, exploring, sharing, not running office automation tools.'"

Comments (10 posted)

Book review: OpenOffice.org 2 Guide (Linux.com)

Linux.com reviews a book about OpenOffice.org. "OpenOffice.org expert Solveig Haugland has published a massive new manual called the OpenOffice.org 2 Guide. This 520-page tome will be useful both for OOo newbies and power users who are interested in learning arcane features of the office suite. What does Haugland's $28 book have that the free online guides don't? The primary distinction is that Haugland's book is one work in one place, whereas the community's guides are available for sale in the form of separate books on the main OOo programs (Writer, Calc, Draw, Impress) for generally $10 to $20, or for free download."

Comments (none posted)

A first look at Thunderbird 2.0 (Linux.com)

Linux.com looks at Thunderbird 2.0. "After many months of development, Thunderbird 2.0 is almost ready to debut. The Mozilla Foundation released the first beta of Thunderbird 2.0 last week, and I've been using it to manage my mail since then. The new release boasts tagging, history navigation, new mail alerts, improved extension support, and a number of other features. Thunderbird 2.0 won't knock your socks off with exciting new features, but it's a nice, gradual improvement over the Thunderbird 1.5 series."

Comments (2 posted)

Google Toolbar 3.0 beta improves browsing experience (Linux.com)

Linux.com looks at the Google Toolbar 3 beta for Firefox. "I tested the toolbar with Firefox 2.0 and Flock 0.7.9. You'll see a warning before you install the toolbar on Flock that the extension wasn't designed specifically for Flock, but I haven't run into any problems with it so far in Flock. Once I had it installed, I signed out of Google services and signed in using the Google Toolbar sign-in feature. I was then authenticated for Gmail, Google Apps, Google Bookmarks, Blogger, and the whole kit and caboodle of Google services I tried, with the exception of AdSense."

Comments (1 posted)

New Xen better for desktops (ZDNet)

ZDNet looks at a new release of Xen, a commercial virtualization system. "On a desktop system, Xen virtualization promises to keep separate zones for test, work, personal and management software. So far, however, that promise has been hampered by a major weakness: the inability to display multiple graphical user interfaces for these "guest" operating systems. Xen 3.0.4 changes this. By including what's called a virtual frame buffer, Xen's controlling "host" operating system can capture video data written to a specific part of memory and then send it to the display. The technology lets users see virtual machines through a graphical interface, a feat competitors such as EMC's VMware can already accomplish, rather than the text-based command line suitable chiefly for the technically proficient."

Comments (11 posted)

Miscellaneous

Creative Commons gets new chairman; Lessig to continue as CEO (NewsForge)

NewsForge reports that Lawrence Lessig has retired from his position as the Creative Commons chairman of the board. "After four successful years of revolutionizing how content is shared in the real world, Lawrence Lessig, founding chairman of Creative Commons, announced his retirement as chairman of the board last week. Lessig passed the CC torch to Joi Ito, a venture capitalist from Japan. Creative Commons (CC) is a non-profit organization and is known for its Creative Commons copyright licenses. "We provide free licenses," Lessig writes, "that mark creative work with the freedom the creator wants it to carry, so others can share the work, or remix the work, or both share and remix the work, as the author chooses.""

Comments (none posted)

South Korea's ETRI develops advanced Linux desktop search system

ZDNet Korea looks at antbear, a desktop search system that addresses problems in the searching of text written with Asian character sets. "Advanced word recognition technology gives more reliable search results Linux desktop search, thus far, had some limitations due to its lacking features compared to Windows environment that has various features. Although 'Beagle' has been available for supporting Korean and other Asian languages (Chinese, Japanese), its 'bigram' search method in many situations fails to recognize true meanings of Asian characters for the search. For example, it breaks down and indexes the search word(s) into two separate characters, which can generate unrelated results. The reliability of the search result gets even worse when its search is based on larger number of files."

Comments (2 posted)

Grant funds open-source challenge to Google library (ZDNet)

ZDNet reports that the nonprofit Internet Archive has received a million dollar grant from the Alfred P. Sloan Foundation. "The archiving organization's Open-Access Text Archive is an open-source alternative to book-scanning efforts like the ones from Google and Microsoft. Internet Archive, perhaps best known for its WayBack Machine archive of Web pages by date--is also an online digital library of text, audio, software, images and video content."

Comments (none posted)

2006: The year the FSF reached out to the community (Linux.com)

Linux.com looks at the Free Software Foundation. "The list of the community-based actions the FSF has taken in the past year is a long one. It begins with an expanded role for some of its longstanding institutions. Throughout the year, the FSF's high-priority list seems to have exerted some influence on such items as the open source release of the Java code and the growing interest in LinuxBIOS by chipset manufacturers. Similarly, the FSF's compliance lab, although now more than five years old, enlisted five volunteers to answer licensing questions using a ticket system, and now fields more than 75 questions each week, according to compliance engineer Brett Smith. In the last couple of years, too, rather than maintaining just the GNU Project Web site, the FSF has also started a non-developer site that Peter Brown, executive director of the FSF, describes as carrying "more of a mainstream message.""

Comments (33 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

The Council of the EU does not support Linux

It seems that the Council of the European Union has a streaming service so that people can watch the meetings. That's a great idea, but they are using a proprietary format for the feed so that it can only be viewed on Microsoft Windows and Macintosh platforms. From the FAQ:
On which platforms can I view the live streaming media service of the Council of the European Union?

The live streaming media service of the Council of the European Union can be viewed on Microsoft Windows and Macintosh platforms. We cannot support Linux in a legal way. So the answer is: No support for Linux

A petition has been created by Stefan Esterer, asking the council to make the feed available to all by using a free codec. So if you are in the European Union and would like to watch the council meetings you should consider signing the petition.

Comments (35 posted)

The Free Ryzom campaign is unsuccessful

The Free Ryzom Campaign has announced that its bid to buy the Ryzom game from its bankrupt creator was turned down by the court. "At the end, there were three offers presented, and the other two were bigger than our's. They are keeping more employees than we do, and offer more money." The project is now discussing how it could continue and achieve its goal of creating a free multi-player online game. With the energy and resources they have pulled together, they could yet do interesting things. (Thanks to Dafydd Walters).

Comments (4 posted)

Nouveau driver pledge

The nouveau driver project is working on an open source 3D acceleration driver for nVidia cards. To help out the project David Nielsen has started a pledge drive. He's looking for 1000 people to each pledge $10 USD by February 8, 2007.

Comments (12 posted)

OLPC announces its user interface

The One Laptop Per Child project has sent out a press release proclaiming the virtues of the user interface it has developed. "The Sugar UI, jointly developed with Red Hat and Pentagram, is the first to have been purpose-built as an educational environment for children using laptops. It is designed to support the learning experiences of elementary- and secondary-school children in poor, often rural communities by providing them with opportunities to freely explore, experiment and express themselves."

Comments (2 posted)

Rwanda to deploy OLPC systems

The One Laptop Per Child project has announced that Rwanda will be rolling out OLPC systems. "In recognition of children being Rwanda's most precious natural resource, the government of Rwanda has committed to provide one laptop per child to all primary school children within five years."

Comments (14 posted)

Commercial announcements

Digium launches AsteriskNOW

Digium has announced the availability of "AsteriskNOW," a version of Asterisk bundled with an (unspecified) Linux distribution. It is claimed that, with AsteriskNOW, a functioning Asterisk phone system can be up and running within 30 minutes.

All the software is GPL, but registration is required to download it. Worse, registration requires agreeing to terms of use including this gem: "Digium hereby authorizes you to copy materials published by Digium on the Website solely for non-commercial use by you or internally within your organization (or if you are a Digium Distributor or Partner, your customer's organization) solely in support of Digium products. No other use of the information is authorized."

Update: the problem with the terms of use has been fixed.

Full Story (comments: 19)

eyeon Software Ships Fusion for Linux

eyeon Software has announced the availability of Fusion for Linux. Fusion is a visual effects software system. "Based on the recent December release of version 5.1, Fusion on Linux is the company’s next universal platform initiative. “We have been working hard on Fusion Linux, discovering along the way the necessary changes required to provide a product equal to the task of both the Fusion and Linux communities. And we’re really proud to deliver this in time for the holidays… I need some sleep and a beer.”"

Comments (none posted)

OpenRPT 2.0 open-source report writer announced

OpenMFG has announced version 2.0 of OpenRPT, a dual-licensed report writer. "OpenRPT 2.0 was retooled from the ground up to take full advantage of the underlying Qt 4 framework. Qt is an open source, comprehensive development framework that includes an extensive array of features, capabilities and tools that enable development of high-performance, cross-platform rich-client and server-side applications. Among the new OpenRPT features enabled by updating from Qt 3 to Qt 4 is the ability to export to Adobe PDF natively for both the OpenRPT API and the rendering application."

Full Story (comments: none)

Open Source Virtualization for Sun UltraSPARC T1

The OpenVZ project now runs on the Sun UltraSPARC T1 processor. "The OpenVZ project today announced its open source virtualization software is available for servers using Sun's breakthrough UltraSPARC(r) T1 CoolThreads(TM) processor. The operating system-level server virtualization software technology helps increase server utilization rates."

Full Story (comments: none)

Red Hat Reports Third Quarter Fiscal Year 2007 Results

Red Hat has announced their third quarter FY2007 financial results. " Total revenue for the quarter was $105.8 million, an increase of 45% from the year-ago quarter and 6% from the prior quarter. Subscription revenue was $88.9 million, up 48% year-over-year and 5% sequentially. Net income for the quarter was $14.6 million or $0.07 per diluted share compared with $11.0 million or $0.05 per diluted share for the prior quarter. Non-GAAP adjusted net income for the quarter was $29.6 million, or $0.14 per diluted share, after adjusting for stock compensation and tax expense as detailed in the tables below. This compares to non-GAAP adjusted net income of $22.7 million, or $0.11 per diluted share in the third quarter of last fiscal year."

Comments (none posted)

Resources

“Commercial” is not the opposite of Free-Libre / Open Source Software

David A. Wheeler presents an essay that looks at how commercial and open-source software are not mutually exclusive entities. "When I talk with with other people about Free-Libre / Open Source Software (FLOSS), I still hear a lot of people mistakenly use the term “commercial software” as if it had the opposite meaning of FLOSS (aka open source software, Free-Libre Software, or OSS/FS). That’s in spite of the rise in commercial development and support for FLOSS, most FLOSS projects’ goal to incorporate improvements, which are actually a form of financial gain, official definitions of “commercial item” that include FLOSS, and FLOSS licenses and projects that clearly approve of commercial support. Terms like “closed source” or “proprietary software” are plausible antonyms of FLOSS, but “commercial” is absurd as an antonym."

Comments (25 posted)

Contests and Awards

Voting Has Opened for the 2006 LinuxQuestions.org Members Choice Awards

LinuxQuestions.org has announced that voting for the 2006 LinuxQuestions.org Members Choice Awards is now open. The Members Choice Awards allow the Linux community to select their favorite products in a variety of categories. Awards will be given out in 21 categories this year, including Distribution of the Year, Browser of the Year, Office Suite of the Year, Desktop Environment of the Year and Database of the Year. The polls will close on February 18th and the winners will be announced shortly after.

Comments (none posted)

Surveys

BasKet Note Pads Usability Survey (KDE.News)

KDE.News has announced a new survey for BasKet Note Pads. "The aim of the BasKet Usability Project is to improve the usability of the BasKet Note Pads tool. Usability, as I (the project maintainer) see it, not only depends on the user interface, but also on the underlying assumptions that are made about the users and their context of use. So, knowledge of users, their contexts and claims are of vital importance for improving usability."

Comments (none posted)

Education and Certification

Test Your Knowledge of Samba Topics (Sys Admin)

Sys Admin has published a free Samba quiz. "Samba is one of those technologies that you must know if you are working with integration today. Its importance is such that it is a focal point of the newly announced LPIC-3 certification from the Linux Professional Institute. Following are fifty questions on general aspects of Samba that anyone working with it at an advanced level should know. Good luck (answers are at the end of the article)!"

Comments (none posted)

Calls for Presentations

ICMC 2007 call for participation

A call for participation has gone out for ICMC 2007, the International Computer Music Conference. "We are pleased to announce the general call for submission to the International Computer Music Conference 2007, which will take place at Holmen Island in Copenhagen starting Monday, August 27 and ending Saturday, September 1st, 2007. We invite original contributions in all areas of the computer music field in a number of formats. We are also open to any proposal, and encourage all submissions, including those that do not fit the categories below." The submission deadline is April 30.

Full Story (comments: none)

SambaXP 2007 Call For Papers

A call for papers has gone out for SambaXP 2007. "From April 23th to 25th 2007 developers and users will meet again in Goettingen, Germany at the sixth international SAMBA conference, the "samba eXPerience 2007"." Papers are due by February 5.

Comments (none posted)

ShmooCon, Washington DC call for papers

The next ShmooCon will take place in Washington DC on March 23-25, 2007. Papers are due by mid January.

Full Story (comments: none)

The O'Reilly Tools of Change for Publishing Conference

O'Reilly has announced the 2007 Tools of Change for Publishing Conference along with a call for proposals. "To raise the level of technology knowledge in the publishing industry and to provide a meeting ground for those leading the charge into the future of publishing, O'Reilly Media is launching the first Tools of Change for Publishing (TOC) Conference. The TOC Conference will take place June 18-20, 2007 in San Jose, California. The call for participation is now open; proposals are due no later than January 22, 2007."

Full Story (comments: none)

Upcoming Events

European Patent Conference, Brussels

The European Patent Conference will take place in Brussels, Belgium on January 24, 2007. "EUPACO-1 is the second in a series of events aimed at constructing a new European patent system through dialogue and collaboration based on research and data."

Full Story (comments: none)

Call for Location OOoCon 2007 - Deadline Extended

A call for location has gone out for the 2007 OpenOffice.org Conference. "The annual OpenOffice.org Conference (OOoCon) continues to go from strength to strength, with this year's glittering event in Lyon, France attracting over 600 registrations and enjoying a civic reception laid on by the Mayor of Lyon in the historic town hall. Can your team do even better next year?" The deadline for choosing the location has been extended to January 31, 2007.

Full Story (comments: none)

Events: January 11, 2007 to March 12, 2007

The following event listing is taken from the LWN.net Calendar.

Date(s)EventLocation
January 11
January 12
Foundations of Open Media Software Sydney, Australia
January 15
January 20
linux.conf.au 2007 Sydney, Australia,
January 20
January 26
Cell Hack-a-thon Loveland, CO, USA
January 23
January 26
Open Source Meets Business Nürnberg, Germany
January 24 European Patent Conference Brussels, Belgium
January 30
February 1
Solutions Linux Expo Paris, France
February 1
February 2
LinuxDays Luxembourg Luxembourg, Luxembourg
February 2 FUDCon Boston 2007 Boston, MA, USA
February 7
February 9
Free Software World Conference 3.0 Badajoz, Spain
February 7
February 9
Xorg Developer's Conference Santa Clara, CA, USA
February 9 Women In Open Source Los Angeles, USA
February 9 Open Source Health Care Summit Los Angeles, USA
February 10
February 11
2007 Southern California Linux Expo Los Angeles, USA
February 12
February 13
Vancouver PHP Conference Vancouver, BC, Canada
February 12
February 13
Linux Storage and Filesystem Workshop San Jose, CA, USA
February 12
February 16
Ruby on Rails Bootcamp Training Atlanta, USA
February 12
February 15
3GSM World Congress 2007 Barcelona, Spain
February 14
February 15
LinuxWorld OpenSolutions Summit New York, NY, USA
February 15 TiE Open Source Summit Pittsburgh, PA, USA
February 16 The Ubucon New York New York, NY, USA
February 19
February 23
DebianEDU DevCamp Soissons, France
February 22 PyCon Tutorial Day Addison, Texas,
February 22 CELF Japan Linux Technical Jamboree #13 Tokyo, Japan
February 22
February 24
OpenMind 2007 San Giorgio a Cremano, Naples, Italy
February 23
February 25
PyCon 2007 Addison, Texas,
February 23 PHP Conference UK 2007 London, England
February 24
February 25
Free and Open Source Software Developers' European Meeting Brussels, Belgium
February 24
February 25
Java/DevJam/2007/Fosdem Brussels, Belgium
February 26
March 1
PyCon Sprints Addison, Texas,
February 26
March 2
PHP5 Bootcamp Training at the Big Nerd Ranch Atlanta, Georgia, USA
February 27
March 1
O'Reilly Emerging Telephony Conference San Francisco, CA,
February 27
March 2
EUSecWest Applied Security Conference London, UK
February 28
March 2
Network and Distributed System Security Symposium San Diego, CA, USA
March 2
March 3
LinuxForum 2007 Copenhagen, Denmark
March 3
March 8
O'Reilly Emerging Technology Conference San Diego, CA, USA
March 5
March 8
EclipseCon 2007 Santa Clara, CA, USA
March 5
March 6
Karlsruhe Workshop on Software Radios Karlsruhe, Germany
March 8
March 10
2007 Open Source Think Tank Napa, CA, USA
March 10
March 13
Camp 5 Advanced Zope3 Training Charlotte, North Carolina, USA

If your event does not appear here, please tell us about it.

Web sites

GNU Herds - Free Software Association

The GNU Herds site has been launched. "GNU Herds is a not-for-profit and true-democratic association which aims to encourage the professional development of Free Software contributors."

Full Story (comments: none)

Page editor: Forrest Cook

Letters to the editor

Recent comments

From:  James Rich <james-AT-eaerich.com>
To:  letters-AT-lwn.net
Subject:  Recent comments
Date:  Wed, 27 Dec 2006 13:59:38 -0700 (MST)

Dear Editor,

Recent comments posted to articles on LWN have not been of the usual 
quality I have come to expect from LWN readers.  A number of comments have 
been rude, used foul language, and consisted of personal attacks and 
childish name calling.  I would like to ask LWN readers to please 
carefully consider their comments before posting them.  LWN is not the 
place for such behaviour.  The Internet is certainly large enough that 
such comments can find a more suitable forum.

James Rich

It's not the software that's free; it's you.
 	- billyskank on Groklaw

Comments (14 posted)

Page editor: Jonathan Corbet

Copyright © 2007, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds