Your editor has long enjoyed photography. As a high school student, he
even pondered, briefly, the idea of pursuing photography as a career; for
better or for worse, common sense won out and your editor went to
engineering school instead. But taking pictures has remained an active
hobby, even if it has tended to degrade to the creation of a stream of
snapshots of the kids for grandparent consumption in recent years. The
advent of digital photography has brought a couple of your editor's
passions back together, with only one thing - free time - missing. But,
your editor has discovered, one of the keys to the finding of free time is
to take an activity of interest and redefine it as "work." Thus, this
article.
A while back, your editor stumbled across the Flickr HDR pool; some
of the photos in that pool were sufficiently amazing to inspire an
immediate "I wanna do that" reaction. The better part of a year later, it
finally became possible to learn a bit more about the process behind
those pictures. HDR (or high dynamic range)
photography is a set of techniques for overcoming the limitations of
contemporary hardware and, in the process, generating images which better
represent a scene as viewed by the human eye - or which appear to come from
a work of fantasy art.
The sensors in today's digital cameras have gotten good, but they still
fall short of the human eye in a few ways. In particular, the range of
light levels which can be captured by the sensor is not yet up to what film
can handle, and is far from what the eye can do. Anybody who has spent any
time taking pictures is familiar with this problem: one can take a
beautiful landscape picture, but, in the end result, the wild cloud
formations are washed out completely and the shadows just go black. Being
unable to capture a scene that one can see quite well can be most
frustrating.
The idea behind HDR, as it is used with photography, is to extend the
available dynamic range by taking multiple shots at different exposure
levels. For a given exposure, there will be a range of light levels which
will be captured with good resolution by the sensor; everything else gets
compressed at one end or the other. If one has a series of images at
different exposures and a reasonable model of the camera's response curve,
one can generate a composite image by using the parts of each source image
which are in the good part of the curve. So, in that landscape picture, a
very dark exposure can be used for the bright parts of the scene - clouds,
for example - while a bright exposure yields low-light details. By mixing
them together, the HDR algorithm can produce an image with full sensor
resolution across a much wider dynamic range.
As an example, consider the photograph below, taken from your editor's
dining room:
| Original | HDR |
![[Original]](/images/ns/grumpy/hdr/window-orig-sm.jpg) |
![[HDR]](/images/ns/grumpy/hdr/window-cf-sm.png) |
(Larger versions of the images are
available.) In the original, parts of the plant in the foreground are
entirely lost in the shadows. Meanwhile, the breathtaking view of Colorado
suburbia (with mountains in the distance) is washed out entirely. The HDR
version brings all of that detail back.
HDR is not applicable to all situations. It has a tendency to turn people
into cartoon characters. Beyond that, the need for multiple exposures
generally implies setting up a tripod and taking some time for the entire
process. It is thus not well suited to changing scenes, sports photography
(though baseball, perhaps, can be expected to stand still for the requisite
time), etc. It can work well for relatively static scenes: landscapes,
buildings, the SCO case, and so on.
Most of the people playing with HDR seem to be using proprietary plugins
for a proprietary image manipulation program running under a proprietary
operating system. That is, needless to say, not your editor's preferred
mode of operation. Thus your editor began a search for tools which would
perform HDR processing under Linux. It turns out that there are a few such
tools around; there is no need to use proprietary software for this task.
HDR generation
The first step is to look for a way to represent HDR images - normal image
formats are not up to that task. Linux.com ran
a reasonable
article on HDR formats late last year; the end result appears to be
that the
OpenEXR format is the way to
go. The OpenEXR package comes with the libraries needed by other
applications and the deeply painful "exrdisplay" image viewer. The
pfstools package
adds a set of pipeline-oriented tools for working with HDR images; it is a
necessary part of any HDR hobbyist's toolkit.
Next, one should come up with a set of source images. Ideally, these images are
taken with a tripod-mounted camera and cover a range of at least two
f-stops above and below the nominally "correct" exposure. Varying the
exposure time is preferred over changing the aperture; if nothing else,
this ensures that all of the images will have the same depth of field. One
can start with images taken without a tripod, but it will be
necessary to register them before continuing. Your editor did not get into
that aspect of the task; tools like hugin and hdrprep
can be used for this job. These tools may be a good topic for your
editor's attention in a future article. One can also apply HDR techniques
to a single image, especially if it is in the camera's raw format, but
multiple exposures give much better results.
With the images in place, one can look at combining them into an HDR
image. This is a two-stage process (two user-visible stages, at least):
creating a set of response curves and using them to map the images together
into a single dynamic range space. The response curves are a mapping
between some sort of real-world light levels and the resulting sensor
values on all three color channels. When combined with information on the
relative exposure times of two (or more images), the response curves allow
the HDR program to map pixels from all of the images into the same space.
The response curves can be generated directly from the source images; they
don't normally change, so they can be saved and reused later.
The first HDR-generation tool to look at is cinepaint,
once known as "Film Gimp." This tool is a fork of the GIMP which is aimed
at use by movie studios; its floating-point image data support makes it useful for
HDR processing as well. The generation of HDR is done with the "bracketing
to HDR" plugin which is, happily, packaged with the cinepaint source
distribution. There is a
detailed explanation of what this plugin does and how to use it. Be
warned that it makes for somewhat difficult reading - and it would even if
it weren't originally written in German.
The good news is that actually using this plugin is easy. One selects
"bracketing for HDR" from the File->New from menu, then
selects the set of source images from a simple dialog. The plugin will
then import them. There is no provision for obtaining the relative
exposure information from the image files themselves; instead, the plugin
sorts the images by brightness and applies an assumed (adjustable) exposure
difference between them.
It attempts to feed each image to dcraw for decoding, but your
editor was not able to get raw images to work despite the fact that dcraw
supports his camera just fine; it looks like the raw import plugin was
written for an older version of dcraw. That problem is likely to be easily
overcome; your editor just didn't want to spend much time on it. So TIFF
files were used instead.
Once the images are in, the user can check the exposure values, then hit
the "compute response" button. That yields the two plots shown in the
screenshot. By messing around with the buttons, one can look for the
reference image which yields the smoothest set of response curves - or one
can just accept what the plugin does by default.
Then a click on the "generate HDR" button creates the final
product, which can then be saved out in the OpenEXR format.
Your editor set out to take some amazing pictures for this article. The
area in which your editor resides is widely held to be beautiful, but,
frankly, Colorado is not at its best in early March; perhaps this article
should have been written in June. Nonetheless, the effort
was made. Below is a rather mediocre shot of the Boulder foothills in
original and HDR (with cinepaint) forms (larger
versions available).
| Original | HDR |
![[Original]](/images/ns/grumpy/hdr/flagstaff-orig-sm.jpg) |
![[HDR]](/images/ns/grumpy/hdr/flagstaff-cp-sm.png) |
The HDR image above shows a halo effect (the bright sky above the mountain)
which is characteristic of some tone mapping algorithms; we'll get into
tone mapping shortly.
An alternative approach is PFScalibration,
a command-line HDR generation utility based on pfstools. These tools work
as a netpbm-like pipeline; their use requires a fair amount of typing,
though much of the work can be scripted. The steps are the following:
- Run jpeg2hdrgen to generate a description file for the source
images. It reads the EXIF information from the source files to get
the relative exposures and outputs it in a simple file. There is a
dcraw2hdrgen tool as well, but the subsequent stages in the
pipeline are not able to work with raw files. Your editor suspects
that TIFF files could be used by creating the hdrgen file by hand, but
the whole process seems to be intended for use with JPEG files. A
lossy file format is not the most auspicious starting point for
somebody interested in high dynamic range imagery, but that's how it
is.
- The pfshdrcalibrate utility can then be used to create a set
of response curves; gnuplot can be used to visualize them.
This process can take some time (it's significantly slower than
cinepaint), but the resulting file can be saved and reused with
different images in the future.
- Another pfshdrcalibrate run then uses the response curves to
create the HDR image. Piping the output into pfsoutexr
generates an OpenEXR file.
Here's an example generated from a series of pictures of your editor's
dungeon office (larger
versions):
| Original | HDR |
![[Original]](/images/ns/grumpy/hdr/office-orig-sm.jpg) |
![[HDR]](/images/ns/grumpy/hdr/office-pc-sm.png) |
As a general rule, HDR images generated with cinepaint and PFScalibration
tend to look identical. The generation of HDR is not where the real magic
lies, so the results should be close.
For those who don't like command-line HDR processing, the qtpfsgui utility may be worth a
look. It is a graphical wrapper around PFScalibration based on QT4; it
handles both HDR generation and tone mapping. On the HDR side, it puts up
a file selection dialog for the source images followed by the "HDR creation
wizard." The user is asked to select a "creation configuration," from a
list of configurations helpfully named "Configuration 1" through
"Configuration 6". The advice to stick with Configuration 1 was
hard for your editor to ignore; simply hitting "next" generated the image.
Said image appeared in a display window; like exrdisplay, this window can
only show the image in full resolution. Your editor, lacking a
7 megapixel monitor, was thus unable to view the entire image at
once. Even worse, qtpfsgui is one of the family of (generally KDE-based)
graphical tools which feels the need to implement its own window manager.
The display window lives within the larger qtpfsgui window; it cannot be
resized with the usual shortcut your editor is used to. In summary,
qtpfsgui gets the job done, but writing a simple script around
PFScalibration seems like an easier way to go.
Tone mapping
While the tools above will generate a fine HDR image, one problem remains:
the dynamic range in that HDR image far exceeds the range of your editor's
monitor (or printer). Turning that image into something which can be
displayed requires a step called tone mapping. This is
where the serious magic comes in: somehow the vast amount of information in
the HDR image must be scaled back in a way which does not compromise the
image quality that was the whole point of this exercise in the first place.
Several tone mapping algorithms exist, and most of them have a number of
mysterious knobs to tweak. While the generation of HDR can be mostly
automated, tone mapping inherently requires experimentation and human
judgment.
The bulk of the action appears to be in the pfstmo package, which
implements several tone mapping algorithms as separate, standalone
filters. One can use pfstmo with the rest of the pfstools package to
construct pipelines which generate tone-mapped images. Given the iterative
nature of the task, however, it would be nice if there were a better way.
That better way is qpfstmo,
a Qt-based graphical interface to pfstmo. The interface feels a little
clunky at times, and it would sure be nice to have some online
documentation on what the various parameters do, but qpfstmo does what is
really needed: it lets the user play with tone mapping algorithms and
compare the results. A small image size can be used for trying out
algorithms and parameters - a real time saver, since some of the algorithms
can take a long time on a full-size image - and multiple versions of the image can be on the
screen at once. When a final configuration is found for a given image, it
can be generated in a larger size and saved in any of the usual image
formats. When applied to a large image file, this step can be rather hard
on the hardware; your editor discovered that 1GB of memory was not really
enough.
The qtpfsgui tool mentioned above has the ability to drive pfstmo as well.
It is, in fact, clear that this tool shares a lot of code with pfstmo. The
interface is far less friendly, however: everything happens within the One
Big Window and it does not appear to be possible to see the results from
more than one algorithm at the same time. It resets the display image size
every time the user changes algorithm. One assumes that this (fairly new)
tool will improve over time. For now, though, qpfstmo seems like a much
better way to go for tone mapping control.
A different set of tone mapping operators is supplied with the exrtools distribution. Your editor
tried them all; each one is a cumbersome, multi-step process. It can take
a long time to process an image, only to find that the parameters need
quite a bit of tweaking. The tools seem like they will do quality
transformations, but they just cry out for a qpfstmo-like interface which
allows experimentation with smaller-size images and comparison of results.
For what it's worth, here's a shot taken from the hill above your editor's
house mapped with the exrtools non-linear masking method:
| Original | HDR |
![[Original]](/images/ns/grumpy/hdr/arapaho-orig-sm.jpg) |
![[HDR]](/images/ns/grumpy/hdr/arapaho-nlm-sm.png) |
See the larger versions for more detail.
Doubtless one could get good results from these tools with enough effort,
but your editor found it easier to get quality images with psftmo.
Conclusion
For the generation of HDR images, your editor found cinepaint to be faster
and simpler to work with. This does not count, however, the long and
frustrating experience of building the HDR plugin on a Fedora
Rawhide system; one gets the sense that the plugin's author uses a rather
older, less picky version of g++. Longer-term, however, the PFScalibration
suite may prove to be the way to go. It is far more compact and easy to
install on a new system; why lug the weight of cinepaint if one is not
going to use its other features? A bit of scripting will easily turn
PFScalibration into a single-command HDR generation tool.
It's worth noting that there are a couple of other HDR generators for Linux
out there. MakeHDR is
where a lot of it started; one of its authors is Paul Debevec, who did much
of the early research in this area. The code was last touched in 1999,
however, and it comes with a "educational purposes only" license. One can
also look at HDRgen, but it is a
binary-only, free-beer tool. Your editor did not actually try either one
of them; given that the free tools do the job so well, there didn't seem to
be any point.
For tone mapping, pfstmo (and qpfstmo) are the best tools at this point. It is
hard to be entirely satisfied with the state of the art in this area,
though. Tone mapping will always be an exercise in compromises, so it's
not surprising that the results are rarely perfect. There is likely to be
room for improvement - in both the algorithms and the interface to them -
for some time to come.
As is the case in many areas, Linux has the tools one needs to play with
high dynamic range imagery. One just has to work a little harder to get
started than on some other systems. HDR has found its way into your
editor's photographic toolkit; look for the results in the reporting from
some conference in some exotic part of the world. When playing with this
stuff, your editor is far from grumpy.
Comments (29 posted)
The problem first
came
up in February: the Red Hat Directory Server developers would like to
include the Java Security Services module in the Fedora distribution. The
code, it seems, is free, but there is still a problem: the Java virtual
machine requires that all Java Cryptography Extension providers (of which
JSS is one) to be signed with a Sun-approved key. If an application tries
to use a JCE module which lacks the requisite signature, the whole thing
comes crashing down - an experience which probably differs from what the
user had in mind. In practice, this limitation means that users either use
the signed version obtained from Sun, or do not use JSS at all.
Warren Togami recently posted a couple of
possibilities for how Fedora might be able to ship JSS. They were:
- The Fedora team builds the JSS module, then compares it to the
Sun-signed version. Assuming they match, Fedora has proved that it
can rebuild the software. So the project can declare Mission
Accomplished, dump the module it just built, and ship Sun's version.
A variation on this approach suggested later on involved having Red
Hat obtain an approved key and sign the modules that Fedora would
distribute; in this way, Fedora could add its own modifications.
- Fedora ships an unsigned version of JSS. Applications would then have
to be recoded to load the module in a way which shorts out the
signature check. Any applications not fixed up in this way would
fail.
The first option, at first blush, would appear to work. Fedora would be
able to build its own module and ship the source. It falls down, however,
as soon as a Fedora user tries to make a change; that user will not be able
to rebuild the patched module in a way that will actually work. Derivative
distributions would run into the same problem. As a result, it would
appear that Fedora stopped considering this option fairly quickly.
Not signing the module at all has obvious problems as well. It seems
likely that many potential JSS users have their own applications in mind.
If those applications do not work, they will rightly see Fedora as not
having support for the features they are looking for.
Other alternatives have been considered; one is to emphasize the use of the
GCJ compiler and try to steer users away from Sun's virtual machine. That
approach would certainly offer a higher degree of freedom, at the cost of
not really providing what many Java users appear to want. Additionally,
not everybody is convinced that GCJ has achieved the level of maturity that
many users would expect.
In an interesting way, this is really just the Tivo problem under a
different guise. Locked-down hardware refuses to run software which lacks
the expected signatures. In this case, we have virtual hardware, in the
form of the Java virtual machine, which is doing the same thing. The
result is the same as well: the software is available and nominally free,
but the users of that software cannot create their own versions and expect
to be able to run them.
If Sun follows through on its desire to move to GPLv3, and if that license
retains its requirement that any needed signing keys be distributed with
the source, Sun may find itself in an interesting position. It is hard to
see how the current policy would be compliant with the new GPL's
requirements.
The upcoming GPL Java release would appear to be the best hope for
distributors trying to deal with this situation. Once the code is free,
distributors can patch it to make the whole of Java distributable as free
software. So the real solution to shipping JSS with a distribution which
insists on freedom would appear to be to wait for a free Java.
Comments (9 posted)
Page editor: Jonathan Corbet
Security
March 14, 2007
This article was contributed by Jake Edge.
Websites with malicious content are a growing problem,
so tools to detect this content and alert the user to its presence
are quite welcome. A plugin for Firefox called
Firekeeper uses the ideas behind
intrusion
detection systems (IDS) and applies them to web traffic. Firekeeper
uses some of the rule syntax and pattern matching code from
Snort, the venerable open source IDS,
providing it with a solid foundation.
As with any IDS, the basic function of Firekeeper is to inspect the traffic
that it sees, applying some pattern matching smarts and a set of rules to
determine what actions it takes. The possible actions are to alert the
user and allow them to decide what to do, stop processing the HTTP response
without user interaction or to accept and continue processing, also without
consulting the user. Alert rules can also provide extra information
that will be displayed with the alert in order to help the user make an
informed decision about what action to take. This information can
take the form of text strings to describe the content as well as references
to URLs, CVE entries and Bugtraq IDs potentially giving the user a wealth
of descriptive information.
Firekeeper can do pattern matching on three different parts of the HTTP or
HTTPS response: the URL, headers and body. The simplest form matches literal
strings in the various pieces of the response, but there is also a
Perl compatible regular expression (regexp) engine that can be applied to
each piece as well. The documentation warns of serious performance
implications from having too many regexps, especially ones that do not
contain a literal rule to narrow the search space; good advice for
most applications that use regexps.
Firekeeper can be downloaded from the project site and it installs flawlessly
if one is willing to add the site (hosted at mozdev.org) to the list
of trusted plugin locations and ignore the unsigned nature of the code.
The source is available from the site as well so those with concerns about
the security bypasses can build their own version. It comes with a handful
of default rules
and a test page to
try them out as well. Visiting various sites with Firekeeper enabled while
working on this article did not noticeably slow down the browser for the
author and, other than the tests, did not trigger any rules.
Any IDS is an invasive program and has access to all sorts of information
one probably wants to keep private, particularly decrypted network data.
This makes IDS programs high profile targets for exploitation. If an
attacker can send a packet or series of packets that can subvert the IDS,
they can potentially eavesdrop on all network traffic, even encrypted
traffic. Because Firekeeper has access to the decrypted HTTPS traffic,
there is reason to be concerned that the plugin could be subverted via
the same kinds of remotely exploitable vulnerabilities that have impacted
Snort, a recent example is
here.
Firekeeper implements a small subset of the Snort functionality, which should
make it less likely, but users of the plugin should be aware of the
possibility.
An IDS is only as good as the rules that it uses, and newer exploits (and
so-called 0-days)
will not yet have rules available, leaving a window of vulnerability.
Firekeeper does have provisions for loading rule files from external sites
(which, of course, has its own set of security issues) that would help
propagate new rules quickly, at least for users who restart their browser
frequently.
Firekeeper is certainly not for less technical users and probably never will
be. There is too much knowledge and understanding of web protocols and
security threats required to understand the alerts and too many false
positives to turn the alerts into blocks. And like many security tools
and techniques, this is no panacea; it will not stop all browser-targeted
attacks, but it does have its uses. An alert that a site has tried to
exploit a browser bug, even one that does not affect the browser version
being used, is still useful information which can help users to avoid dodgy sites.
Comments (1 posted)
Brief items
Visitors to the
OpenBSD site will notice
that it now reads "Only two remote holes in the default install, in more
than 10 years!" That's one more than it had a little while ago. The
details can be found in
this Core Security
advisory: it seems that the problem was in the IPv6 code. It's amusing
to read the timeline - the OpenBSD folks were apparently not enthusiastic
about accepting the existence of a remotely exploitable vulnerability.
They did accept it, though, and their record over many years remains
impressive.
Comments (28 posted)
New vulnerabilities
amarok: remote code injection
| Package(s): | amarok |
CVE #(s): | |
| Created: | March 14, 2007 |
Updated: | March 14, 2007 |
| Description: |
Amarok's Magnatune component suffers from a shell code injection vulnerability exploitable by a hostile remote server. |
| Alerts: |
|
Comments (none posted)
kdelibs: denial of service
| Package(s): | kdelibs |
CVE #(s): | CVE-2007-1308
|
| Created: | March 8, 2007 |
Updated: | March 29, 2007 |
| Description: |
Kdelibs has a denial of service vulnerability that can be triggered in
Konqueror's use of KDE JavaScript. A null pointer dereference caused
by accessing the content of an iframe with an ftp:// URI in the src
attribute can be used to trigger the DOS. |
| Alerts: |
|
Comments (none posted)
ktorrent: incorrect validation
| Package(s): | ktorrent |
CVE #(s): | CVE-2007-1384
CVE-2007-1385
CVE-2007-1799
|
| Created: | March 13, 2007 |
Updated: | October 24, 2007 |
| Description: |
Bryan Burns of Juniper Networks discovered that KTorrent did not
correctly validate the destination file paths nor the HAVE statements
sent by torrent peers. A malicious remote peer could send specially
crafted messages to overwrite files or execute arbitrary code with user
privileges. |
| Alerts: |
|
Comments (1 posted)
mplayer: buffer overflow
| Package(s): | mplayer |
CVE #(s): | CVE-2007-1246
|
| Created: | March 8, 2007 |
Updated: | April 1, 2008 |
| Description: |
MPlayer versions up to 1.0rc1 have a buffer overflow in the
loader/dmo/DMO_VideoDecoder.c DMO_VideoDecoder_Open function.
user-assisted remote attackers can use this to create a buffer overflow
and possibly execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
silc-server: denial of service
| Package(s): | silc-server |
CVE #(s): | |
| Created: | March 14, 2007 |
Updated: | March 14, 2007 |
| Description: |
silc-server, a Secure Internet Live Conferencing protocol implementation, has a NULL pointer dereference which can be exploited to crash the server. |
| Alerts: |
|
Comments (none posted)
xen, qemu: information disclosure
| Package(s): | Xen |
CVE #(s): | CVE-2007-0998
|
| Created: | March 14, 2007 |
Updated: | March 20, 2007 |
| Description: |
From the Red Hat advisory: a flaw was found affecting the VNC server code in QEMU. On a
fully virtualized guest VM, where qemu monitor mode is enabled, a user who
had access to the VNC server could gain the ability to read arbitrary files
as root in the host filesystem. |
| Alerts: |
|
Comments (none posted)
xine-lib: arbitrary code execution
| Package(s): | xine-lib |
CVE #(s): | CVE-2007-1387
|
| Created: | March 13, 2007 |
Updated: | April 1, 2008 |
| Description: |
Moritz Jodeit discovered that the DirectShow loader of Xine did not
correctly validate the size of an allocated buffer. By tricking a user
into opening a specially crafted media file, an attacker could execute
arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
acroread: multiple vulnerabilities
| Package(s): | acroread |
CVE #(s): | CVE-2006-5857
CVE-2007-0045
CVE-2007-0046
|
| Created: | January 11, 2007 |
Updated: | October 26, 2009 |
| Description: |
Adobes acrobat reader has the following vulnerabilities:
The Adobe Reader Plugin has a cross site scripting vulnerability that
can be triggered by processes malformed URLs. Arbitrary JavaScript can
be served by a malicious web server, leading to a cross-site scripting
attack.
Maliciously crafted PDF files can be used to trigger two vulnerabilities,
if an attacker can trick a user into viewing the files, arbitrary code
can be executed with the user's privileges. |
| Alerts: |
|
Comments (1 posted)
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2006-3918
|
| Created: | August 9, 2006 |
Updated: | April 4, 2008 |
| Description: |
From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server
was returned to the user in an unescaped error message. This could
allow an attacker to perform a cross-site scripting attack if a victim was
tricked into connecting to a site and sending a carefully crafted Expect
header." |
| Alerts: |
|
Comments (none posted)
bind: denial of service
| Package(s): | bind |
CVE #(s): | CVE-2007-0493
CVE-2007-0494
|
| Created: | January 26, 2007 |
Updated: | March 14, 2007 |
| Description: |
The bind package is vulnerable to two remote denial of service attacks in
which attackers can cause the bind daemon to to crash or exit unexpectedly
by providing malformed data to the daemon in a DNS request. |
| Alerts: |
|
Comments (none posted)
bluez-utils: hidd vulnerability
| Package(s): | bluez-utils |
CVE #(s): | CVE-2006-6899
|
| Created: | January 16, 2007 |
Updated: | May 14, 2007 |
| Description: |
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain
control of the Mouse and Keyboard Human Interface Device (HID) via a
certain configuration of two HID (PSM) endpoints, operating as a server,
aka HidAttack. |
| Alerts: |
|
Comments (none posted)
bugzilla: multiple vulnerabilities
| Package(s): | bugzilla |
CVE #(s): | CVE-2006-5453
CVE-2006-5454
CVE-2006-5455
|
| Created: | November 10, 2006 |
Updated: | August 28, 2007 |
| Description: |
Bugzilla has the following vulnerabilities:
Input data passed to various fields is not properly sanitized before
being passed back to users.
Users can gain unauthorized access to read attachment
descriptions while using diff mode.
HTTP GET and HTTP POST requests can be used to perform unauthorized
actions due to improper verification.
Input that is passed to showdependencygraph.cgi is not properly
sanitized before being returned to users. |
| Alerts: |
|
Comments (none posted)
busybox: insecure password generation
| Package(s): | busybox |
CVE #(s): | CVE-2006-1058
|
| Created: | May 5, 2006 |
Updated: | May 2, 2007 |
| Description: |
The BusyBox 1.1.1 passwd command does not use a proper salt when generating
passwords. This would create an instance where a brute force attack could
take very little time. |
| Alerts: |
|
Comments (2 posted)
clamav: directory traversal, denial of service
| Package(s): | clamav |
CVE #(s): | CVE-2007-0897
CVE-2007-0898
|
| Created: | February 20, 2007 |
Updated: | March 7, 2007 |
| Description: |
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors
under certain conditions, which allows remote attackers to cause a denial
of service (file descriptor consumption and failed scans) via CAB archives
with a cabinet header record length of zero, which causes a function to
return without closing a file descriptor. (CVE-2007-0897)
Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before
0.90 allows remote attackers to overwrite arbitrary files via a .. (dot
dot) in the id MIME header parameter in a multi-part
message. (CVE-2007-0898) |
| Alerts: |
|
Comments (none posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
vixie-cron: privilege escalation
| Package(s): | cron |
CVE #(s): | CVE-2006-2607
|
| Created: | May 31, 2006 |
Updated: | June 1, 2009 |
| Description: |
The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root. |
| Alerts: |
|
Comments (1 posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2006-4262
|
| Created: | October 2, 2006 |
Updated: | June 16, 2009 |
| Description: |
Will Drewry of the Google Security Team discovered several buffer overflows
in cscope, a source browsing tool, which might lead to the execution of
arbitrary code. |
| Alerts: |
|
Comments (none posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2004-2541
|
| Created: | May 22, 2006 |
Updated: | June 19, 2009 |
| Description: |
A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows
remote attackers to execute arbitrary code via a C file with a long
#include line that is later browsed by the target. |
| Alerts: |
|
Comments (1 posted)
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
| Package(s): | cyrus-sasl |
CVE #(s): | CVE-2006-1721
|
| Created: | April 21, 2006 |
Updated: | September 4, 2007 |
| Description: |
Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5
process that could lead to a Denial of Service. An attacker could possibly
exploit this vulnerability by sending specially crafted data stream to the
Cyrus-SASL server, resulting in a Denial of Service even if the attacker is
not able to authenticate. |
| Alerts: |
|
Comments (none posted)
dovecot: index cache file handling error
| Package(s): | dovecot |
CVE #(s): | CVE-2006-5973
|
| Created: | November 29, 2006 |
Updated: | May 8, 2007 |
| Description: |
The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable. |
| Alerts: |
|
Comments (none posted)
ekiga: format string vulnerability
| Package(s): | ekiga |
CVE #(s): | CVE-2007-1006
CVE-2007-0999
|
| Created: | February 21, 2007 |
Updated: | March 30, 2007 |
| Description: |
Ekiga contains a format string vulnerability in the code which processes
control messages from remote peers.
If a user was running Ekiga and listening for incoming calls, a remote
attacker could send a crafted call request, and execute arbitrary code with
the user's privileges. |
| Alerts: |
|
Comments (none posted)
elinks: arbitrary file access
| Package(s): | elinks |
CVE #(s): | CVE-2006-5925
|
| Created: | November 16, 2006 |
Updated: | October 22, 2009 |
| Description: |
The elinks text-mode browser has an arbitrary file access vulnerability
in the Elinks SMB protocol handler. If a user can be tricked into
visiting a specially crafted web page, arbitrary files may be read or
written with the user's permissions. |
| Alerts: |
|
Comments (none posted)
fail2ban: denial of service
| Package(s): | fail2ban |
CVE #(s): | CVE-2006-6302
|
| Created: | February 16, 2007 |
Updated: | July 30, 2007 |
| Description: |
fail2ban 0.7.4 and earlier does not properly parse sshd logs file, which
allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file
and cause a denial of service by adding arbitrary IP addresses to the sshd
log file, as demonstrated by logging in to ssh using a login name
containing certain strings with an IP address. |
| Alerts: |
|
Comments (3 posted)
fetchmail: password disclosure and DOS
| Package(s): | fetchmail |
CVE #(s): | CVE-2006-5867
CVE-2006-5974
|
| Created: | January 10, 2007 |
Updated: | March 16, 2007 |
| Description: |
Fetchmail suffers from a password disclosure vulnerability due to a failure to use secure protocols (advisory) and a denial of service vulnerability (advisory). |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflows
| Package(s): | ffmpeg |
CVE #(s): | CVE-2006-4799
CVE-2006-4800
|
| Created: | September 14, 2006 |
Updated: | May 28, 2007 |
| Description: |
the AVI processing code in FFmpeg has a number of buffer overflow
vulnerabilities.
If an attacker can trick a user into loading a specially crafted
crafted AVI, arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (2 posted)
Mozilla stuff: multiple vulnerabilities
Comments (none posted)
freeradius: several vulnerabilities
| Package(s): | freeradius |
CVE #(s): | CVE-2005-4745
CVE-2005-4746
|
| Created: | August 8, 2006 |
Updated: | April 24, 2007 |
| Description: |
Several remote vulnerabilities have been discovered in freeradius, a
high-performance RADIUS server, which may lead to SQL injection or denial
of service. |
| Alerts: |
|
Comments (none posted)
freetype: integer overflows
| Package(s): | freetype |
CVE #(s): | CVE-2006-0747
CVE-2006-1861
CVE-2006-2493
CVE-2006-2661
CVE-2006-3467
|
| Created: | June 8, 2006 |
Updated: | June 1, 2010 |
| Description: |
The FreeType library has several integer overflow vulnerabilities.
If a user can be tricked into installing a specially
crafted font file, arbitrary code can be executed with the privilege
of the user. |
| Alerts: |
|
Comments (none posted)
gcc: file overwrite vulnerability
| Package(s): | gcc |
CVE #(s): | CVE-2006-3619
|
| Created: | September 6, 2006 |
Updated: | March 14, 2008 |
| Description: |
The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree. |
| Alerts: |
|
Comments (none posted)
gd: buffer overflow
| Package(s): | gd |
CVE #(s): | CVE-2007-0455
|
| Created: | February 7, 2007 |
Updated: | November 18, 2009 |
| Description: |
The gd graphics library contains a buffer overflow which could enable a remote attacker to execute arbitrary code. Note that various other packages include code from gd and could also be vulnerable. |
| Alerts: |
|
Comments (2 posted)
gdb: buffer overflow
| Package(s): | gdb |
CVE #(s): | CVE-2006-4146
|
| Created: | September 15, 2006 |
Updated: | June 12, 2007 |
| Description: |
A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU
Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to
execute arbitrary code via a crafted file with a location block
(DW_FORM_block) that contains a large number of operations. |
| Alerts: |
|
Comments (none posted)
gdm: improper file permissions
| Package(s): | gdm |
CVE #(s): | CVE-2006-1057
|
| Created: | April 19, 2006 |
Updated: | May 2, 2007 |
| Description: |
The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gnupg: stack overwrite
| Package(s): | gnupg |
CVE #(s): | CVE-2006-6235
|
| Created: | December 12, 2006 |
Updated: | March 13, 2007 |
| Description: |
A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to
execute arbitrary code via crafted OpenPGP packets that cause GnuPG to
dereference a function pointer from deallocated stack memory. |
| Alerts: |
|
Comments (3 posted)
GnuPG: unsigned data injection vulnerability
| Package(s): | gnupg |
CVE #(s): | CVE-2007-1263
|
| Created: | March 6, 2007 |
Updated: | March 30, 2007 |
| Description: |
Core Security Technologies has reported
that GnuPG and GnuPG clients are vulnerable to an unsigned data injection
vulnerability. |
| Alerts: |
|
Comments (none posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
gv: stack-based buffer overflow
| Package(s): | gv |
CVE #(s): | CVE-2006-5864
|
| Created: | November 20, 2006 |
Updated: | April 9, 2007 |
| Description: |
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv
3.6.2, and possibly earlier versions, allows user-assisted attackers to
execute arbitrary code via a PostScript (PS) file with certain headers that
contain long comments, as demonstrated using the DocumentMedia header. |
| Alerts: |
|
Comments (none posted)
gzip: multiple vulnerabilities
| Package(s): | gzip |
CVE #(s): | CVE-2006-4334
CVE-2006-4335
CVE-2006-4336
CVE-2006-4337
CVE-2006-4338
|
| Created: | September 19, 2006 |
Updated: | January 20, 2010 |
| Description: |
Tavis Ormandy of the Google Security Team discovered two denial of service
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to hang or
crash.
Tavis Ormandy of the Google Security Team discovered several code execution
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to crash or
execute arbitrary code. |
| Alerts: |
|
Comments (1 posted)
horde-kronolith: local file inclusion
| Package(s): | horde-kronolith |
CVE #(s): | CVE-2006-6175
|
| Created: | January 17, 2007 |
Updated: | March 7, 2008 |
| Description: |
Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered
string is used instead of a sanitized string to view local files. An
authenticated attacker could craft an HTTP GET request that uses directory
traversal techniques to execute any file on the web server as PHP code,
which could allow information disclosure or arbitrary code execution with
the rights of the user running the PHP application (usually the webserver
user). |
| Alerts: |
|
Comments (none posted)
ImageMagick: buffer overflows
| Package(s): | ImageMagick |
CVE #(s): | CVE-2006-5456
|
| Created: | October 31, 2006 |
Updated: | March 8, 2007 |
| Description: |
Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick
6.0.7 allow user-assisted attackers to cause a denial of service and
possibly execute execute arbitrary code via (1) a DCM image that is not
properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a
PALM image that is not properly handled by the ReadPALMImage function in
coders/palm.c. |
| Alerts: |
|
Comments (2 posted)
imlib2: arbitrary code execution
| Package(s): | imlib2 |
CVE #(s): | CVE-2006-4806
CVE-2006-4807
CVE-2006-4808
CVE-2006-4809
|
| Created: | November 6, 2006 |
Updated: | August 13, 2007 |
| Description: |
M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the
validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user
were tricked into viewing or processing a specially crafted image with
an application that uses imlib2, the flaws could be exploited to execute
arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
java: multiple vulnerabilities
| Package(s): | java |
CVE #(s): | CVE-2006-4339
CVE-2006-4790
CVE-2006-6731
CVE-2006-6736
CVE-2006-6737
CVE-2006-6745
|
| Created: | January 18, 2007 |
Updated: | June 4, 2010 |
| Description: |
java has multiple vulnerabilities, these include:
an RSA exponent padding attack vulnerability, two vulnerabilities
which allow untrusted applets to access data in other applets,
vulnerabilities that involve applets gaining privileges due to
serialization bugs in the JRE and buffer overflows in the java image
handling routines that can give attackers read/write/execute capabilities
for local files. |
| Alerts: |
|
Comments (1 posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kdelibs: cross-site scripting
| Package(s): | kdelibs konqeror |
CVE #(s): | CVE-2007-0537
|
| Created: | February 5, 2007 |
Updated: | August 13, 2007 |
| Description: |
Konqueror 3.5.5 does not properly parse HTML comments, which allows remote
attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS
protection schemes by embedding certain HTML tags within a comment, a
related issue to CVE-2007-0478. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4623
|
| Created: | October 18, 2006 |
Updated: | November 14, 2007 |
| Description: |
The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-0007
CVE-2007-0006
|
| Created: | February 15, 2007 |
Updated: | November 14, 2007 |
| Description: |
Linux kernel versions from 2.6.9 to 2.6.20 have a denial of service
vulnerability. A remote attacker can cause the key_alloc_serial
function's key serial number collision avoidance code to have a
null dereference, resulting in a crash. |
| Alerts: |
|
Comments (1 posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4535
CVE-2006-4538
|
| Created: | September 18, 2006 |
Updated: | January 5, 2009 |
| Description: |
Sridhar Samudrala discovered a local denial of service vulnerability
in the handling of SCTP sockets. By opening such a socket with a
special SO_LINGER value, a local attacker could exploit this to crash
the kernel. (CVE-2006-4535)
Kirill Korotaev discovered that the ELF loader on the ia64 and sparc
platforms did not sufficiently verify the memory layout. By attempting
to execute a specially crafted executable, a local user could exploit
this to crash the kernel. (CVE-2006-4538) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service by memory consumption
| Package(s): | kernel |
CVE #(s): | CVE-2006-2936
|
| Created: | July 17, 2006 |
Updated: | November 14, 2007 |
| Description: |
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to
2.6.17, and possibly later versions, allows local users to cause a denial
of service (memory consumption) by writing more data to the serial port
than the driver can handle, which causes the data to be queued. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2007-0772
|
| Created: | February 23, 2007 |
Updated: | November 14, 2007 |
| Description: |
The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial
of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free
of an incorrect pointer. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-5757
|
| Created: | November 13, 2006 |
Updated: | November 14, 2007 |
| Description: |
From the MOKB-05-11-2006
advisory: "The ISO9660 filesystem handling code of the Linux
2.6.x kernel fails to properly handle corrupted data structures, leading to
an exploitable denial of service condition. This particular vulnerability
seems to be caused by a race condition and a signedness issue. When
performing a read operation on a corrupted ISO9660 fs stream, the
isofs_get_blocks() function will enter an infinite loop when
__find_get_block_slow() callback from sb_getblk() fails ("due to various
races between file io on the block device and getblk")." |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-2935
CVE-2006-4145
CVE-2006-3745
|
| Created: | September 1, 2006 |
Updated: | July 30, 2008 |
| Description: |
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the system to
crash (denial of service). Malformed CDROM firmware or USB storage devices
(such as USB keys) could cause system crash (denial of service), and if
they were intentionally malformed, can cause arbitrary code to run with
elevated privileges. In addition, the SCTP protocol is subject to a remote
system crash (denial of service) attack. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2006-5749
CVE-2006-4814
CVE-2006-6106
|
| Created: | January 5, 2007 |
Updated: | January 8, 2009 |
| Description: |
A security issue has been reported in Linux kernel due to an error in
drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()"
function never initializes an event timer before scheduling it with the
"add_timer()" function.
The mincore function in the kernel does not properly lock access to user
space, which has unspecified impact and attack vectors, possibly related to
a deadlock.
Another vulnerability has been reported in Linux kernel caused by a
boundary error within the handling of incoming CAPI messages in
net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain
Kernel data structures. |
| Alerts: |
|
Comments (none posted)
krb5: uninitialized pointers
| Package(s): | krb5 |
CVE #(s): | CVE-2006-6143
CVE-2006-3084
|
| Created: | January 10, 2007 |
Updated: | July 7, 2010 |
| Description: |
The kdamind daemon can, in some situations, perform operations on uninitialized pointers. This bug could conceivably open up the system to a code execution attack by an unauthenticated remote attacker, but it appears to be difficult to exploit. See this advisory for details. |
| Alerts: |
|
Comments (1 posted)
krb5: local privilege escalation
| Package(s): | krb5 |
CVE #(s): | CVE-2006-3083
|
| Created: | August 9, 2006 |
Updated: | July 7, 2010 |
| Description: |
Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges. |
| Alerts: |
|
Comments (none posted)
mod_python: information disclosure
| Package(s): | libapache2-mod-python |
CVE #(s): | CVE-2004-2680
|
| Created: | March 7, 2007 |
Updated: | March 8, 2007 |
| Description: |
From the Ubuntu advisory: Miles Egan discovered that mod_python, when used in output filter mode,
did not handle output larger than 16384 bytes, and would display freed
memory, possibly disclosing private data. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgtop2: buffer overflow
| Package(s): | libgtop2 |
CVE #(s): | CVE-2007-0235
|
| Created: | January 15, 2007 |
Updated: | August 9, 2007 |
| Description: |
The /proc parsing routines in libgtop are vulnerable to a buffer overflow.
If an attacker can run a process in a specially crafted long
path then trick a user into running gnome-system-monitor,
arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (none posted)
libmodplug: boundary errors
| Package(s): | libmodplug |
CVE #(s): | CVE-2006-4192
|
| Created: | December 11, 2006 |
Updated: | May 4, 2011 |
| Description: |
Luigi Auriemma has reported various boundary errors in load_it.cpp and
a boundary error in the "CSoundFile::ReadSample()" function in
sndfile.cpp. A remote attacker can entice a user to read crafted modules
or ITP files, which may trigger a buffer overflow resulting in the
execution of arbitrary code with the privileges of the user running the
application. |
| Alerts: |
|
Comments (none posted)
libpng: buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-3334
|
| Created: | July 19, 2006 |
Updated: | December 15, 2008 |
| Description: |
In pngrutil.c, the function png_decompress_chunk() allocates
insufficient space for an error message, potentially overwriting stack
data, leading to a buffer overflow. |
| Alerts: |
|
Comments (none posted)
libpng: heap based buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-0481
|
| Created: | February 13, 2006 |
Updated: | December 15, 2008 |
| Description: |
A heap based buffer overflow bug was found in the way libpng strips alpha
channels from a PNG image. An attacker could create a carefully crafted PNG
image file in such a way that it could cause an application linked with
libpng to crash or execute arbitrary code when the file is opened by a
victim. |
| Alerts: |
|
Comments (1 posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CVE-2006-2193
|
| Created: | June 15, 2006 |
Updated: | September 1, 2008 |
| Description: |
The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable
to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters
in the DocumentName tag to overflow a buffer, causing a denial of service,
and possibly the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
libvncserver: authentication bypass
| Package(s): | libvncserver |
CVE #(s): | CVE-2006-2450
|
| Created: | August 4, 2006 |
Updated: | March 19, 2007 |
| Description: |
LibVNCServer fails to properly validate protocol types effectively
letting users decide what protocol to use, such as "Type 1 - None".
LibVNCServer will accept this security type, even if it is not offered
by the server. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mod_jk: stack overflow
| Package(s): | mod_jk |
CVE #(s): | CVE-2007-0774
|
| Created: | March 5, 2007 |
Updated: | May 30, 2007 |
| Description: |
A stack overflow flaw was found in the URI handler of mod_jk. A remote
attacker could visit a carefully crafted URL being handled by mod_jk and
trigger this flaw, which could lead to the execution of arbitrary code as the
'apache' user. |
| Alerts: |
|
Comments (none posted)
mysql: format string bug
| Package(s): | mysql |
CVE #(s): | CVE-2006-3469
|
| Created: | July 21, 2006 |
Updated: | July 30, 2008 |
| Description: |
Jean-David Maillefer discovered a format string bug in the
date_format() function's error reporting. By calling the function with
invalid arguments, an authenticated user could exploit this to crash
the server. |
| Alerts: |
|
Comments (none posted)
MySQL: privilege violations
| Package(s): | mysql |
CVE #(s): | CVE-2006-4031
CVE-2006-4226
|
| Created: | August 25, 2006 |
Updated: | July 30, 2008 |
| Description: |
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access
a table through a previously created MERGE table, even after the user's
privileges are revoked for the original table, which might violate intended
security policy (CVE-2006-4031).
MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run
on case-sensitive filesystems, allows remote authenticated users to create
or access a database when the database name differs only in case from a
database for which they have permissions (CVE-2006-4226). |
| Alerts: |
|
Comments (none posted)
MySQL: logging bypass
| Package(s): | mysql |
CVE #(s): | CVE-2006-0903
|
| Created: | April 4, 2006 |
Updated: | May 21, 2008 |
| Description: |
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms
via SQL queries that contain the NULL character, which are not properly
handled by the mysql_real_query function. NOTE: this issue was originally
reported for the mysql_query function, but the vendor states that since
mysql_query expects a null character, this is not an issue for mysql_query. |
| Alerts: |
|
Comments (2 posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | January 6, 2006 |
Updated: | March 7, 2011 |
| Description: |
Kurt Fitzner discovered that the NBD (network block device) server did not
correctly verify the maximum size of request packets. By sending specially
crafted large request packets, a remote attacker who is allowed to access
the server could exploit this to execute arbitrary code with root
privileges. |
| Alerts: |
|
Comments (none posted)
ncompress: buffer underflow
| Package(s): | ncompress |
CVE #(s): | CVE-2006-1168
|
| Created: | August 10, 2006 |
Updated: | February 21, 2012 |
| Description: |
The ncompress compression utility has a missing boundary check.
A local user can use a maliciously created file to cause a
a .bss buffer underflow. |
| Alerts: |
|
Comments (none posted)
openldap: security bypass
| Package(s): | openldap |
CVE #(s): | CVE-2006-4600
|
| Created: | September 29, 2006 |
Updated: | June 12, 2007 |
| Description: |
slapd in OpenLDAP before 2.3.25 allows remote authenticated users with
selfwrite Access Control List (ACL) privileges to modify arbitrary
Distinguished Names (DN). |
| Alerts: |
|
Comments (none posted)
OpenSSH: denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4925
CVE-2006-5052
|
| Created: | October 6, 2006 |
Updated: | November 15, 2007 |
| Description: |
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of
service (crash) by sending an invalid protocol sequence with
USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.
An unspecified vulnerability in portable OpenSSH before 4.4, when running
on some platforms, allows remote attackers to determine the validity of
usernames via unknown vectors involving a GSSAPI "authentication abort." |
| Alerts: |
|
Comments (none posted)
openssh: privilege separation issue
| Package(s): | openssh |
CVE #(s): | CVE-2006-5794
|
| Created: | November 8, 2006 |
Updated: | April 5, 2007 |
| Description: |
From the OpenSSH 4.5 announcement: "Fix a bug in the sshd privilege separation monitor that weakened its
verification of successful authentication. This bug is not known to
be exploitable in the absence of additional vulnerabilities." |
| Alerts: |
|
Comments (none posted)
openssh: remote denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4924
CVE-2006-5051
|
| Created: | September 27, 2006 |
Updated: | September 17, 2008 |
| Description: |
Openssh 4.4 fixes some
security issues, including a pre-authentication denial of service, an
unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort
could be used to determine the validity of usernames on some platforms. |
| Alerts: |
|
Comments (none posted)
php: several vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2006-4481
CVE-2006-4484
CVE-2006-4485
|
| Created: | September 8, 2006 |
Updated: | June 13, 2008 |
| Description: |
The file_exists and imap_reopen functions in PHP before 5.1.5 do not check
for the safe_mode and open_basedir settings, which allows local users to
bypass the settings (CVE-2006-4481).
A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c
in the GD extension in PHP before 5.1.5 allows remote attackers to have an
unknown impact via a GIF file with input_code_size greater than
MAX_LWZ_BITS, which triggers an overflow when initializing the table array
(CVE-2006-4484).
The stripos function in PHP before 5.1.5 has unknown impact and attack
vectors related to an out-of-bounds read (CVE-2006-4485). |
| Alerts: |
|
Comments (1 posted)
php: multiple vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2007-0906
CVE-2007-0907
CVE-2007-0908
CVE-2007-0909
CVE-2007-0910
CVE-2007-0988
|
| Created: | February 20, 2007 |
Updated: | March 21, 2007 |
| Description: |
A number of buffer overflow flaws were found in the PHP session extension,
the str_replace() function, and the imap_mail_compose() function.
If very long strings under the control of an attacker are passed to the
str_replace() function then an integer overflow could occur in memory
allocation. If a script uses the imap_mail_compose() function to create a
new MIME message based on an input body from an untrusted source, it could
result in a heap overflow. An attacker who is able to access a PHP
application affected by any these issues could trigger these flaws and
possibly execute arbitrary code as the 'apache' user. (CVE-2007-0906)
If unserializing untrusted data on 64-bit platforms, the zend_hash_init()
function can be forced to enter an infinite loop, consuming CPU resources
for a limited length of time, until the script timeout alarm aborts
execution of the script. (CVE-2007-0988)
If the wddx extension is used to import WDDX data from an untrusted source,
certain WDDX input packets may allow a random portion of heap memory to be
exposed. (CVE-2007-0908)
If the odbc_result_all() function is used to display data from a database,
and the contents of the database table are under the control of an
attacker, a format string vulnerability is possible which could lead to the
execution of arbitrary code. (CVE-2007-0909)
A one byte memory read will always occur before the beginning of a buffer,
which could be triggered for example by any use of the header() function in
a script. However it is unlikely that this would have any effect.
(CVE-2007-0907)
Several flaws in PHP could allows attackers to "clobber" certain
super-global variables via unspecified vectors. (CVE-2007-0910) |
| Alerts: |
|
Comments (none posted)
php: buffer overflows
| Package(s): | php |
CVE #(s): | CVE-2006-5465
|
| Created: | November 3, 2006 |
Updated: | January 18, 2010 |
| Description: |
The Hardened-PHP Project discovered buffer overflows in
htmlentities/htmlspecialchars internal routines to the PHP Project. Of
course the whole purpose of these functions is to be filled with user
input. (The overflow can only be when UTF-8 is used) |
| Alerts: |
|
Comments (none posted)
phpbb2: missing input sanitizing
| Package(s): | phpbb2 |
CVE #(s): | CVE-2006-1896
|
| Created: | May 22, 2006 |
Updated: | February 11, 2008 |
| Description: |
It was discovered that phpbb2, a web based bulletin board, insufficiently
sanitizes values passed to the "Font Color 3" setting, which might lead to
the execution of injected code by admin users. |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
postgresql: insufficient verification
| Package(s): | postgresql |
CVE #(s): | CVE-2007-0555
CVE-2007-0556
|
| Created: | February 5, 2007 |
Updated: | March 19, 2007 |
| Description: |
PostgreSQL has two vulnerabilities that allow an authenticated attacker
with the permissions to run arbitrary SQL to launch a denial-of-service
attack or possibly read out random chunks of memory. Since attacks to
require authenticated access, the security hole is only considered medium
risk. See announcement for additional
information. |
| Alerts: |
|
Comments (none posted)
postgresql: SQL injection
| Package(s): | postgresql |
CVE #(s): | CVE-2006-2313
CVE-2006-2314
|
| Created: | May 24, 2006 |
Updated: | June 6, 2007 |
| Description: |
The PostgreSQL team has put out a set of "urgent updates" (in the form of the 7.3.15, 7.4.13, 8.0.8, and 8.1.4 releases) closing a
newly-discovered set of SQL injection issues. Details about the problem
can be found on the
technical information page; in short: multi-byte encodings can be used
to defeat normal string sanitizing techniques. The update fixes one problem
related to invalid multi-byte characters, but punts on another by simply
disallowing the old, unsafe technique of escaping single quotes with a
backslash. |
| Alerts: |
|
Comments (1 posted)
quake: buffer overflow
| Package(s): | quake3-bin |
CVE #(s): | CVE-2006-2236
|
| Created: | May 10, 2006 |
Updated: | January 12, 2009 |
| Description: |
Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server. |
| Alerts: |
|
Comments (none posted)
rpm: arbitrary code execution
| Package(s): | rpm |
CVE #(s): | CVE-2006-5466
|
| Created: | November 6, 2006 |
Updated: | August 28, 2007 |
| Description: |
An error was found in the RPM library's handling of query reports. In
some locales, certain RPM packages would cause the library to crash. If
a user was tricked into querying a specially crafted RPM package, the
flaw could be exploited to execute arbitrary code with the user's
privileges. |
| Alerts: |
|
Comments (none posted)
samba: several vulnerabilities
Comments (none posted)
Mozilla: multiple vulnerabilities
| Package(s): | seamonkey firefox thunderbird |
CVE #(s): | CVE-2006-6077
CVE-2007-0008
CVE-2007-0009
CVE-2007-0775
CVE-2007-0777
CVE-2007-0778
CVE-2007-0779
CVE-2007-0780
CVE-2007-0800
CVE-2007-0981
CVE-2007-0995
CVE-2007-0996
|
| Created: | February 26, 2007 |
Updated: | July 23, 2007 |
| Description: |
Several flaws were found in the way SeaMonkey processed certain malformed
JavaScript code. A malicious web page could execute JavaScript code in such
a way that may result in SeaMonkey crashing or executing arbitrary code as
the user running SeaMonkey. (CVE-2007-0775, CVE-2007-0777)
Several cross-site scripting (XSS) flaws were found in the way SeaMonkey
processed certain malformed web pages. A malicious web page could display
misleading information which may result in a user unknowingly divulging
sensitive information such as a password. (CVE-2006-6077, CVE-2007-0995,
CVE-2007-0996)
A flaw was found in the way SeaMonkey cached web pages on the local disk. A
malicious web page may be able to inject arbitrary HTML into a browsing
session if the user reloads a targeted site. (CVE-2007-0778)
A flaw was found in the way SeaMonkey displayed certain web content. A
malicious web page could generate content which could overlay user
interface elements such as the hostname and security indicators, tricking a
user into thinking they are visiting a different site. (CVE-2007-0779)
Two flaws were found in the way SeaMonkey displayed blocked popup windows.
If a user can be convinced to open a blocked popup, it is possible to read
arbitrary local files, or conduct an XSS attack against the user.
(CVE-2007-0780, CVE-2007-0800)
Two buffer overflow flaws were found in the Network Security Services (NSS)
code for processing the SSLv2 protocol. Connecting to a malicious secure
web server could cause the execution of arbitrary code as the user running
SeaMonkey. (CVE-2007-0008, CVE-2007-0009)
A flaw was found in the way SeaMonkey handled the "location.hostname" value
during certain browser domain checks. This flaw could allow a malicious web
site to set domain cookies for an arbitrary site, or possibly perform an
XSS attack. (CVE-2007-0981) |
| Alerts: |
|
Comments (1 posted)
shadow-utils: mailbox creation vulnerability
| Package(s): | shadow-utils |
CVE #(s): | CVE-2006-1174
|
| Created: | May 25, 2006 |
Updated: | June 12, 2007 |
| Description: |
The useradd tool from the shadow-utils package has a potential security
problem. When a new user's mailbox is created, the permissions are
set to random garbage from the stack, potentially allowing the
file to be read or written during the time before fchmod() is called. |
| Alerts: |
|
Comments (none posted)
slocate: information disclosure
| Package(s): | slocate |
CVE #(s): | CVE-2007-0227
|
| Created: | February 22, 2007 |
Updated: | March 30, 2007 |
| Description: |
The slocate permission checking code has a local information disclosure
vulnerability. During the reporting of matching files, slocate does not
respect the parent directory's read permissions, resulting in hidden
filenames being viewable by other local users. |
| Alerts: |
|
Comments (none posted)
smb4k: multiple vulnerabilities
| Package(s): | smb4k |
CVE #(s): | CVE-2007-0472
CVE-2007-0473
CVE-2007-0474
CVE-2007-0475
|
| Created: | February 13, 2007 |
Updated: | March 12, 2007 |
| Description: |
The Smb4K
0.8.0 release announcement notes that several security weaknesses in
the utility programs (stack overflows / the use of strcpy instead of
strncpy / a design error in smb4k_kill) and in the Smb4KFileIO class (use
of mktemp instead of mkstemp for creation of the temporary files which
could lead to both a race and an information leak / a race in the code that
handles the lock file). Fixes for all of these issues are included in Smb4K
0.8.0 and in the patches that have been prepared for Smb4K 0.7.5 and
0.6.10a. Other versions are not supported anymore. |
| Alerts: |
|
Comments (none posted)
snort: remote arbitrary code execution
| Package(s): | snort |
CVE #(s): | CVE-2006-5276
|
| Created: | March 2, 2007 |
Updated: | September 7, 2007 |
| Description: |
The Snort intrusion detection system is vulnerable to a buffer overflow
in the DCE/RPC preprocessor code. Remote attackers can send
specially crafted fragmented SMB or DCE/RPC packets which can be used
to allow the the remote execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
spamassassin: denial of service
| Package(s): | spamassassin |
CVE #(s): | CVE-2007-0451
|
| Created: | February 16, 2007 |
Updated: | March 14, 2007 |
| Description: |
Version 3.1.8 of Spamassassin fixes some bugs and a malformed HTML denial
of service vulnerability. |
| Alerts: |
|
Comments (none posted)
STLport: buffer overflows
| Package(s): | STLport |
CVE #(s): | CVE-2007-0803
|
| Created: | March 7, 2007 |
Updated: | March 7, 2007 |
| Description: |
STLport (prior to version 5.0.3) suffers from two remotely exploitable buffer overflows. |
| Alerts: |
|
Comments (none posted)
sun-jdk: arbitrary code execution
| Package(s): | sun-jdk |
CVE #(s): | CVE-2007-0243
|
| Created: | February 19, 2007 |
Updated: | April 25, 2007 |
| Description: |
A anonymous researcher discovered that an error in the handling of a GIF
image with a zero width field block leads to a memory corruption flaw. An
attacker could entice a user to run a specially crafted Java applet or
application that would load a crafted GIF image, which could result in
escalation of privileges and unauthorized access to system resources. |
| Alerts: |
|
Comments (1 posted)
tcpdump: denial of service
| Package(s): | tcpdump |
CVE #(s): | CVE-2007-1218
|
| Created: | March 5, 2007 |
Updated: | November 15, 2007 |
| Description: |
Off-by-one buffer overflow in the parse_elements function in the 802.11
printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted 802.11
frame. NOTE: this was originally referred to as heap-based, but it might be
stack-based. |
| Alerts: |
|
Comments (none posted)
ulogd: buffer overflow
| Package(s): | ulogd |
CVE #(s): | CVE-2007-0460
|
| Created: | January 29, 2007 |
Updated: | March 19, 2007 |
| Description: |
A buffer overflow in ulogd has an unknown impact and attack vectors related
to "improper string length calculations." |
| Alerts: |
|
Comments (none posted)
unzip: long file name buffer overflow
| Package(s): | unzip |
CVE #(s): | CVE-2005-4667
|
| Created: | February 6, 2006 |
Updated: | May 2, 2007 |
| Description: |
A buffer overflow in UnZip 5.50 and earlier allows local users to execute
arbitrary code via a long filename command line argument. NOTE: since the
overflow occurs in a non-setuid program, there are not many scenarios under
which it poses a vulnerability, unless unzip is passed long arguments when
it is invoked from other programs. |
| Alerts: |
|
Comments (1 posted)
util-linux: information disclosure
| Package(s): | util-linux |
CVE #(s): | CVE-2007-0822
|
| Created: | March 7, 2007 |
Updated: | March 7, 2007 |
| Description: |
Users can confuse util-linux by way of removable drives, leading to crashes and the possibility of information disclosure via the resulting core dumps. |
| Alerts: |
|
Comments (1 posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
wireshark: multiple vulnerabilities
Comments (6 posted)
wordpress: cross-site scripting
| Package(s): | wordpress |
CVE #(s): | CVE-2007-1049
|
| Created: | March 5, 2007 |
Updated: | March 21, 2007 |
| Description: |
A Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in
the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0
before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary
web script or HTML via the file parameter to wp-admin/templates.php, and
possibly other vectors involving the action variable. |
| Alerts: |
|
Comments (none posted)
xine: format string vulnerabilities
| Package(s): | xine |
CVE #(s): | CVE-2007-0017
|
| Created: | January 23, 2007 |
Updated: | August 10, 2007 |
| Description: |
Multiple format string vulnerabilities in (1) the cdio_log_handler function
in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and
the (2) cdio_log_handler and (3) vcd_log_handler functions in
modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in
VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to
execute arbitrary code via format string specifiers in an invalid URI, as
demonstrated by a udp://-- URI in an M3U file. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-6172
|
| Created: | December 5, 2006 |
Updated: | June 5, 2007 |
| Description: |
A buffer overflow was discovered in the Real Media input plugin in
xine-lib. If a user were tricked into loading a specially crafted stream
from a malicious server, the attacker could execute arbitrary code with the
user's privileges. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-1664
|
| Created: | April 27, 2006 |
Updated: | February 27, 2008 |
| Description: |
xine-lib does an improper input data boundary check on
MPEG streams. A specially crafted MPEG file can be
created that can cause arbitrary code execution when the
file is accessed. |
| Alerts: |
|
Comments (none posted)
xinit: race condition
| Package(s): | xinit |
CVE #(s): | CVE-2006-5214
|
| Created: | October 17, 2006 |
Updated: | August 9, 2007 |
| Description: |
A race condition allows local users to see error messages generated during
another user's X session. This could allow potentially sensitive
information to be leaked. |
| Alerts: |
|
Comments (1 posted)
X.org: local privilege escalations
| Package(s): | xorg-x11 |
CVE #(s): | CVE-2006-4447
|
| Created: | August 28, 2006 |
Updated: | April 30, 2007 |
| Description: |
Several X.org libraries and X.org itself contain system calls to
set*uid() functions, without checking their result. Local users could
deliberately exceed their assigned resource limits and elevate their
privileges after an unsuccessful set*uid() system call. This requires
resource limits to be enabled on the machine. |
| Alerts: |
|
Comments (none posted)
X.org: integer overflows
| Package(s): | xorg, xorg-server |
CVE #(s): | CVE-2006-6101
CVE-2006-6102
CVE-2006-6103
|
| Created: | January 10, 2007 |
Updated: | March 8, 2007 |
| Description: |
A number of integer overflows have turned up in the X.org server. Some of these overflows involve calls to alloca(), and thus make corruption of the stack relatively easy. This vulnerability is exploitable by anybody who can make a connection to the server, meaning that it is a local root exploit in most settings. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch remains 2.6.21-rc3. About 250 patches have
found their way into the mainline repository since -rc3 was released; -rc4
will likely come out shortly after LWN is published this week.
There are two current -mm trees, differing only in their inclusion of one
patch set: 2.6.21-rc3-mm1
(which includes the RSDL scheduler) and 2.6.21-rc3-mm2 (which does
not).
The current stable 2.6 kernel is 2.6.20.3, released on March 13 with a
couple dozen fixes. 2.6.20.2
was released on March 9 with a full 100 patches.
For older kernels: 2.6.16.43 was released on
March 8. 2.6.16.44-rc1
is out with a number of fixes, including a couple of security patches.
Comments (2 posted)
Kernel development news
-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) \
+ + sizeof(typeof(int[1 - 2*!!__builtin_types_compatible_p(typeof(arr), \
+ typeof(&arr[0]))]))*0)
-- Rusty Russell
Rusty, that's a work of art.
However, I would suggest that you never show it to anybody ever
again. I'm sure that in fifty years, it will be worth much more. So
please keep it tightly under wraps, to keep people from gouging
their eyes out^W^W^W^W^W^W^W make a killing in the art market.
-- Linus Torvalds
Comments (30 posted)
The long story of the kevent subsystem has appeared on this page a number
of times. Kevents are designed to give applications a single system call
which they can use to wait for any events of interest: I/O, timers,
signals, and more. While quite a bit of work has been done on this code,
its path into the kernel has been long. A number of developers are still
unconvinced that the interface is needed, and, if it is, that the proposed
kevent API (which would have to be maintained forever) is the right one.
Now there is a competing approach which may prove easier for the community
to accept.
Davide Libenzi is the creator of the epoll_wait() system call; it
is a version of poll() which is intended to be scalable to large
numbers of file descriptors. This API seems to be well regarded for what
it does, but it is limited to waiting on file descriptors. Many of the
things that kevents address are not associated with files, and so cannot be
handled through the epoll interface.
Kevents fix that shortcoming with the creation of a new subsystem and
user-space API. Davide has now shown up with a different strategy: make a
way for applications to request delivery of events via a file descriptor.
Consider, for example, the case of signals. Signals tend to be tricky for
applications to handle; they are asynchronous events which are delivered to
a special signal handler function, but that function is seriously limited
in what it can do. In response, application developers have resorted to
tricks like writing a byte to an internal pipe so that the signal can be
handled in the main event loop.
Davide has proposed a new system
call named signalfd() which can help developers avoid much of
the hassle of working with signals:
int signalfd(int ufd, const sigset_t *mask, size_t masksize);
If ufd is -1, this call will create (and return) a new
file descriptor. The signals described in mask will be caught and
returned to the process by way of that file descriptor. It is pollable,
allowing signals to be handled in an event loop based on select(),
poll()
or epoll_wait(). When signals are available, they can be read
from the descriptor as data; the signalfd_siginfo structure
returned by read() has the signal number and all of the related
information that comes with it.
If ufd is set to an existing signal file descriptor, the
signalfd() call will change to the new mask. It is worth
noting that reading from this file descriptor competes with normal signal
delivery for queued signals; there is no way to predict whether the signal
will be delivered in the usual way or will be read from the file
descriptor. This situation can be avoided by using sigprocmask()
to block normal delivery of the signal(s) of interest.
There is a similar interface for
timer events:
int timerfd(int ufd, int clockid, int timertype,
const struct timespec *when);
Once again, ufd is -1 to create a new file descriptor, or
an existing timer file descriptor which is to be modified. The
clockid parameter describes which clock is wanted:
CLOCK_MONOTONIC or CLOCK_REALTIME. The type of timer is
described by timertype: TFD_TIMER_REL for a time relative
to the current time, TFD_TIMER_ABS for an absolute time, or
TFD_TIMER_SEQ for a repeating timer at a given interval. The
when structure contains the requested expiration time.
Once again, this file descriptor can be polled. Reading from it yields an
integer value saying how many times the timer has fired since the last time
it was read.
Evgeniy Polyakov, the author of the kevent patches, has not been sitting
still while these patches have gone around. His proposal is called
eventfs; it is a special
filesystem which offers the ability to bind events to file descriptors.
The first version of the patch only handles signals, via a system call
named (yes) signalfd():
int signalfd(int signal, int flags);
This call creates a new file descriptor for the given signal (a
separate file descriptor is required for each signal in this scheme). In
the current code, if flags is nonzero, the signal will only be
delivered through eventfs and will never go into the signal queue. The
file descriptor is pollable, but there is no way to read any information
from it. So any associated signal information is lost; multiple deliveries
of the same signal between polls will also be lost.
One assumes that Evgeniy's patches could be improved over time, but
Davide's version seems to be ahead in terms of features, coverage, and
community review. Davide has also avoided the need to create a new
filesystem to back the whole thing up. So if bets were being taken on
which approach might make it into the kernel, Davide would seem to be in
the lead at the moment.
There are certainly things to be said for this approach. It brings Linux
toward a single interface for event delivery without the need for a new,
complex API. It also reinforces the role of the file descriptor as a
fundamental object for interaction with the kernel. On the other hand,
the poll interfaces do not provide a way for
applications to receive events without the need to call into the kernel - a
feature which has been requested by some interested parties. There are
also event types (asynchronous I/O completion, for example) which are not
yet covered. So, if things do go this way, it would not be
surprising to see patches trying to fill in those gaps in the near future.
Comments (39 posted)
As flame wars go, this one was somewhat more technical and inscrutable than
most. It was, however, still a flame war. The core issue was this: is the
addition of the
paravirt_ops
layer, now beginning to be used to support running Linux under hypervisors,
a good thing or a long-term maintenance disaster for the Linux kernel?
It all started with a patch added to the -mm tree; it seems that some work
on the new clockevents code
broke the VMI virtualization layer. So the developers at VMware put
together a fix, but that fix did not sit well with the core clockevents
developers. In their view, it took much of the older time-related code,
which they had worked so hard to get rid of, and shoved it back under the
VMI layer. Thomas Gleixner did not like
this solution:
This is ugly as hell. NO_HZ enables the dyntick functions in
idle(), irq_enter() and irq_exit() so the clockevents code is
actually invoked. I have not looked close enough why this does
work at all.
I have the feeling that "working fine" means something like "does not
explode".
The right solution, according to Thomas, is for all of the people who are
working on hypervisors and Linux to get together and come up with a single
timer interface based on clockevents. This should not be all that hard of
a job, in his opinion. The VMI hackers may well be willing to do that over
time, but they don't see that as something which can be done in the near
future. Their current code works, and, besides, they are on the verge of a
product release and would rather not thrash things up at this time.
"On the verge of a product release" is not an excuse which flies far on
linux-kernel. This is doubly true in this case, where some of the people
involved feel that the VMI developers should have seen clockevents coming
and developed for that interface over the last year. They see the current
VMI timer code as being the beginning of a long-term maintenance
nightmare.
Ingo Molnar widened the discussion to the
problems he sees with paravirt_ops in general. The posting is long, but
the core point seems to be this: every hypervisor connection implemented
with paravirt_ops becomes an ABI that the kernel must then maintain
forever. The paravirt_ops interface itself is supposed to insulate the
kernel from changes, and that API can change. But each hypervisor
interface done through paravirt_ops must continue to work into the future,
meaning that certain sorts of fundamental design changes cannot be made.
Maintaining compatibility with several hypervisors will be hard, and Ingo sees bad things when one inevitably
breaks:
And it doesn't matter whether we think that it was VMWare who messed
up. Users/customers _will_ blame us: "v2.6.25 regresses, it wont
run under ESX v1.12 anymore". Distro will yield and will undo
whatever change breaks backwards compatibility with older
hypervisors. (most likely it will be undone upstream already)
Backwards compatibility acts as a very heavy barrier against
certain types of paravirt_ops design changes.
There have not been a whole lot of others supporting this point of view,
though. The current abuses are seen as things which can be fixed, people
seem to be sanguine about the ability to maintain compatibility in the
paravirt_ops interface code, and, most likely, many people simply tune out
of virtualization discussions. Linus suggests that Ingo point out specific problems
(and fix them if he desires) rather than complaining about general
problems. Ingo's response is that hypervisor interfaces should be treated
like system calls, and added with the same degree of care and deliberation.
In the end, it is not clear that anything will change. There is a high
level of interest in getting hypervisor support into the kernel, and that
process is unlikely to stop. So expect to see some more serious squabbles
about what is done in hypervisor interfaces in the future. If we are
lucky, that process, while noisy, will result in the evolution of the
paravirt_ops code toward something which proves to be maintainable over the
long term.
Comments (none posted)
In
last week's episode, the
Rotating Staircase Deadline Scheduler (RSDL) had appeared out of the blue
and was busily impressing testers left and right. One person even called
for it to go straight into 2.6.21. In reality, the replacement of
something as fundamental as the CPU scheduler was never going to be an
entirely smooth operation. So it's not all that surprising that the RSDL
has run into an obstacle or two.
The biggest snag would appear to be this
workload reported by Mike Galbraith. Mike is trying to run some CPU
hogs (MP3 encoding, in particular) in the background while watching some
interactive eye candy. It's a load that works with the current scheduler,
but it becomes sluggish when running under RSDL. There have been a couple of
other reports of a visible interactive slowdown when serious computation is
going on - though others have reported better
results.
There is little surprise in the appearance of behavioral regressions
for certain workloads. Few people would have expected RSDL to be perfect
within a week of its first posting. The real difficulty, instead, is that
RSDL creator Con Kolivas has reacted in a somewhat defensive manner, refusing to see the behavior as a regression:
Your expectations of what you should be able to do are simply
skewed. Find what cpu balance you loved in the old one (and I
believe it wasn't that much more cpu in favour of X if I recall
correctly) and simply change the nice setting on your lame encoder
- since you're already setting one anyway.
We simply cannot continue arguing that we should dish out
unfairness in any manner any more. It will always come back and
bite us where we don't want it. We are getting good interactive
response with a fair scheduler yet you seem intent on overloading
it to find fault with it.
Con's position is that the scheduler should strive to provide fairness and
low latency; any further expectations about interactive response should
then be addressed by playing with nice levels. The interactivity estimator
built into the current scheduler is just too difficult to work with; the
kernel should not be in that particular business. The problem is that
this approach conflicts with how Linux users have come to expect things to
work.
As soon as one looks at improving RSDL for these situations, one gets into
the same old discussions on improving interactive response in general.
Linus pointed out that RSDL's way of
scheduling is not quite as fair as it could be, since it does not always
account for work in the right place:
And the problem is that a lot of clients actually end up doing
*more* in the X server than they do themselves directly. Doing
things like showing a line of text on the screen is a lot more
expensive than just keeping track of that line of text, so you end
up with the X server easily being marked as getting "too much" CPU
time, and the clients as being starved for CPU time. And then you
get bad interactive behaviour.
There are a couple of ways of handling problems like this. One is to just
favor the X server, either by somehow marking it as the core of interactive
behavior or by simply raising its priority. Con has been in favor of the
latter approach; to that end, he has posted a
separate patch which is aimed at improving latencies for all processes,
even when they are not all running at the same priority levels. There have
not been any follow-up results reported as of this writing.
This difficulty may well not keep RSDL out of the mainline kernel. The
advantages inherent in dumping the interactivity heuristics are large, and
RSDL does seem to improve life for a number of users. Noticeable
performance regressions for some workloads are a problem, though; nobody
wants to field a bunch of "2.6.x turned my response to crap" messages from
unhappy users. So expect some iterations on this project yet - and,
perhaps, an additional kernel cycle or two before it can be merged.
Comments (13 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Memory management
Networking
Architecture-specific
Security-related
Virtualization and containers
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
The CentOS development team has
announced
the first beta release of CentOS 5 for i386 and x86_64. See the
release
notes for more information about the beta.
According to the CentOS website,
"CentOS is an Enterprise-class Linux Distribution derived from
sources freely provided to the public by a prominent North American
Enterprise Linux vendor. CentOS conforms fully with the upstream vendors
redistribution policy and aims to be 100% binary compatible. (CentOS mainly
changes packages to remove upstream vendor branding and artwork.) CentOS
is free."
The prominent North American vendor is Red
Hat, but the Red Hat legal department defends the Red Hat trademarks
and requires that all mention of that trademarked name be absent from the
CentOS site and software. However, it's no coincidence that CentOS
releases follow closely after those prominent EL releases.
Of the various EL clones that showed up a few years ago, CentOS has done an
exceptional job of attracting developers and users and keeping up with its
upstream parent. Security advisories are posted regularly to the
centos-announce mailing list.
CentOS supports i386 and x86_64 hardware and there are mailing lists available
in English, Czech, German, Spanish, French, Dutch and Brazilian Portuguese.
Looking down the road a ways it looks like there is some possibility for
collaboration between Fedora and CentOS. See this thread
on centos-devel which looks at the Fedora EPEL (Extra Packages for
Enterprise Linux) project. This project is still quite young but some
packages are available for
download and testing. The epel-devel-list
is available for EPEL development discussion.
Comments (none posted)
New Releases
Mandriva has announced the launch of the beta program for Corporate Desktop
4.0. "
Ergonomic, secure, comprehensive, easy to use and to
administer: by consulting its corporate clients and by exploiting its
experience in the desktop area, Mandriva developed Corporate Desktop 4.0, a
distribution that can be installed in less than 10 minutes and extensively
customized thanks to a new post-installation tool."
Full Story (comments: none)
It's official:
Red Hat Enterprise Linux 5 is available. See
the list of features to learn more about what's new.
Comments (3 posted)
Distribution News
There is an update from the Debian release team: "
You might not remember who the release team is, but we still want to
inform you about the final leg of the etch release cycle. Our original
schedule did not work out due to problems with the kernel and the
slower than expected reduction of release critical bugs." The new
schedule calls for some aggressive bug fixing and a final release at the
beginning of April.
Full Story (comments: 6)
The Debian Project Leader election is still in the campaigning period. The
IRC debate was held recently and the
logs have
been posted.
Debian developers have until March 18 to vote on
this General Resolution. "The Debian project resolves that
Debian developers allowed to perform combined source and binary packages
uploads should be allowed to perform binary-only packages uploads for the
same set of architectures."
Comments (none posted)
Debian's Alioth team has announced the availability of Mercurial for source
control. "
Alioth can now host your Mercurial repositories in pretty
much the same way as it can host your CVS, Subversion, Arch/Bazaar, Bzr and
Git repositories."
Full Story (comments: none)
The Gentoo Council has drafted a new
Code of Conduct that
will be enforced for both developers and users. The draft version of the
Code of Conduct is currently being discussed on the Gentoo-dev mailing
list. "
The Code of Conduct will be voted upon by the Gentoo Council
Thursday, March 15th; implementation will be immediate upon final approval.
The Code of Conduct describes what the Gentoo Council has deemed acceptable
and unacceptable behavior. It also describes the punishment that will be
enforced if the Code of Conduct is breached."
Full Story (comments: 1)
SUSE Security has announced that SUSE Linux 9.3 will be discontinued soon.
"
Having provided security-relevant fixes for more than two years,
vulnerabilities found in SUSE Linux 9.3 after April 15th 2007 will not be
fixed any more for this product. We expect to release the last updates
around April 30th 2007."
Full Story (comments: 5)
The Ubuntu beta freeze is scheduled for March 15, with the beta release
happening one week after on March 22.
Full Story (comments: none)
Several distributions have announced that they will be participating in the
2007 Summer of Code. Debian
is looking for
proposal ideas and mentors and has
two wiki
pages set up collect them. Mandriva has
this announcement with links to a wiki page
for ideas and another page for mentors. Ubuntu is also
participating and looking for project ideas,
mentors and students.
Comments (none posted)
New Distributions
Pg_live is a free Linux Live CD community project. It is an enhanced
adaptation of one of the Ubuntu family of distributions, known as Xubuntu,
and has been designed and optimized expressly for the PostgreSQL Database
administrator and enthusiast.
Full Story (comments: none)
Distribution Newsletters
The Debian Weekly News for March 13, 2007 covers spring list cleaning, GIF
patent has expired, Second Life runs on Debian servers, the release status
of the Motorola 680x0 port, handling of inactive Debian accounts, One
Laptop per Child Software on Debian, Google's Summer of Code 2007, and much
more.
Full Story (comments: none)
The
Fedora
Weekly News for March 12, 2007 looks at 2 Million Fedora Core 6
Installs, Fedora Core 6 Linux Eclipses 2M User Mark, Talking points for
Fedora 7 release, Fedora Infrastructure needs your help!, Fedora 7 and the
wireless world, Ambassadors Report: Chemnitz LinuxTag, Review: Fedora 7
Test 2, and several other topics.
Comments (none posted)
The
Gentoo
Weekly Newsletter for March 5, 2007 covers the Opengear donation of two
CM4008, Xfce becomes an official project, Developer of the Week
(nightmorph), FOSDEM, Chemnitzer Linux-Tage, Linuxforum 07, and several
other topics.
Comments (none posted)
The Ubuntu Weekly News for February 28, 2007 covers New Team: Ubuntu
Scribes, Feisty Fawn Herd5 Released, No Beryl or Compiz for Feisty, Weekly
Quiz Update, Changes in Feisty, Upcoming meetings and events, and much more.
Full Story (comments: none)
The Ubuntu Weekly Newsletter for March 10, 2007 looks at Linspire now based
on Ubuntu, Statistics of Ubuntuforums, Ohio US Team approved and official,
Weekly Quiz Update, Upcoming meetings and events and several other topics.
Full Story (comments: none)
The
DistroWatch
Weekly for March 12, 2007 is out. "
Twenty news announcements on
the main page of DistroWatch turned last week into the busiest one so far
this year, but things are unlikely to slow down much in the coming days
either. The new GNOME 2.18, whose bits and pieces are slowly starting to
appear on some mirrors, will be followed by the much awaited Red Hat
Enterprise Linux 5 later this week, while new development releases from
Mandriva Linux (2007.1 RC1) and openSUSE (10.3 alpha 2) are also expected
shortly. In other news: How OpenBSD and an old IBM laptop saved a
construction project in a Central American jungle, an introduction to
Conary - a package management system done right, and a brief comparison
between Linux Mint and Freespire - two distributions with similar goals and
identical base systems. The feature story of this week's issue looks at the
deepening management crisis at Gentoo Linux."
Comments (none posted)
Newsletters and articles of interest
Linux.com
talks with some
DPL candidates. "
Once again, the Debian project is gearing up to
elect a new project leader, with voting set to begin late this month. As we
did last year, we asked the DPL candidates to sound off on some of the
issues that will face the Debian Project in the next year. Out of nine
candidates, six took the time to respond to our questions via email. Steve
McIntyre, Sven Luther, and incumbent DPL Anthony Towns failed to respond in
time for this article. We received responses from Wouter Verhelst, Aigars
Mahinovs, Gustavo Franco, Sam Hocevar, Simon Richter, and Raphaël
Hertzog." Update: Sven Luther has withdrawn his nomination, leaving
only eight candidates.
Comments (none posted)
DesktopLinux
covers the
release of Mandriva Corporate Desktop 4.0 beta. "
For its desktop
environment, Corporate Desktop 4.0 features the X.org 7.1 window manager
and the KDE 3.5.4 desktop environment. While GNOME 2.16 is also included,
this distribution is optimized for KDE. It also includes a new tool to set
KDE user rights from an LDAP (Lightweight Directory Access Protocol)
directory, to complement directory-based authentication."
Comments (5 posted)
Distribution reviews
Linux.com
reviews
Linux Mint. "
Ubuntu is a strong desktop distro, but it falls short
for some users in a few areas. Where are the multimedia codecs and DVD
support, and what's with all the brown, for heaven's sake? If you'd like
multimedia support with a minty fresh theme, try Linux Mint 2.2, an
Ubuntu-based distro that throws in support for Flash 9, Windows Media
Format, DVDs, MP3s, and troublesome wireless cards."
Comments (none posted)
LinuxDevices
looks at
Vyatta Subscription Edition 2.0 (VS2). "
Vyatta two weeks ago
released Vyatta Community Edition 2.0 (VC2), which featured a move to a
full Debian Linux undercarriage, for enhanced user serviceability. Vyatta
does not specify whether VS2 is also based on Debian; however, it seems
likely that the two platforms are similar, except for their licensing
terms."
Comments (none posted)
Page editor: Rebecca Sobol
Development
Mirage is a relatively
new image viewing application which has been designed with speed
in mind:
Mirage is a fast and simple GTK+ image viewer. Because it depends only on PyGTK, Mirage is ideal for users who wish to keep their computers lean while still having a clean image viewer.
The project was started in March, 2006 according to the
CHANGELOG file.
Mirage has undergone rapid development since then, with fifteen releases
so far.
In 2004, LWN's Jon Corbet wrote
The Grumpy Editor's Guide to Image Viewers.
One conclusion of the article was that none of the current image
viewers were as useful as xv:
Your editor stands by his original claim: xv, even after nine years of absolutely no development, is still superior to any of the free alternatives. No other tool provides the same ease of use, speed, features, and quality of results.
Nothing has changed in regards to xv development, but
xv is still the standard that other viewers are judged against.
Let's see how Mirage stacks up.
Here are some of the features offered by Mirage:
- Supported image formats include png, jpg, svg, xpm, gif, bmp, tiff, and others.
- Has the ability to cycle through large collections of images.
- Images can be dynamically resized, full-screen and best fit modes are available.
- A built-in slide show viewer is included.
- Has a random image viewing function.
- A user-selectable status bar shows basic image metadata.
- An image properties pulldown shows more detailed image metadata.
- Images can be rotated, zoomed, cropped, resized and flipped.
- Panning through zoomed-in images can be performed with the mouse.
- Many of the program's options are user-configurable.
- A number of
command-line switches are available.
- A number of shortcuts are bound to various key combinations.
The
online documentation
explains the application in more detail.
Some of the features that your author has come to depend on in xv, but are not available in Mirage include:
- A grab function for turning windows into images.
- The ability to convert and save images to another format.
- A full-featured color editor window, especially the R/G/B/mono linearity adjustments.
- The lack of a spinning clock as an indication of ongoing image processing.
- Cropping via mouse clicks in the main window.
Some of these missing functions, such as image grab and convert,
can be handled by external commands. Perhaps that is in line with
the Mirage lightweight design philosophy, but the omissions come at the
cost of user inconvenience.
Your author tried out version 0.8.1 of Mirage on an Ubuntu Edgy Eft
system, for the most part, the application behaved as advertised.
There was a slight problem starting up the slideshow mode,
when the application was opened up with a *.jpg command line option,
the slideshow button was grayed-out until several images were first
viewed manually. A repeat slideshow option would
also be useful if the application were to be used in an unattended
mode.
Mirage has a nice look and feel, for the basic job of viewing large
collections of images, it performs quite well and your author will
keep it on his machine.
The Mirage source code and packages are available for download
here.
Comments (6 posted)
System Applications
Database Software
Version 1.02 of
pg8000 has been released.
"
pg8000 is a Pure-Python interface to the PostgreSQL database engine. It is one of many PostgreSQL interfaces for the Python programming language. pg8000 is somewhat distinctive in that it is written entirely in Python and does not rely on any external libraries (such as a compiled python module, or PostgreSQL's libpq library).
pg8000's name comes from the belief that it is probably about the 8000th PostgreSQL interface for Python."
This version adds support for DB-API 2.0, and a few more features.
Comments (none posted)
Version 5.0.37 of MySQL Community Server is available.
"
This is our second full (source and binary) release of the MySQL
Community Server since we made the split between the Community and
Enterprise Version. It includes all bug fixes applied to up to and
including the MySQL 5.0.36 Enterprise Server.
This release also resolves a crashing bug that could be exploited as a
potential local Denial of Service attack".
Full Story (comments: none)
The March 11, 2007 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL DBMS articles and resources.
Full Story (comments: none)
Embedded Systems
Open Collector
notes the release of the
Free ECB_AT91 V1
single board computer.
"
The design of the ECB_AT91 Single-Board Computer is free. It already runs Debian, OpenEmbedded (Angstrom Distribution) and Buildroot. You can buy one or more, or download the design and build your own. The board is powered by an Atmel AT91RM9200 processor, which features an ARM9 core clocked at 180MHz. It supports up to 64MB of SDRAM, has one SD/MMC slot, 2 MB of serial flash, one 10/100 Ethernet interface, USB host and two serial ports."
Comments (none posted)
LDAP Software
Version 1.1.3 of Linbox Directory Server, an identity and network services management system, is out with new features and bug fixes.
Full Story (comments: none)
Networking Tools
Version 1.4.14 of IPCop
has been announced.
"
IPCop is a friendly firewall solution protecting networks running on linux.
It will be geared towards home and SOHO users. Interface is task based.
Hardware requirement could be very minimal and grow with services used.
This release update timezone to support US daylight saving time occuring March 11 and mainly update squid and snort.
You are encouraged to update from previous releases once some bugs introduced in 1.4.14 are fixed on 1.4.15."
Comments (none posted)
Version 1.5.0 of Seagull
is out.
"
Seagull is a multi-protocol traffic generator. Especially targeted towards IMS, Seagull supports Diameter (RFC3588 and all applications) over TCP/SCTP and IPv4/IPv6 , TCAP (over SS7 or Sigtran), XCAP over HTTP and Radius."
Comments (none posted)
Web Site Development
The March 8, 2007 edition of the Midgard Weekly Summary
is out with the latest news about the Midgard web content management system.
Full Story (comments: none)
Version 0.1.3 alpha of Remo is out.
"
Remo stands for "Rule Editor for ModSecurity". It's a
project, attempting to bring easier configuration to
ModSecurity, an apache application firewall. The second
and goal is to make a whitelist/positive security model
feasible for ModSecurity deployments.
This new release brings support for query string arguments
and cookies. Additionally, every request parameter can be
optional or mandatory."
Full Story (comments: none)
Desktop Applications
Audio Applications
The Ardour multi-track audio recorder project
has applied
for participation in the 2007 Google Summer of Code.
"
So, my own personal ideas for projects are:
Scripting support, Batch command support, Graph-based connection UI,
MIDI interface (perhaps on top of the midi support from last years GSoC?? perhaps!), Video tracks, YOUR IDEA HERE".
Comments (none posted)
Data Visualization
Version 1.22 of Asymptote
is available.
"
Asymptote is a powerful descriptive vector
graphics language for technical drawing, inspired by MetaPost but with an
improved C++-like syntax. Asymptote provides for figures the same
high-quality level of typesetting that LaTeX does for scientific text.
Problems with loading LaTeX packages and slide presentations were fixed.
Non-static variables in every loop iteration are now allocated anew.
Formatting under locales with nonperiod decimal separators was fixed,
along with logarithmic tick labels near the machine epsilon..."
Comments (none posted)
Desktop Environments
The announcement has gone out: GNOME 2.18 is available. See
the release notes for
an introduction to the new features in this version of the GNOME desktop
environment.
Full Story (comments: 24)
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The GNOME 2.18.0 release will apparently be missing the
network-manager-applet.
"
The GNOME Release Team has dropped network-manager-applet from GNOME
2.18.0, as no releases were ever made. It can be proposed again for
inclusion in 2.20".
Full Story (comments: 1)
The March 11, 2007 edition of the
KDE Commit-Digest has been
announced.
The content summary says:
"
The Oxygen iconset is moved from playground
to kdelibs, changes made throughout KDE to support the new icon names
specification. The Crystal iconset is moved from kdelibs to its kdeartwork
retirement home. More work on the Oxygen widget style. Security fixes in
KTorrent. Initial work on "uninstall" functionality for the KDE Windows
installation utility. New "Snowish" theme for the Kamion user information
migration utility. Continued graphics improvements across kdegames. Improved
wireless network encryption support in Solid. Further work on the Amarok 2.0
porting, with particular attention to the Music Store integration elements.
KPilot is to make a surprise return for the KDE 4.0 release."
Comments (none posted)
A draft KDE 4.0 release roadmap has been posted for comments. Should the
current schedule hold, we should expect the 4.0 release to happen toward
the end of October (of this year!). "
KDE 4.0 will not contain all features announced nor promised: these will
come during the lifetime of KDE 4. We can probably switch quickly to a
KDE 4.1 release if there are major subsystems ready for merging soon after
the KDE 4.0 hits the streets."
Full Story (comments: none)
KDE.News
looks at Oxygen
in the Road to KDE 4 series.
"
One of the big visual changes just happened in KDE 4, the transition of kdelibs to the Oxygen Icon set. This transition is still in progress, and it includes a massive icon naming scheme change that affects thousands of files. But, the Oxygen artwork project much is more than just an icon set, it's a unified way to do artwork for KDE 4. SVG an essential part of Oxygen, so many applications that are now capable of SVG display are also using Oxygen styled artwork."
Comments (8 posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
The following new Xorg software has been announced this week:
More information can be found on the
X.Org Foundation wiki.
Comments (none posted)
Encryption Software
Version 2.0.3 of GnuPG, an encryption application, has been announced.
"
This is bug fix release. There are also some minor enhancements."
Full Story (comments: none)
Version 4.6 of OpenSSH has been released with bug fixes and:
"
sshd now allows the enabling and disabling of authentication
methods on a per user, group, host and network basis via the
Match directive in sshd_config."
Full Story (comments: none)
Financial Applications
Version 2.6.26 of
SQL-Ledger,
a web-based accounting system, is out with one change:
"
added check password check in admin.pl when called with wget or similar commandline utilities".
Comments (none posted)
Games
Version 2.45 of Bullet Physics SDK
is available with a number of new capabilities.
"
Bullet is a state-of-the-art 3D Collision Detection and Rigid Body Dynamics Library for games. ZLib license, free for commercial use, including Playstation 3. Supports COLLADA Physics."
Comments (none posted)
Version 1.00 of Kimboot, an arcade-style game,
has been announced on the PyGame site. Changes include:
"
Major code cleanup; some parts were rewritten from scratch. This release uses OpenGL for drawing. Theme support: you can make your own graphics and sounds, and then just choose your custom theme in Options. Background image support (theme-dependent). New graphical effects. New kinds of enemies (Drunken, Genius, and Boss). Enemies are now animated."
Comments (2 posted)
GUI Packages
Release 2.8.2 of
wxWidgets,
a cross-platform GUI toolkit,
has been announced.
"
This is mainly a bug fix release; please see changes.txt for details."
Comments (none posted)
Interoperability
The March 12, 2007 edition of the
Wine Weekly Newsletter
is online with coverage of the Wine project. Topics include:
NetTunes, GDIPlus, Cairo Winelib Port, DirectX 10 For SoC?,
Developing For Fun While Under a Contract, Winetricks and
Lotus Notes Printing Regression.
Comments (none posted)
Multimedia
KDE.News
continues on the Road to
KDE 4 with a look at Amarok 2. "
This week we'll take a brief
look at some of the many features that are making their way into Amarok 2,
which is the development branch for Amarok in KDE 4. The features discussed
are all in progress features which have reached varying stages of
completion. Read on for information about Amarok's engines (including
Phonon), UI changes, changes to the Magnatune music store, OS X support,
and more."
Comments (none posted)
Versions 0.1 of
Dissent
and the associated Dissent-Gstreamer are available.
"
The Dissent Project attempts to be a full featured multimedia application that can play audio and video files as well as internet radio streams by using powerful media engines such as GStreamer.
It also has robust functionality for both RSS feeds and Podcasts which can be viewed in the built in web browser.
The Dissent Project aims to tightly integrate services from various organizations such as Amnesty International."
Comments (none posted)
Music Applications
Version 5.05 of Csound, a language for music synthesis, is out.
"
This largely a maintenence release, but as usual there are some new
opcodes and facilities.
This is the first release to include a French manual".
Full Story (comments: none)
Version 1.1 of MMA (Musical MIDI Accompaniment) is out with
several new features and bug fixes.
Full Story (comments: none)
Digital Photography
Version 0.11 of UFRaw, a utility to read and
manipulate raw images from digital cameras, is out.
"
The highlight of this release is the new
handling of image highlights, which takes care of both highlight
restoration and highlight clipping."
Full Story (comments: none)
Web Browsers
The
Firekeeper
project has been launched.
"
Firekeeper is an Intrusion Detection and Prevention System for Firefox. It is able to detect, block and warn the user about malicious sites. Firekeeper uses flexible rules similar to Snort ones to describe browser based attack attempts. Rules can also be used to effectively filter different kinds of unwanted content."
Full Story (comments: none)
Miscellaneous
Version 2.0 beta 1 of Pytables, a package for managing hierarchical datasets,
has been announced.
"
The PyTables development team is very happy to announce the public
availability of the first *beta* version of PyTables 2.0. Starting with
this release, both the API and the file format have entered in the stage
of freezing (i.e. nothing will be modified unless something is clearly
*wrong*), so people can use it in order to begin with the migration of
their existing PyTables 1.x scripts as well as start enjoying the new
exciting features in this major version ;)"
Comments (none posted)
Languages and Tools
C
ACC 0.5, a version of the GCC compiler aimed at
aspect-oriented
C programming, has been released. "
Besides some new features, the ACC 0.5 release also includes a set of
experimental weave adapters that
help integrate aspeCts in the build process of large C-based software
projects." Should be an interesting release for people into new
approaches to programming languages.
Full Story (comments: 5)
Robert Schwebel has sent in an announcement for the launch of the
OSELAS.Toolchain.
"
... we came to the conclusion that,
with PTXdist, we already have most of the infrastructure we need for
building toolchains: a staging model (get, prepare, extract, compile,
install, targetinstall), a Kconfig frontend for easy configuration,
autogenerated dependencies, a clean patch management system. So we tried
it out and the result is OSELAS.Toolchain(). It is now able to build a
full suite of gcc-4.1.2 toolchains for many different arm platforms,
including big endian, iwmmxt etc., for mips, powerpc and x86."
Full Story (comments: none)
Caml
The March 13, 2007 edition of the Caml Weekly News
is out with new Caml language articles.
Full Story (comments: none)
Haskell
The March 12, 2007 edition of the
Haskell Weekly News is online. This week we see the 2007 Haskell Workshop announcement, Haskell.org's participation in the Google Summer of Code gets underway, and of course, new libraries!
Comments (none posted)
Ruby
The March 11th, 2007 edition of the
Ruby Weekly News takes a look at the latest discussions
on the ruby-talk mailing list and comp.lang.ruby newsgroup.
Comments (none posted)
Tcl/Tk
The March 14, 2007 edition of the Tcl-URL! is online with new
Tcl/Tk articles and resources.
Full Story (comments: none)
Emulators
Version 0.7.0 of DOSBox, an x86 emulator which can be used for
running DOS games,
is available.
"
There were a lot of changes since the last version and here is a short list of the larger changes:
- Faster dynamic core for certain games.
- Improve the cycle guessing code and make it default!
- Foreign keyboard layout support."
Comments (none posted)
Libraries
Stable version 0.17 of GUASI
has been announced.
"
The GUASI library implements a thread based generic asyncronous execution engine, to be used to give otherwise syncronous calls an asyncronous behaviour. It can be used to wrap any syncronous call, so that it can be scheduled for execution, and whose result can be fetched at later time (hence not blocking the submitter thread). The GUASI library can be used as complement to standard event retrieval interfaces like poll(2), select(2) or epoll(4)."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Doc Searls
looks at
Internet Radio. "
Internet Radio has been sentenced to death. In a
move that recalls the Vogons' decision to destroy Earth to clear the way
for a highway bypass through space (a thankfully fictional premise of
Douglas Adams' Hitchhikers Guide to the Galaxy), the judges comprising the
Copyright Royalty Board have decided
to destroy the Internet radio industry so the Recording Industry won't be
inconvenienced by something it doesn't know, like or understand."
Comments (6 posted)
NewsForge
looks into the Free Software Foundation Europe's Freedom Task Force.
"
In the United States, the Free Software Foundation (FSF) has reached out to
the community with advocacy campaigns and the consultation process on the
next version of the GNU General Public License. By contrast, the Free
Software Foundation Europe (FSFE) is focusing much of its community outreach
on the creation of a group it calls the Freedom Task Force (FTF). Although
relatively new, the FTF is already starting to make its mark on free software
in Europe in the fields of education and compliance, and with its unique
approach to the problems of copyright."
Comments (none posted)
Trade Shows and Conferences
Linux-Watch
looks forward
to the Free Software Foundation's annual associate member and activist
meeting. "
The Free Software Foundation (FSF) holds its annual
associate member and activist meeting at MIT in Cambridge, Mass., on March
24. This year's conference theme is the "Year of the Update." The update in
question is the upcoming GPLv3, the latest version of the GNU General
Public License."
Comments (none posted)
Jeremy Jones
reports
on PyCon 2007. "
I recently attended PyCon 2007. It's interesting to
look back on the previous year when trying to figure out where to focus my
attention in the next year. In organizing my thoughts, I hope to give you
some useful information on what's coming. I also had the pleasure of
sitting down with Guido van Rossum, Python's creator and benevolent
dictator for life. This is the first time that backward compatibility is an
issue, and Guido addresses what you need to do to prepare, discusses the
strengths and weaknesses of the new conversion tool, and points out the
benefits of several new language features (for example, full support for
Unicode strings). He also discusses the controversy and misunderstanding
some of these changes have caused in the Python community, and how they're
being resolved."
Comments (none posted)
Companies
This
Guardian article argues that selling Linux-installed systems is not as
easy a thing for Dell to do as one might expect. "
Cost savings also
come directly from Microsoft and Intel in the form of discounts and
cooperative advertising support for the use of logos, and so on. These
schemes don't exist for Linux. But will the tens of thousands of Linux
supporters 'Digging' the idea on IdeaStorm ever turn into paying customers?
I can't speak for Dell on this, but I suspect very few will. Worse, those
few are mostly the sort of buyer no-one really wants."
Comments (34 posted)
LinuxWorld
covers
Novell's acquisition of RedMojo. "
Novell in November quietly
acquired a company whose resource virtualization software is being used to
bolster the data center automation capabilities of Novell's ZENworks
management package. The company acquired RedMojo for $9.72 million, though
chose not to make an official announcement at the time."
Comments (1 posted)
ZDNet
looks forward to the release of RHEL 5. "
Red Hat will permit up to four virtual machines to run atop RHEL 5 Server, but it's adding a new product called RHEL Advanced Platform that supports unlimited virtual machines and includes the company's Global File System software."
Comments (none posted)
Linux Adoption
InformationWeek
reports that the US Federal Aviation Administration is not planning
to make the move to Windows Vista.
"
March is coming in like a lion for Microsoft's public sector business. Days after InformationWeek reported that the Department of Transportation has placed a moratorium on upgrades to Windows Vista, Office 2007, and Internet Explorer 7, the top technology official at the Federal Aviation Administration revealed that he is considering a permanent ban on the Microsoft software in favor of a combination of Google's new online business applications running on Linux-based hardware."
Comments (5 posted)
DesktopLinux.com
reports
on a possible large-scale Linux migration effort in Japan.
"
Japan's public broadcasting network, NHK, reported late last week that the Japanese Ministry of Economy, Trade, and Industry plans to introduce Linux for use within classrooms across the country in the near future, according to Japanese non-profit educational website Gyaku.
Japan has been considering Linux for use in its schools since 2004, Gyaku noted. An investigation conducted in Spring 2006 found that more than 400,000 computers at schools in Japan were running on Windows 98 or Windows ME -- systems no longer supported by Microsoft."
Comments (none posted)
BBC News
reports
on an effort to use more open-source software in the UK government.
"
The government could save more than £600 million a year if it used more open source software, the shadow chancellor has estimated.
George Osborne said the savings would cut 5% off Whitehall's annual IT bill.
He called for a more "level playing field" for all software companies, and urged "cultural change" in government."
(Thanks to Richard Stevens).
Comments (none posted)
Interviews
PC World
talks
with IBM VP Scott Handy. "
Scott Handy started with IBM in 1983
as a systems engineer and went on to sales, marketing, and strategy
positions covering large accounts, channels, small and medium business, and
IBM products for Windows NT, Sun Solaris, and OS/2 Warp. Now, as vice
president for Linux and open source, he is one of the main public faces
articulating IBM's open-source strategy. IDG News Service Senior Writer
Elizabeth Montalbano caught up with Handy at the sidelines of the recent
LinuxWorld Open Solutions Summit in New York. He talked about how the
industry giant manages to support a vast product portfolio for Linux and
open-source initiatives."
Comments (none posted)
Resources
Mayank Sharma
explores Firebug on Linux.com.
"
Developing Web sites isn't as straightforward a task as it used to be at the turn of the century. With an influx of new tools, technologies, and development methodologies, a Web page is no longer a string of plain ol' HTML, but instead a complex mix of stylesheets, markup languages, and scripts. Debugging this complicated blend is no easy task. Firebug is an open source add-on to the Firefox Web browser that lets you edit and debug everything from simple CSS and JavaScript templates to complex AJAX applications."
Comments (none posted)
IBM developerWorks
takes
a look at debugging a FreeBSD kernel. "
Explore how to remotely
debug a FreeBSD kernel that is running on a target machine without
affecting system performance. In this article, examine setting up the debug
environment using serial communication port, compiling modified kernel
code, debugging, and troubleshooting tips."
Comments (1 posted)
Linux.com has
some tips
for software testers. "
One of the best ways you can participate in
the free and open source software (FOSS) revolution is by helping to test
software and reporting bugs and issues to project developers to help them
improve their code. Even in the wild and woolly, sometimes undisciplined
approach to development that we see in FOSS projects, there are ways to
test more effectively. Here are more than a dozen tips suggested by testing
gurus and developers that can help you become a successful tester."
Comments (1 posted)
Reviews
Linux.com
reviews
K3b. "
One of free software's premier applications, KDE's CD and DVD
burning suite K3b, is about to hit the big 1-0. This milestone touts
rewritten DVD video ripping and a refocused interface design. The new
release represents a level of feature-completeness and stability that
surpasses all previous K3b releases and, perhaps, all free software
competitors."
Comments (16 posted)
Linux On Desktop
reviews
the Thunar file manager. "
Thunar is a file manager that is shipped
by default with XFCE and is a integral part of XFCE desktop environment.
Thunar is developed by Benedikt Meurer and has been named after the god
Thor of Norse mythology. It is similar to Nautilus but uses much less
resource as compared to Nautilus, and in fact one of the goals of creating
Thunar was to create a file manager that was fast, clean and easy to
use." (Found on
GnomeDesktop)
Comments (3 posted)
Linux Devices
takes a look at the Nuvation IP camera.
"
Nuvation is demonstrating an ultra-compact, Linux-powered, intelligent IP camera reference design, at the TI Developer Conference in Dallas this week. The engineering consultancy firm says its camera can encode and stream D1 (720x480) video over Ethernet at 30fps.
The Nuvation design measures just 3.25 x 1.7 x 1.8 inches (79 x 43 x 47mm), yet it incorporates a full 300MHz ARM9 processor capable of running Linux or another embedded OS, according to the company."
Comments (1 posted)
Linux.com
looks at
Zabbix. "
Zabbix is a server-agent type of monitoring software,
meaning you have a Zabbix server where all gathered data is collected, and
a Zabbix agent running on each host. Note that you can have more than one
Zabbix server installed, but you cannot consolidate data from multiple
servers in one single central server. All Zabbix data, including
configuration and performance data, is stored in a relational database --
MySQL, PostgreSQL, or Oracle -- on the server. Zabbix server can run on all
Unix/Linux distributions, and Zabbix agents are available for Linux, Unix
(AIX, HP-UX, Mac OS X, Solaris, FreeBSD), Netware, Windows, and network
devices running SNMP v1, v2, and v3."
Comments (13 posted)
Miscellaneous
Melissa Draper
discusses the launch of the AussieChix group on Linux.com.
"
Following discussions at the Linux.Conf.Au conference in Sydney in January, members realised that a national group would better serve the country. Last month the groups united to form AussieChix, a new nationwide chapter that makes the group more accommodating to women from across Australia, whilst also improving the communications between the members of the previous chapters."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Electronic Frontier Foundation has sent out a press release on its role
in successfully challenging a patent being asserted by Clear Channel. "
The patent covered a system and method of creating digital
recordings of live performances. Clear Channel claimed the
bogus patent created a monopoly on all-in-one technologies
that produce post-concert digital recordings and threatened
to sue those who made such recordings. This locked musical
acts into using Clear Channel technology and blocked
innovations by others."
Full Story (comments: none)
The EFF has published
a report on the workings of the Digital Video Broadcasting project, which is creating television standards for much of the world outside of the Americas. Unsurprisingly, there is a lot of DRM involved. "
Consumers would never choose this future, so Hollywood will try to force it on them by regulatory fiat. DVB's imprimatur may put restrictive standards on the fast-track to becoming legally-enforced mandates, and existing laws already limit evasion of DRM even for lawful purposes. In effect, private DRM standards will trump national laws that have traditionally protected the public's interests and carefully circumscribed copyright holders' rights."
Comments (2 posted)
We have received a note from the One Laptop Per Child project saying that
the current build of beta-test systems is going well - well enough that
they have some systems available to expand their developer program. If you
have a project which you think might help out the OLPC folks and would like
a cute green laptop to run it on, have a look at the
OLPC Developers Program
page and let them know what you are thinking.
Comments (9 posted)
The OpenOffice.org project has sent an open letter to Dell in support of
installing their software on Dell's systems. "
Let's have a
conversation about how we could build an 'OpenOffice.org
supplied by Dell' product to give your customers what they are asking
for. We'd also be happy to accept any financial contribution that Dell
might offer to help ensure that OpenOffice.org continues to evolve in
the future."
Full Story (comments: 2)
Commercial announcements
Centric CRM has
announced the release of Centric CRM 4.1, a Customer Relationship Management system.
"
Centric CRM 4.1 introduces Action Plans, a new tool that allows a
company to quickly establish workflow best practices, as well as expanded
support for a total of eleven leading database systems".
Comments (none posted)
Version 6.0.1 of CrossOver has been announced.
"
This version is entirely a bug fix release. Notably, it
contains a fix so that time sensitive applications will continue
to work correctly after the new Daylight Savings
Time switch. It also contains a few bug fixes for Outlook
and handling multiple CD installers, as well as a range
of other minor issues."
Full Story (comments: none)
Funambol and db4objects have
announced Funambol Connector for db4o.
"
The Funambol Connector for db4o makes it easy for software developers
to store and manage complex information in an embedded database on mobile
devices such as laptops, smartphones and PDAs. The combination of Funambol
and db4o eliminates the need to write extensive code to manage and extract
data from complicated data structures and gives users a wide range of
mobile devices to access complex data while on the go."
Comments (none posted)
Sun Microsystems, Inc. and the NetBeans(TM) Community have
announced an early release of the NetBeans Ruby Pack.
"
The NetBeans plug-in offers
developers added support for dynamic and scripting languages and includes
editing features for both Ruby and JRuby -- a 100% pure-Java(TM)
implementation of the Ruby programming language that runs on the Java(TM)
Virtual Machine.
The NetBeans Ruby Pack goes beyond basic editing, syntax highlighting,
navigation outline, project support and unit test execution to provide
developers with a rich set of features to enhance productivity."
Comments (none posted)
NetXen, Inc. has announced the availability of their
Linux Sockets Acceleration product. NetXen
"
... introduced Linux Sockets Acceleration(tm) (LSA), a solution that
delivers far higher network performance while greatly reducing host CPU
overhead. It is the first network acceleration solution for Linux that
requires no modifications to the kernel, host TCP stack or applications,
and can offload both user- and kernel-mode applications. NetXen's LSA is
also the first solution to support NIC and offload modes simultaneously."
Full Story (comments: none)
The OpenVZ project has announced the availability of its operating system
server virtualization software for Red Hat Enterprise Linux 5.
"
"This provides a great base with solid device support and code stability,
which we will use as the basis for future OpenVZ software," said Kir
Kolyshkin, manager of the OpenVZ project. "We continue to keep in step with
the latest Linux releases to serve users in the open source community.""
Full Story (comments: none)
Open-Xchange Inc. has
announced the Open-Xchange Community project.
"
Open-Xchange and the world's leading web-hosting company, 1&1 Internet,
recently announced the availability of MailXchange, 1&1's hosted email and
collaboration solution based upon Open-Xchange Inc.'s award winning Smart
Collaboration(TM) technology. Open-Xchange today is releasing the source
code of 1&1 MailXchange server components under General Public License
(GPL) and the AJAX-based user interface under Creative Commons License
"Attribution- NonCommercial-ShareAlike 2.5"."
Comments (none posted)
Oracle Corporation has
announced its joining of the Eclipse Foundation board of directors.
"
Oracle today announced it will extend its participation in
the Eclipse Foundation by becoming a Board Member and Strategic Developer.
An Eclipse member since its inception, Oracle's increased role further
demonstrates the company's efforts to help drive open source innovations
and furthers its commitment to the developer community. Oracle's increased
role in the Eclipse community also includes a new proposal to open source
its Oracle(R) TopLink technology, a component of Oracle Fusion Middleware,
through the Eclipse Foundation."
Comments (none posted)
Oracle Corporation has
announced its plans to release Oracle TopLink as open-source software.
"
Today, at the EclipseCon Conference, Oracle (Nasdaq: ORCL), a newly
appointed Eclipse Board Member and Strategic Developer, announced it will
donate its award winning Java persistence framework, Oracle(R) TopLink, to
the open source community. In addition, Oracle announced the proposal of a
new Eclipse project to deliver a comprehensive persistence platform based
on the contribution of Oracle TopLink, a component of Oracle Fusion
Middleware, source code and test cases."
Comments (none posted)
Palamida has
announced the addition of Python language support to its
compliance library.
"
Palamida(TM), the leader in
software intellectual property management solutions and audit services,
today announced that it has expanded its extensive compliance library to
include over 6,200 new open source projects while adding support for the
popular Python programming language."
Comments (none posted)
Paradigma Software has announced the release of a free beta version of
Valentina Server for Linux.
"
Valentina is a pioneering database system that, built on a unique object-relational model,
outperforms almost all commercially available database servers disk based or RAM based. Recent
customer provided data compares equivalent search operations with mySQL server at five minutes to
complete, down to five seconds with Valentina Server."
Full Story (comments: none)
Novell, Inc. has
announced the availability of SUSE Linux Enterprise Server 10 with
integrated Xen* virtualization technology for the SAP NetWeaver and mySAP Business Suite.
Comments (none posted)
STMicroelectronics has
announced two new SPEAr family configurable System-on-Chip ICs.
"
The
dual-core SPEAr Plus600, complemented with a single-core variant, SPEAr
Head600, represents a market-unique solution that enables printer, fax,
point-of-sale (POS) and other equipment manufacturers to develop complex
yet flexible digital engines at a fraction of the time and cost required by
a full-custom design approach. Additionally, the possibility to choose
between a single- and a dual-processor device with the same footprint and
architecture will enable manufacturers to address different market segments
for the same application."
Comments (none posted)
Sun Microsystems, Inc. has
announced plans to release the online game server platform
Project Darkstar as open-source code.
"
Sun Microsystems, Inc. announced plans today at the 2007 Game Developers Conference
in San Francisco to open source Project Darkstar, a ground-breaking online
game server platform written entirely in Java(TM) technology, at the 2007
Game Developers Conference in San Francisco. The company also announced the
opening of registration for the Darkstar Playground, which will enable
developers to create a wide variety of games that can be provisioned
through a single server platform."
Comments (none posted)
New Books
O'Reilly has published the book
Ajax on Java by Steven Douglas Olson.
Full Story (comments: none)
Resources
The March 13, 2007 edition of the FSFE Newsletter is online
with the latest Free Software Foundation Europe news.
Topics include: Fiduicary License Agreement released under GFDL/CC-by-sa,
FSFE announces big raffle among all Fellows, FSFE at FOSDEM in Brussels
(Belgium), Ciará¡n O'Riordan at SkyCon in Limerick (Ireland),
End of internship of Maria Luisa Carli,
System administration murphy weeks and Get Active: Join the SELF project!
Full Story (comments: none)
Federico Mena-Quintero has published a
Summer of Code Mentoring HOWTO document.
"
The Summer of Code, initiated by Google, is a wonderful opportunity for students to learn how to contribute to free software in a short time, while making a nice chunk of money in the process. Each participating student gets a mentor, who is normally a member of an existing free software project. This document intends to give some advice to mentors, so that they'll be able to help their students to complete their projects successfully."
Comments (none posted)
Contests and Awards
The Electronic Frontier Foundation has
announced the recipients of its 2007 Pioneer Awards: Yochai Benkler, Cory Doctorow, and Bruce Schneier.
Comments (1 posted)
The Andrew W. Mellon Foundation has
announced
that nominations are open for the 2007 Mellon Awards. "
The Mellon
Awards, in values of $50,000 and $100,000, honor not-for-profit
organizations for leadership in the collaborative development of open
source software tools with particular application to higher education and
not-for-profit activities. More information on the awards, including a
listing of last year's winners and the 2007 online nomination form, is
available at http://matc.mellon.org."
Comments (none posted)
The fourth
PyWeek Challenge has been
announced, it will take place from April 1-4, 2007.
"
The PyWeek challenge:
1. Invites entrants to write a game in one week from scratch either as an individual or in a team,
2. Is intended to be challenging and fun,
3. Will hopefully increase the public body of game tools, code and expertise,
4. Will let a lot of people actually finish a game, and
5. May inspire new projects (with ready made teams!)"
Comments (none posted)
Mainsoft Corporation has
announced the Race to Linux 2.0 challenges, to be held in March and
April, 2007.
"
The 3-series Race to Linux 2.0 challenges Visual Studio
developers to experiment with .NET 2.0-to-Linux porting
options. DevX will announce the target applications at the
beginning of each race. More than 100 developers have
registered to date.
The first developer to deliver the application running
successfully under SUSE Linux on an IBM System x will win a
Nintendo Wii and games package."
Comments (none posted)
An XMMS2 logo contest has been launched.
"
XMMS2 Team officially announced it's graphic competition today. The
competition goal is for the popular media player to gain a new look
and to increase awareness of the project. The competition will be
split up in two parts: the first will be for a new logotype. The
second part, which will be launched after the conclusion of the
first, will aim for a new look for the wiki with reusable elements
for client authors to use.
First prize in both competitions is an Amazon.com gift certificate
valid for $400."
Full Story (comments: none)
Surveys
Dell has decided to follow up on requests for Linux-installed systems by
running
a survey on just what people would like. Questions cover the types of
systems, which distributions, etc. There is, however, no question on
whether customers want systems with 100% free software. The survey is open
through March 23.
Comments (38 posted)
Education and Certification
The Linux Professional Institute will offer discounted certification exams
at LinuxWorld Belgium on March 21 and 22, 2007.
Full Story (comments: none)
TimeSys Corporation
"
... is adding more sessions to its popular
series of educational webinars for embedded Linux developers. Running
through March and April, the new topics cover best practices for
embedded Linux development through an examination of project risk and
the benefits of a common toolset. Later sessions in the series look at
technology choices for developers building devices with a graphical
interface and an in-depth look at the QEMU processor emulator."
Full Story (comments: none)
Calls for Presentations
A call for papers has gone out for the Black Hat USA security conference.
The event takes place at Caesars Palace in Las Vegas, NV on
July 28 - August 2, 2007. Submissions are due by May 1.
Full Story (comments: none)
A call for papers has gone out for the DeepSec In-Depth Security Conference.
The event will take place on November 20-23, 2007 in Vienna, Austria.
Proposals are due before June 10.
Full Story (comments: none)
GUADEC 2007 call for papers deadline has been extended until
March 15.
Full Story (comments: none)
Upcoming Events
GnomeDesktop.org has
announced
the GUADEMY GNOME+KDE Hack-meeting. The event will be held in
Coruña, Spain on March 23-25, 2007.
"
KDE will be represented by Aaron Seigo, Larrosa, Astals and Rafael Fernandez, and from GNOME, Rodrigo Moya, Álvaro del Castilo, Álvaro López Ortega, Carlos Garnacho, Andrés Gómez and Iago Toral will be there."
Comments (none posted)
Sun Microsystems, Inc. has
announced the 2007 JavaOne Conference.
The event will take place in San Francisco, CA on May 8-11, 2007.
Comments (none posted)
The Linux Users' Group of Davis will hold the next
Linux Installfest in Davis, CA on Saturday March 31, 2007.
Full Story (comments: none)
The 2007 MySQL Conference & Expo will take place in Santa Clara,
California on April 23-26, 2007.
"
This year's program promises
to be the most exciting ever, offering more than 110 sessions and workshops
for every type of user -- from experienced database administrators and
programmers to MySQL beginners. Attendees who register by March 14 will
save $200 off the standard fee. Other discounts are also available that
may be used in conjunction with early registration for additional savings."
Full Story (comments: none)
Bruce Perens has announced a press conference during the Novell Brainshare
conference in Salt Lake City, UT during the week of March 19.
"
The topics will be: The Microsoft-Novell agreement,
GPL version 3 and how it will impede Novell from making use of new
innovation by the Free Software community and
Software patents vs. Free Software."
Full Story (comments: none)
Some of the Samba eXPerience 2007 speakers
have been announced.
"
The organizers are happy to welcome Howard Chu (Chief Architect of OpenLDAP) as the keynote speaker. Other topics include: talks from the WINE project and OpenChange to show the link to other projects, a talk regarding Samba and GPLv3 reflecting current legal discussions and, of course, developers, users, and vendors fill out the rest of the program with 25 talks in two days."
Comments (none posted)
The dates for the 2007 Scientific Python conference
have been announced.
"
According to www.scipy.org, The SciPy 2007 Conference will be on August 16-17 this year; tutorials and sprints will run on the 14th, 15th, and 18th. I wont be able to attend (new baby), but Id like to organize a half-day or one-day session to update and extend the Software Carpentry notes. Lots of modules need writing, both on Python-specific stuff and on general software engineering skills for scientists and engineers."
Comments (none posted)
Events: March 22, 2007 to May 21, 2007
The following event listing is taken from the
LWN.net Calendar.
| Date(s) | Event | Location |
March 18 March 23 |
Novell BrainShare 2007 |
Salt Lake City, Utah, USA |
March 22 March 25 |
Linux Audio Conference |
Berlin, Germany |
March 23 March 25 |
ShmooCon |
Washington DC, USA |
March 23 March 25 |
Guademy |
Coruña, Spain |
| March 24 |
FSF Associate Membership Meeting |
Cambridge, MA, USA |
March 26 March 29 |
Emerging Technology Conference |
San Diego, CA, USA |
April 1 April 4 |
International Lisp Conference 2007 |
Cambridge, England |
April 1 April 5 |
Embedded Systems Conference |
San Jose, CA, USA |
| April 1 |
GPLv3: Improving a Great Licence (discussion draft 3) |
Brussels, Belgium |
April 2 April 6 |
DJango Bootcamp |
Atlanta, Georgia, USA |
April 2 April 5 |
Hack in The Box Security Conference 2007 |
Dubai, United Arab Emirates |
April 3 April 8 |
Make Art 2007 |
Poitiers, France |
April 12 April 14 |
International Free Software Forum (Forum
Internacional Software Livre) |
Porto Alegre, Brazil, |
April 14 April 15 |
Ruby and Python Conference 2007 |
Poznan, Poland |
April 15 April 18 |
Gelato ICE: Itanium® Conference & Expo |
San Jose, California, USA |
April 17 April 19 |
Embedded Linux Conference |
San Jose, USA |
April 18 April 20 |
CanSecWest Applied Security Conference 2007 |
Vancouver, Canada |
| April 19 |
Linux 2007 |
Lisbon, Portugal |
| April 19 |
Power Architecture Software Summit |
Austin, TX, USA |
April 20 April 22 |
International Conference on Availability, Reliability and Security
Conference on Availability, Reliability and Security |
Vienna, Austria, |
April 20 April 22 |
Penguicon 5.0 Open Source Software & Science Fiction Convention |
Troy, Michigan, USA |
| April 21 |
Romanian Open Source Development Meeting |
Bucharest, Romania |
April 23 April 25 |
Samba eXPerience 2007 |
Göttingen, Germany |
April 23 April 27 |
PostgreSQL Bootcamp at the Big Nerd Ranch |
Atlanta, USA |
April 23 April 26 |
MySQL Conference and Expo |
Santa Clara, CA, USA |
April 28 April 29 |
Linuxfest Northwest |
Bellingham, WA, USA |
May 3 May 4 |
Ubuntu Education Summit |
Sevilla, Spain |
May 3 May 5 |
SugarCRM Global Developer Conference |
San Jose, CA, USA |
May 4 May 6 |
Libre Graphics Meeting 2007 |
Montreal, Quebec, Canada |
May 5 May 6 |
LayerOne Security Conference |
Pasadena, CA, USA |
| May 5 |
Ubucon - Sevilla |
Sevilla, Spain |
May 6 May 11 |
Ubuntu Developer Summit |
Sevilla, Spain |
| May 7 |
CommunityOne |
San Francisco, CA, USA |
May 8 May 9 |
World Summit on Intrusion Prevention |
Baltimore, MD, USA |
May 8 May 11 |
Annual Java Technology Conference |
San Francisco, CA, USA |
May 8 May 11 |
OSHCA 2007 |
Kuala Lumpur, Malaysia |
May 9 May 11 |
Red Hat Summit |
San Diego, CA, USA |
May 10 May 11 |
IEEE International Workshop on Open Source Test Technology Tools |
Berkeley, CA, USA |
| May 10 |
NLUUG Spring Conference 2007 |
Ede, The Netherlands |
May 11 May 13 |
Conferenze Italiana sul Software Libero |
Cosenza, Italy |
May 12 May 13 |
KOffice ODF Weekend |
Berlin, Germany |
May 14 May 25 |
The Pure Data Spring School 2007 |
Glasgow, Scotland |
May 16 May 18 |
php|tek |
Chicago, IL, USA |
May 17 May 20 |
RailsConf 2007 |
Portland, Oregon |
May 18 May 19 |
eLiberatica Open Source and Free Software Conference |
Brasov, Romania |
May 18 May 19 |
FreedomHEC |
Los Angeles, CA |
May 18 May 19 |
BSDCan 2007 |
Ottawa, Canada |
May 19 May 20 |
The 3rd International Workshop on Software Engineering for Secure Systems |
Minneapolis, Minnesota, USA |
May 19 May 20 |
Rockbox International Developers Conference 2007 |
Stockholm, Sweden |
| May 19 |
Grazer LinuxDays 2007 |
Graz, Austria |
May 19 May 20 |
Make Magazine Maker Faire 2007 |
San Mateo, CA, USA |
| May 19 |
Linuxwochen Austria - Graz |
Graz, Austria |
If your event does not appear here, please
tell us about it.
Page editor: Forrest Cook