LWN.net Logo

LWN.net Weekly Edition for March 15, 2007

The Grumpy Editor's guide to HDR with Linux

This article is part of the LWN Grumpy Editor series.
Your editor has long enjoyed photography. As a high school student, he even pondered, briefly, the idea of pursuing photography as a career; for better or for worse, common sense won out and your editor went to engineering school instead. But taking pictures has remained an active hobby, even if it has tended to degrade to the creation of a stream of snapshots of the kids for grandparent consumption in recent years. The advent of digital photography has brought a couple of your editor's passions back together, with only one thing - free time - missing. But, your editor has discovered, one of the keys to the finding of free time is to take an activity of interest and redefine it as "work." Thus, this article.

A while back, your editor stumbled across the Flickr HDR pool; some of the photos in that pool were sufficiently amazing to inspire an immediate "I wanna do that" reaction. The better part of a year later, it finally became possible to learn a bit more about the process behind those pictures. HDR (or high dynamic range) photography is a set of techniques for overcoming the limitations of contemporary hardware and, in the process, generating images which better represent a scene as viewed by the human eye - or which appear to come from a work of fantasy art.

The sensors in today's digital cameras have gotten good, but they still fall short of the human eye in a few ways. In particular, the range of light levels which can be captured by the sensor is not yet up to what film can handle, and is far from what the eye can do. Anybody who has spent any time taking pictures is familiar with this problem: one can take a beautiful landscape picture, but, in the end result, the wild cloud formations are washed out completely and the shadows just go black. Being unable to capture a scene that one can see quite well can be most frustrating.

The idea behind HDR, as it is used with photography, is to extend the available dynamic range by taking multiple shots at different exposure levels. For a given exposure, there will be a range of light levels which will be captured with good resolution by the sensor; everything else gets compressed at one end or the other. If one has a series of images at different exposures and a reasonable model of the camera's response curve, one can generate a composite image by using the parts of each source image which are in the good part of the curve. So, in that landscape picture, a very dark exposure can be used for the bright parts of the scene - clouds, for example - while a bright exposure yields low-light details. By mixing them together, the HDR algorithm can produce an image with full sensor resolution across a much wider dynamic range.

As an example, consider the photograph below, taken from your editor's dining room:

OriginalHDR
[Original] [HDR]

(Larger versions of the images are available.) In the original, parts of the plant in the foreground are entirely lost in the shadows. Meanwhile, the breathtaking view of Colorado suburbia (with mountains in the distance) is washed out entirely. The HDR version brings all of that detail back.

HDR is not applicable to all situations. It has a tendency to turn people into cartoon characters. Beyond that, the need for multiple exposures generally implies setting up a tripod and taking some time for the entire process. It is thus not well suited to changing scenes, sports photography (though baseball, perhaps, can be expected to stand still for the requisite time), etc. It can work well for relatively static scenes: landscapes, buildings, the SCO case, and so on.

Most of the people playing with HDR seem to be using proprietary plugins for a proprietary image manipulation program running under a proprietary operating system. That is, needless to say, not your editor's preferred mode of operation. Thus your editor began a search for tools which would perform HDR processing under Linux. It turns out that there are a few such tools around; there is no need to use proprietary software for this task.

HDR generation

The first step is to look for a way to represent HDR images - normal image formats are not up to that task. Linux.com ran a reasonable article on HDR formats late last year; the end result appears to be that the OpenEXR format is the way to go. The OpenEXR package comes with the libraries needed by other applications and the deeply painful "exrdisplay" image viewer. The pfstools package adds a set of pipeline-oriented tools for working with HDR images; it is a necessary part of any HDR hobbyist's toolkit.

Next, one should come up with a set of source images. Ideally, these images are taken with a tripod-mounted camera and cover a range of at least two f-stops above and below the nominally "correct" exposure. Varying the exposure time is preferred over changing the aperture; if nothing else, this ensures that all of the images will have the same depth of field. One can start with images taken without a tripod, but it will be necessary to register them before continuing. Your editor did not get into that aspect of the task; tools like hugin and hdrprep can be used for this job. These tools may be a good topic for your editor's attention in a future article. One can also apply HDR techniques to a single image, especially if it is in the camera's raw format, but multiple exposures give much better results.

With the images in place, one can look at combining them into an HDR image. This is a two-stage process (two user-visible stages, at least): creating a set of response curves and using them to map the images together into a single dynamic range space. The response curves are a mapping between some sort of real-world light levels and the resulting sensor values on all three color channels. When combined with information on the relative exposure times of two (or more images), the response curves allow the HDR program to map pixels from all of the images into the same space. The response curves can be generated directly from the source images; they don't normally change, so they can be saved and reused later.

[Cinepaint windows] The first HDR-generation tool to look at is cinepaint, once known as "Film Gimp." This tool is a fork of the GIMP which is aimed at use by movie studios; its floating-point image data support makes it useful for HDR processing as well. The generation of HDR is done with the "bracketing to HDR" plugin which is, happily, packaged with the cinepaint source distribution. There is a detailed explanation of what this plugin does and how to use it. Be warned that it makes for somewhat difficult reading - and it would even if it weren't originally written in German.

The good news is that actually using this plugin is easy. One selects "bracketing for HDR" from the File->New from menu, then selects the set of source images from a simple dialog. The plugin will then import them. There is no provision for obtaining the relative exposure information from the image files themselves; instead, the plugin sorts the images by brightness and applies an assumed (adjustable) exposure difference between them. It attempts to feed each image to dcraw for decoding, but your editor was not able to get raw images to work despite the fact that dcraw supports his camera just fine; it looks like the raw import plugin was written for an older version of dcraw. That problem is likely to be easily overcome; your editor just didn't want to spend much time on it. So TIFF files were used instead.

Once the images are in, the user can check the exposure values, then hit the "compute response" button. That yields the two plots shown in the screenshot. By messing around with the buttons, one can look for the reference image which yields the smoothest set of response curves - or one can just accept what the plugin does by default. Then a click on the "generate HDR" button creates the final product, which can then be saved out in the OpenEXR format.

Your editor set out to take some amazing pictures for this article. The area in which your editor resides is widely held to be beautiful, but, frankly, Colorado is not at its best in early March; perhaps this article should have been written in June. Nonetheless, the effort was made. Below is a rather mediocre shot of the Boulder foothills in original and HDR (with cinepaint) forms (larger versions available).

OriginalHDR
[Original] [HDR]

The HDR image above shows a halo effect (the bright sky above the mountain) which is characteristic of some tone mapping algorithms; we'll get into tone mapping shortly.

An alternative approach is PFScalibration, a command-line HDR generation utility based on pfstools. These tools work as a netpbm-like pipeline; their use requires a fair amount of typing, though much of the work can be scripted. The steps are the following:

  • Run jpeg2hdrgen to generate a description file for the source images. It reads the EXIF information from the source files to get the relative exposures and outputs it in a simple file. There is a dcraw2hdrgen tool as well, but the subsequent stages in the pipeline are not able to work with raw files. Your editor suspects that TIFF files could be used by creating the hdrgen file by hand, but the whole process seems to be intended for use with JPEG files. A lossy file format is not the most auspicious starting point for somebody interested in high dynamic range imagery, but that's how it is.

  • The pfshdrcalibrate utility can then be used to create a set of response curves; gnuplot can be used to visualize them. This process can take some time (it's significantly slower than cinepaint), but the resulting file can be saved and reused with different images in the future.

  • Another pfshdrcalibrate run then uses the response curves to create the HDR image. Piping the output into pfsoutexr generates an OpenEXR file.

Here's an example generated from a series of pictures of your editor's dungeon office (larger versions):

OriginalHDR
[Original] [HDR]

As a general rule, HDR images generated with cinepaint and PFScalibration tend to look identical. The generation of HDR is not where the real magic lies, so the results should be close.

[qtpfsgui] For those who don't like command-line HDR processing, the qtpfsgui utility may be worth a look. It is a graphical wrapper around PFScalibration based on QT4; it handles both HDR generation and tone mapping. On the HDR side, it puts up a file selection dialog for the source images followed by the "HDR creation wizard." The user is asked to select a "creation configuration," from a list of configurations helpfully named "Configuration 1" through "Configuration 6". The advice to stick with Configuration 1 was hard for your editor to ignore; simply hitting "next" generated the image.

Said image appeared in a display window; like exrdisplay, this window can only show the image in full resolution. Your editor, lacking a 7 megapixel monitor, was thus unable to view the entire image at once. Even worse, qtpfsgui is one of the family of (generally KDE-based) graphical tools which feels the need to implement its own window manager. The display window lives within the larger qtpfsgui window; it cannot be resized with the usual shortcut your editor is used to. In summary, qtpfsgui gets the job done, but writing a simple script around PFScalibration seems like an easier way to go.

Tone mapping

While the tools above will generate a fine HDR image, one problem remains: the dynamic range in that HDR image far exceeds the range of your editor's monitor (or printer). Turning that image into something which can be displayed requires a step called tone mapping. This is where the serious magic comes in: somehow the vast amount of information in the HDR image must be scaled back in a way which does not compromise the image quality that was the whole point of this exercise in the first place. Several tone mapping algorithms exist, and most of them have a number of mysterious knobs to tweak. While the generation of HDR can be mostly automated, tone mapping inherently requires experimentation and human judgment.

The bulk of the action appears to be in the pfstmo package, which implements several tone mapping algorithms as separate, standalone filters. One can use pfstmo with the rest of the pfstools package to construct pipelines which generate tone-mapped images. Given the iterative nature of the task, however, it would be nice if there were a better way.

[qpfstmo] That better way is qpfstmo, a Qt-based graphical interface to pfstmo. The interface feels a little clunky at times, and it would sure be nice to have some online documentation on what the various parameters do, but qpfstmo does what is really needed: it lets the user play with tone mapping algorithms and compare the results. A small image size can be used for trying out algorithms and parameters - a real time saver, since some of the algorithms can take a long time on a full-size image - and multiple versions of the image can be on the screen at once. When a final configuration is found for a given image, it can be generated in a larger size and saved in any of the usual image formats. When applied to a large image file, this step can be rather hard on the hardware; your editor discovered that 1GB of memory was not really enough.

[qtpfsgui] The qtpfsgui tool mentioned above has the ability to drive pfstmo as well. It is, in fact, clear that this tool shares a lot of code with pfstmo. The interface is far less friendly, however: everything happens within the One Big Window and it does not appear to be possible to see the results from more than one algorithm at the same time. It resets the display image size every time the user changes algorithm. One assumes that this (fairly new) tool will improve over time. For now, though, qpfstmo seems like a much better way to go for tone mapping control.

A different set of tone mapping operators is supplied with the exrtools distribution. Your editor tried them all; each one is a cumbersome, multi-step process. It can take a long time to process an image, only to find that the parameters need quite a bit of tweaking. The tools seem like they will do quality transformations, but they just cry out for a qpfstmo-like interface which allows experimentation with smaller-size images and comparison of results. For what it's worth, here's a shot taken from the hill above your editor's house mapped with the exrtools non-linear masking method:

OriginalHDR
[Original] [HDR]

See the larger versions for more detail. Doubtless one could get good results from these tools with enough effort, but your editor found it easier to get quality images with psftmo.

Conclusion

For the generation of HDR images, your editor found cinepaint to be faster and simpler to work with. This does not count, however, the long and frustrating experience of building the HDR plugin on a Fedora Rawhide system; one gets the sense that the plugin's author uses a rather older, less picky version of g++. Longer-term, however, the PFScalibration suite may prove to be the way to go. It is far more compact and easy to install on a new system; why lug the weight of cinepaint if one is not going to use its other features? A bit of scripting will easily turn PFScalibration into a single-command HDR generation tool.

It's worth noting that there are a couple of other HDR generators for Linux out there. MakeHDR is where a lot of it started; one of its authors is Paul Debevec, who did much of the early research in this area. The code was last touched in 1999, however, and it comes with a "educational purposes only" license. One can also look at HDRgen, but it is a binary-only, free-beer tool. Your editor did not actually try either one of them; given that the free tools do the job so well, there didn't seem to be any point.

For tone mapping, pfstmo (and qpfstmo) are the best tools at this point. It is hard to be entirely satisfied with the state of the art in this area, though. Tone mapping will always be an exercise in compromises, so it's not surprising that the results are rarely perfect. There is likely to be room for improvement - in both the algorithms and the interface to them - for some time to come.

As is the case in many areas, Linux has the tools one needs to play with high dynamic range imagery. One just has to work a little harder to get started than on some other systems. HDR has found its way into your editor's photographic toolkit; look for the results in the reporting from some conference in some exotic part of the world. When playing with this stuff, your editor is far from grumpy.

Comments (29 posted)

Java cryptography and free distributions

The problem first came up in February: the Red Hat Directory Server developers would like to include the Java Security Services module in the Fedora distribution. The code, it seems, is free, but there is still a problem: the Java virtual machine requires that all Java Cryptography Extension providers (of which JSS is one) to be signed with a Sun-approved key. If an application tries to use a JCE module which lacks the requisite signature, the whole thing comes crashing down - an experience which probably differs from what the user had in mind. In practice, this limitation means that users either use the signed version obtained from Sun, or do not use JSS at all.

Warren Togami recently posted a couple of possibilities for how Fedora might be able to ship JSS. They were:

  • The Fedora team builds the JSS module, then compares it to the Sun-signed version. Assuming they match, Fedora has proved that it can rebuild the software. So the project can declare Mission Accomplished, dump the module it just built, and ship Sun's version. A variation on this approach suggested later on involved having Red Hat obtain an approved key and sign the modules that Fedora would distribute; in this way, Fedora could add its own modifications.

  • Fedora ships an unsigned version of JSS. Applications would then have to be recoded to load the module in a way which shorts out the signature check. Any applications not fixed up in this way would fail.

The first option, at first blush, would appear to work. Fedora would be able to build its own module and ship the source. It falls down, however, as soon as a Fedora user tries to make a change; that user will not be able to rebuild the patched module in a way that will actually work. Derivative distributions would run into the same problem. As a result, it would appear that Fedora stopped considering this option fairly quickly.

Not signing the module at all has obvious problems as well. It seems likely that many potential JSS users have their own applications in mind. If those applications do not work, they will rightly see Fedora as not having support for the features they are looking for.

Other alternatives have been considered; one is to emphasize the use of the GCJ compiler and try to steer users away from Sun's virtual machine. That approach would certainly offer a higher degree of freedom, at the cost of not really providing what many Java users appear to want. Additionally, not everybody is convinced that GCJ has achieved the level of maturity that many users would expect.

In an interesting way, this is really just the Tivo problem under a different guise. Locked-down hardware refuses to run software which lacks the expected signatures. In this case, we have virtual hardware, in the form of the Java virtual machine, which is doing the same thing. The result is the same as well: the software is available and nominally free, but the users of that software cannot create their own versions and expect to be able to run them.

If Sun follows through on its desire to move to GPLv3, and if that license retains its requirement that any needed signing keys be distributed with the source, Sun may find itself in an interesting position. It is hard to see how the current policy would be compliant with the new GPL's requirements.

The upcoming GPL Java release would appear to be the best hope for distributors trying to deal with this situation. Once the code is free, distributors can patch it to make the whole of Java distributable as free software. So the real solution to shipping JSS with a distribution which insists on freedom would appear to be to wait for a free Java.

Comments (9 posted)

Page editor: Jonathan Corbet

Security

Intrusion detection for the browser

March 14, 2007

This article was contributed by Jake Edge.

Websites with malicious content are a growing problem, so tools to detect this content and alert the user to its presence are quite welcome. A plugin for Firefox called Firekeeper uses the ideas behind intrusion detection systems (IDS) and applies them to web traffic. Firekeeper uses some of the rule syntax and pattern matching code from Snort, the venerable open source IDS, providing it with a solid foundation.

As with any IDS, the basic function of Firekeeper is to inspect the traffic that it sees, applying some pattern matching smarts and a set of rules to determine what actions it takes. The possible actions are to alert the user and allow them to decide what to do, stop processing the HTTP response without user interaction or to accept and continue processing, also without consulting the user. Alert rules can also provide extra information [Firekeeper alert] that will be displayed with the alert in order to help the user make an informed decision about what action to take. This information can take the form of text strings to describe the content as well as references to URLs, CVE entries and Bugtraq IDs potentially giving the user a wealth of descriptive information.

Firekeeper can do pattern matching on three different parts of the HTTP or HTTPS response: the URL, headers and body. The simplest form matches literal strings in the various pieces of the response, but there is also a Perl compatible regular expression (regexp) engine that can be applied to each piece as well. The documentation warns of serious performance implications from having too many regexps, especially ones that do not contain a literal rule to narrow the search space; good advice for most applications that use regexps.

Firekeeper can be downloaded from the project site and it installs flawlessly if one is willing to add the site (hosted at mozdev.org) to the list of trusted plugin locations and ignore the unsigned nature of the code. The source is available from the site as well so those with concerns about the security bypasses can build their own version. It comes with a handful of default rules and a test page to try them out as well. Visiting various sites with Firekeeper enabled while working on this article did not noticeably slow down the browser for the author and, other than the tests, did not trigger any rules.

Any IDS is an invasive program and has access to all sorts of information one probably wants to keep private, particularly decrypted network data. This makes IDS programs high profile targets for exploitation. If an attacker can send a packet or series of packets that can subvert the IDS, they can potentially eavesdrop on all network traffic, even encrypted traffic. Because Firekeeper has access to the decrypted HTTPS traffic, there is reason to be concerned that the plugin could be subverted via the same kinds of remotely exploitable vulnerabilities that have impacted Snort, a recent example is here. Firekeeper implements a small subset of the Snort functionality, which should make it less likely, but users of the plugin should be aware of the possibility.

An IDS is only as good as the rules that it uses, and newer exploits (and so-called 0-days) will not yet have rules available, leaving a window of vulnerability. Firekeeper does have provisions for loading rule files from external sites (which, of course, has its own set of security issues) that would help propagate new rules quickly, at least for users who restart their browser frequently.

Firekeeper is certainly not for less technical users and probably never will be. There is too much knowledge and understanding of web protocols and security threats required to understand the alerts and too many false positives to turn the alerts into blocks. And like many security tools and techniques, this is no panacea; it will not stop all browser-targeted attacks, but it does have its uses. An alert that a site has tried to exploit a browser bug, even one that does not affect the browser version being used, is still useful information which can help users to avoid dodgy sites.

Comments (1 posted)

Brief items

A second remote hole for OpenBSD

Visitors to the OpenBSD site will notice that it now reads "Only two remote holes in the default install, in more than 10 years!" That's one more than it had a little while ago. The details can be found in this Core Security advisory: it seems that the problem was in the IPv6 code. It's amusing to read the timeline - the OpenBSD folks were apparently not enthusiastic about accepting the existence of a remotely exploitable vulnerability. They did accept it, though, and their record over many years remains impressive.

Comments (28 posted)

New vulnerabilities

amarok: remote code injection

Package(s):amarok CVE #(s):
Created:March 14, 2007 Updated:March 14, 2007
Description: Amarok's Magnatune component suffers from a shell code injection vulnerability exploitable by a hostile remote server.
Alerts:
Gentoo 200703-11 2007-03-13

Comments (none posted)

kdelibs: denial of service

Package(s):kdelibs CVE #(s):CVE-2007-1308
Created:March 8, 2007 Updated:March 29, 2007
Description: Kdelibs has a denial of service vulnerability that can be triggered in Konqueror's use of KDE JavaScript. A null pointer dereference caused by accessing the content of an iframe with an ftp:// URI in the src attribute can be used to trigger the DOS.
Alerts:
Ubuntu USN-447-1 2007-03-28
Mandriva MDKSA-2007:054 2007-03-08

Comments (none posted)

ktorrent: incorrect validation

Package(s):ktorrent CVE #(s):CVE-2007-1384 CVE-2007-1385 CVE-2007-1799
Created:March 13, 2007 Updated:October 24, 2007
Description: Bryan Burns of Juniper Networks discovered that KTorrent did not correctly validate the destination file paths nor the HAVE statements sent by torrent peers. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.
Alerts:
Debian DSA-1373-2 2007-10-23
Debian DSA-1373-1 2007-09-11
Ubuntu USN-436-2 2007-05-18
Mandriva MDKSA-2007:095 2007-05-01
Gentoo 200705-01 2007-05-01
Slackware SSA:2007-093-02 2007-04-04
Ubuntu USN-436-1 2007-03-12

Comments (1 posted)

mplayer: buffer overflow

Package(s):mplayer CVE #(s):CVE-2007-1246
Created:March 8, 2007 Updated:April 1, 2008
Description: MPlayer versions up to 1.0rc1 have a buffer overflow in the loader/dmo/DMO_VideoDecoder.c DMO_VideoDecoder_Open function. user-assisted remote attackers can use this to create a buffer overflow and possibly execute arbitrary code.
Alerts:
Debian DSA-1536-1 2008-03-31
Gentoo 200705-21 2007-05-30
Foresight FLEA-2007-0013-1 2007-04-23
Slackware SSA:2007-109-02 2007-04-20
Gentoo 200704-09 2007-04-14
Ubuntu USN-433-1 2007-03-09
Mandriva MDKSA-2007:057 2007-03-08
Mandriva MDKSA-2007:055 2007-03-08

Comments (none posted)

silc-server: denial of service

Package(s):silc-server CVE #(s):
Created:March 14, 2007 Updated:March 14, 2007
Description: silc-server, a Secure Internet Live Conferencing protocol implementation, has a NULL pointer dereference which can be exploited to crash the server.
Alerts:
Gentoo 200703-12 2007-03-14

Comments (none posted)

xen, qemu: information disclosure

Package(s):Xen CVE #(s):CVE-2007-0998
Created:March 14, 2007 Updated:March 20, 2007
Description: From the Red Hat advisory: a flaw was found affecting the VNC server code in QEMU. On a fully virtualized guest VM, where qemu monitor mode is enabled, a user who had access to the VNC server could gain the ability to read arbitrary files as root in the host filesystem.
Alerts:
Fedora FEDORA-2007-343 2007-03-19
Fedora FEDORA-2007-344 2007-03-19
Red Hat RHSA-2007:0114-02 2007-03-14
openSUSE openSUSE-SU-2012:1572-1 2012-11-26
openSUSE openSUSE-SU-2012:1573-1 2012-11-26

Comments (none posted)

xine-lib: arbitrary code execution

Package(s):xine-lib CVE #(s):CVE-2007-1387
Created:March 13, 2007 Updated:April 1, 2008
Description: Moritz Jodeit discovered that the DirectShow loader of Xine did not correctly validate the size of an allocated buffer. By tricking a user into opening a specially crafted media file, an attacker could execute arbitrary code with the user's privileges.
Alerts:
Debian DSA-1536-1 2008-03-31
Mandriva MDKSA-2007:062 2007-03-13
Mandriva MDKSA-2007:061 2007-03-13
Ubuntu USN-435-1 2007-03-12

Comments (none posted)

Updated vulnerabilities

acroread: multiple vulnerabilities

Package(s):acroread CVE #(s):CVE-2006-5857 CVE-2007-0045 CVE-2007-0046
Created:January 11, 2007 Updated:October 26, 2009
Description: Adobes acrobat reader has the following vulnerabilities:

The Adobe Reader Plugin has a cross site scripting vulnerability that can be triggered by processes malformed URLs. Arbitrary JavaScript can be served by a malicious web server, leading to a cross-site scripting attack.

Maliciously crafted PDF files can be used to trigger two vulnerabilities, if an attacker can trick a user into viewing the files, arbitrary code can be executed with the user's privileges.

Alerts:
SuSE SUSE-SA:2009:049 2009-10-26
Gentoo 200910-03 2009-10-25
Red Hat RHSA-2007:0021-01 2007-01-22
Gentoo 200701-16 2007-01-22
SuSE SUSE-SA:2007:011 2007-01-22
Red Hat RHSA-2007:0017-01 2007-01-11

Comments (1 posted)

apache: cross-site scripting

Package(s):apache CVE #(s):CVE-2006-3918
Created:August 9, 2006 Updated:April 4, 2008
Description: From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header."
Alerts:
SuSE SUSE-SA:2008:021 2008-04-04
Ubuntu USN-575-1 2008-02-04
SuSE SUSE-SA:2006:051 2006-09-08
Debian DSA-1167-1 2005-09-04
Red Hat RHSA-2006:0619-01 2006-08-10
Red Hat RHSA-2006:0618-01 2006-08-08

Comments (none posted)

bind: denial of service

Package(s):bind CVE #(s):CVE-2007-0493 CVE-2007-0494
Created:January 26, 2007 Updated:March 14, 2007
Description: The bind package is vulnerable to two remote denial of service attacks in which attackers can cause the bind daemon to to crash or exit unexpectedly by providing malformed data to the daemon in a DNS request.
Alerts:
Red Hat RHSA-2007:0057-02 2007-03-14
Gentoo 200702-06 2007-02-17
Red Hat RHSA-2007:0044-01 2007-02-06
Ubuntu USN-418-1 2007-02-05
Trustix TSLSA-2007-0005 2007-02-05
Mandriva MDKSA-2007:030 2006-01-30
SuSE SUSE-SA:2007:014 2007-01-30
Fedora FEDORA-2007-147 2007-01-29
Debian DSA-1254-1 2007-01-27
OpenPKG OpenPKG-SA-2007.007 2007-01-29
Slackware SSA:2007-026-01 2007-01-29
rPath rPSA-2007-0021-1 2007-01-25

Comments (none posted)

bluez-utils: hidd vulnerability

Package(s):bluez-utils CVE #(s):CVE-2006-6899
Created:January 16, 2007 Updated:May 14, 2007
Description: hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the Mouse and Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack.
Alerts:
Red Hat RHSA-2007:0065-01 2007-05-14
Ubuntu USN-413-1 2007-01-24
Mandriva MDKSA-2007:014 2006-01-15

Comments (none posted)

bugzilla: multiple vulnerabilities

Package(s):bugzilla CVE #(s):CVE-2006-5453 CVE-2006-5454 CVE-2006-5455
Created:November 10, 2006 Updated:August 28, 2007
Description: Bugzilla has the following vulnerabilities:

Input data passed to various fields is not properly sanitized before being passed back to users.

Users can gain unauthorized access to read attachment descriptions while using diff mode.

HTTP GET and HTTP POST requests can be used to perform unauthorized actions due to improper verification.

Input that is passed to showdependencygraph.cgi is not properly sanitized before being returned to users.

Alerts:
Debian DSA-1208-1 2006-11-11
Gentoo 200611-04 2006-11-09

Comments (none posted)

busybox: insecure password generation

Package(s):busybox CVE #(s):CVE-2006-1058
Created:May 5, 2006 Updated:May 2, 2007
Description: The BusyBox 1.1.1 passwd command does not use a proper salt when generating passwords. This would create an instance where a brute force attack could take very little time.
Alerts:
Red Hat RHSA-2007:0244-02 2007-05-01
Fedora FEDORA-2006-511 2006-05-04
Fedora FEDORA-2006-510 2006-05-04

Comments (2 posted)

clamav: directory traversal, denial of service

Package(s):clamav CVE #(s):CVE-2007-0897 CVE-2007-0898
Created:February 20, 2007 Updated:March 7, 2007
Description: Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor. (CVE-2007-0897)

Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message. (CVE-2007-0898)

Alerts:
Debian DSA-1263-1 2007-03-06
Gentoo 200703-03 2007-03-02
SuSE SUSE-SA:2007:017 2007-02-23
Mandriva MDKSA-2007:043 2006-02-19

Comments (none posted)

cpio: arbitrary code execution

Package(s):cpio CVE #(s):CVE-2005-4268
Created:January 2, 2006 Updated:March 17, 2010
Description: Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).
Alerts:
CentOS CESA-2010:0145 2010-03-17
Red Hat RHSA-2010:0145-01 2010-03-15
rPath rPSA-2007-0094-1 2007-05-07
Red Hat RHSA-2007:0245-02 2007-05-01
Ubuntu USN-234-1 2006-01-02

Comments (none posted)

vixie-cron: privilege escalation

Package(s):cron CVE #(s):CVE-2006-2607
Created:May 31, 2006 Updated:June 1, 2009
Description: The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root.
Alerts:
Ubuntu USN-778-1 2009-06-01
Red Hat RHSA-2006:0539-01 2006-07-12
Gentoo 200606-07 2006-06-09
SuSE SUSE-SA:2006:027 2006-05-31
rPath rPSA-2006-0082-1 2006-05-25

Comments (1 posted)

cscope: buffer overflows

Package(s):cscope CVE #(s):CVE-2006-4262
Created:October 2, 2006 Updated:June 16, 2009
Description: Will Drewry of the Google Security Team discovered several buffer overflows in cscope, a source browsing tool, which might lead to the execution of arbitrary code.
Alerts:
CentOS CESA-2009:1101 2009-06-16
Red Hat RHSA-2009:1101-01 2009-06-15
Gentoo 200610-08 2006-10-20
Debian DSA-1186-1 2006-09-30

Comments (none posted)

cscope: buffer overflows

Package(s):cscope CVE #(s):CVE-2004-2541
Created:May 22, 2006 Updated:June 19, 2009
Description: A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.
Alerts:
CentOS CESA-2009:1102 2009-06-19
CentOS CESA-2009:1101 2009-06-16
Red Hat RHSA-2009:1102-01 2009-06-15
Red Hat RHSA-2009:1101-01 2009-06-15
Gentoo 200606-10 2006-06-11
Debian DSA-1064-1 2006-05-19

Comments (1 posted)

Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service

Package(s):cyrus-sasl CVE #(s):CVE-2006-1721
Created:April 21, 2006 Updated:September 4, 2007
Description: Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. An attacker could possibly exploit this vulnerability by sending specially crafted data stream to the Cyrus-SASL server, resulting in a Denial of Service even if the attacker is not able to authenticate.
Alerts:
Red Hat RHSA-2007:0878-01 2007-09-04
Red Hat RHSA-2007:0795-01 2007-09-04
SuSE SUSE-SA:2006:025 2006-05-05
Fedora FEDORA-2006-515 2006-05-04
Debian DSA-1042-1 2006-04-25
Mandriva MDKSA-2006:073 2006-04-24
Ubuntu USN-272-1 2006-04-24
Gentoo 200604-09 2006-04-21

Comments (none posted)

dovecot: index cache file handling error

Package(s):dovecot CVE #(s):CVE-2006-5973
Created:November 29, 2006 Updated:May 8, 2007
Description: The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable.
Alerts:
Fedora FEDORA-2006-1504 2006-12-27
Fedora FEDORA-2006-1396 2006-12-18
rPath rPSA-2006-0220-1 2006-11-30
Ubuntu USN-387-1 2006-11-28

Comments (none posted)

ekiga: format string vulnerability

Package(s):ekiga CVE #(s):CVE-2007-1006 CVE-2007-0999
Created:February 21, 2007 Updated:March 30, 2007
Description: Ekiga contains a format string vulnerability in the code which processes control messages from remote peers.

If a user was running Ekiga and listening for incoming calls, a remote attacker could send a crafted call request, and execute arbitrary code with the user's privileges.

Alerts:
Gentoo 200703-25 2007-03-29
Red Hat RHSA-2007:0087-02 2007-03-14
Mandriva MDKSA-2007:058 2007-03-08
Ubuntu USN-434-1 2007-03-09
Fedora FEDORA-2007-322 2007-03-07
Fedora FEDORA-2007-321 2007-03-07
Ubuntu USN-426-1 2007-02-22
Mandriva MDKSA-2007:044 2007-02-21
Fedora FEDORA-2007-263 2007-02-20
Fedora FEDORA-2007-262 2007-02-20

Comments (none posted)

elinks: arbitrary file access

Package(s):elinks CVE #(s):CVE-2006-5925
Created:November 16, 2006 Updated:October 22, 2009
Description: The elinks text-mode browser has an arbitrary file access vulnerability in the Elinks SMB protocol handler. If a user can be tricked into visiting a specially crafted web page, arbitrary files may be read or written with the user's permissions.
Alerts:
Ubuntu USN-851-1 2009-10-21
Gentoo 200701-27 2007-01-30
OpenPKG OpenPKG-SA-2006.043 2006-12-26
Debian DSA-1240-1 2006-12-21
Gentoo 200612-16 2006-12-14
Debian DSA-1228-1 2006-12-05
Debian DSA-1226-1 2006-12-03
Fedora FEDORA-2006-1278 2006-11-21
Fedora FEDORA-2006-1277 2006-11-21
Mandriva MDKSA-2006:216 2006-11-20
Red Hat RHSA-2006:0742-01 2006-11-15

Comments (none posted)

fail2ban: denial of service

Package(s):fail2ban CVE #(s):CVE-2006-6302
Created:February 16, 2007 Updated:July 30, 2007
Description: fail2ban 0.7.4 and earlier does not properly parse sshd logs file, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in to ssh using a login name containing certain strings with an IP address.
Alerts:
Gentoo 200702-05 2007-02-16

Comments (3 posted)

fetchmail: password disclosure and DOS

Package(s):fetchmail CVE #(s):CVE-2006-5867 CVE-2006-5974
Created:January 10, 2007 Updated:March 16, 2007
Description: Fetchmail suffers from a password disclosure vulnerability due to a failure to use secure protocols (advisory) and a denial of service vulnerability (advisory).
Alerts:
SuSE SUSE-SR:2007:004 2007-03-16
Debian DSA-1259-1 2007-02-14
Red Hat RHSA-2007:0018-01 2007-01-31
Slackware SSA:2007-024-01 2007-01-25
Gentoo 200701-13 2007-01-22
Fedora FEDORA-2007-042 2007-01-16
Fedora FEDORA-2007-041 2007-01-16
Mandriva MDKSA-2007:016 2006-01-15
Ubuntu USN-405-1 2007-01-11
rPath rPSA-2007-0003-1 2007-01-09
OpenPKG OpenPKG-SA-2007.004 2007-01-08

Comments (none posted)

ffmpeg: buffer overflows

Package(s):ffmpeg CVE #(s):CVE-2006-4799 CVE-2006-4800
Created:September 14, 2006 Updated:May 28, 2007
Description: the AVI processing code in FFmpeg has a number of buffer overflow vulnerabilities. If an attacker can trick a user into loading a specially crafted crafted AVI, arbitrary code can be executed with the user's privileges.
Alerts:
Gentoo 200609-09 2006-09-13

Comments (2 posted)

Mozilla stuff: multiple vulnerabilities

Package(s):firefox thunderbird seamonkey CVE #(s):CVE-2006-6497 CVE-2006-6498 CVE-2006-6501 CVE-2006-6502 CVE-2006-6503 CVE-2006-6504 CVE-2006-6505
Created:December 20, 2006 Updated:March 12, 2007
Description: The Mozilla Project has released new versions of firefox, thunderbird, and seamonkey to address the usual pile of security issues; see this announcement or this CERT advisory for details.
Alerts:
Debian DSA-1265-1 2007-03-10
Debian DSA-1258-1 2007-02-07
Debian DSA-1253-1 2006-01-27
Ubuntu USN-398-4 2007-01-27
SuSE SUSE-SA:2007:006 2007-01-12
Mandriva MDKSA-2007:011 2007-01-11
Mandriva MDKSA-2007:010 2007-01-11
Gentoo 200701-04 2007-01-10
Ubuntu USN-400-1 2007-01-04
Gentoo 200701-03 2007-01-04
Gentoo 200701-02 2007-01-04
Ubuntu USN-398-2 2007-01-03
Ubuntu USN-398-3 2007-01-04
Ubuntu USN-398-1 2007-01-02
Fedora FEDORA-2006-004 2007-01-02
rPath rPSA-2006-0234-2 2006-12-22
SuSE SUSE-SA:2006:080 2006-12-29
Slackware SSA:2006-357-03 2006-12-25
Slackware SSA:2006-357-01 2006-12-25
Slackware SSA:2006-357-02 2006-12-25
rPath rPSA-2006-0234-1 2006-12-22
Fedora FEDORA-2006-1499 2006-12-21
Fedora FEDORA-2006-1491 2006-12-20
Fedora FEDORA-2006-1492 2006-12-20
Red Hat RHSA-2006:0759-01 2006-12-19
Red Hat RHSA-2006:0760-01 2006-12-19
Red Hat RHSA-2006:0758-01 2006-12-19

Comments (none posted)

freeradius: several vulnerabilities

Package(s):freeradius CVE #(s):CVE-2005-4745 CVE-2005-4746
Created:August 8, 2006 Updated:April 24, 2007
Description: Several remote vulnerabilities have been discovered in freeradius, a high-performance RADIUS server, which may lead to SQL injection or denial of service.
Alerts:
Mandriva MDKSA-2007:092 2007-04-23
Debian DSA-1145-1 2006-08-08

Comments (none posted)

freetype: integer overflows

Package(s):freetype CVE #(s):CVE-2006-0747 CVE-2006-1861 CVE-2006-2493 CVE-2006-2661 CVE-2006-3467
Created:June 8, 2006 Updated:June 1, 2010
Description: The FreeType library has several integer overflow vulnerabilities. If a user can be tricked into installing a specially crafted font file, arbitrary code can be executed with the privilege of the user.
Alerts:
Gentoo 201006-01 2010-06-01
Fedora FEDORA-2009-5644 2009-05-28
Fedora FEDORA-2009-5558 2009-05-28
CentOS CESA-2009:0329 2009-05-22
Red Hat RHSA-2009:1062-01 2009-05-22
Red Hat RHSA-2009:0329-02 2009-05-22
Gentoo 200710-09 2007-10-09
Debian DSA-1178-1 2006-09-16
Ubuntu USN-341-1 2006-09-06
Gentoo 200609-04 2006-09-06
rPath rPSA-2006-0157-1 2006-08-25
Mandriva MDKSA-2006:148 2006-08-24
Red Hat RHSA-2006:0635-01 2006-08-21
Red Hat RHSA-2006:0634-01 2006-08-21
Fedora FEDORA-2006-912 2006-08-14
SuSE SUSE-SA:2006:045 2006-08-01
OpenPKG OpenPKG-SA-2006.017 2006-07-28
Ubuntu USN-324-1 2006-07-27
Slackware SSA:2006-207-02 2006-07-27
Mandriva MDKSA-2006:129 2006-07-20
Gentoo 200607-02 2006-07-09
SuSE SUSE-SA:2006:037 2006-06-27
Mandriva MDKSA-2006:099-1 2006-06-13
Mandriva MDKSA-2006:099 2006-06-12
rPath rPSA-2006-0100-1 2006-06-12
Debian DSA-1095-1 2006-06-10
Ubuntu USN-291-1 2006-06-08

Comments (none posted)

gcc: file overwrite vulnerability

Package(s):gcc CVE #(s):CVE-2006-3619
Created:September 6, 2006 Updated:March 14, 2008
Description: The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree.
Alerts:
Mandriva MDVSA-2008:066 2007-03-13
Red Hat RHSA-2007:0473-01 2007-06-11
Red Hat RHSA-2007:0220-02 2007-05-01
Debian DSA-1170-1 2006-09-06

Comments (none posted)

gd: buffer overflow

Package(s):gd CVE #(s):CVE-2007-0455
Created:February 7, 2007 Updated:November 18, 2009
Description: The gd graphics library contains a buffer overflow which could enable a remote attacker to execute arbitrary code. Note that various other packages include code from gd and could also be vulnerable.
Alerts:
Debian DSA-1936-1 2009-11-17
Red Hat RHSA-2008:0146-01 2008-02-28
Ubuntu USN-473-1 2007-06-11
OpenPKG OpenPKG-SA-2007.016 2007-05-18
Trustix TSLSA-2007-0007 2007-02-13
Fedora FEDORA-2007-150 2007-02-12
Fedora FEDORA-2007-149 2007-02-12
rPath rPSA-2007-0028-1 2007-02-08
Mandriva MDKSA-2007:038 2006-02-06
Mandriva MDKSA-2007:036 2006-02-06
Mandriva MDKSA-2007:035 2006-02-06

Comments (2 posted)

gdb: buffer overflow

Package(s):gdb CVE #(s):CVE-2006-4146
Created:September 15, 2006 Updated:June 12, 2007
Description: A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
Alerts:
Red Hat RHSA-2007:0469-01 2007-06-11
Red Hat RHSA-2007:0229-02 2007-05-01
Ubuntu USN-356-1 2006-10-02
Fedora FEDORA-2006-975 2006-09-14

Comments (none posted)

gdm: improper file permissions

Package(s):gdm CVE #(s):CVE-2006-1057
Created:April 19, 2006 Updated:May 2, 2007
Description: The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem.
Alerts:
Red Hat RHSA-2007:0286-02 2007-05-01
Mandriva MDKSA-2006:083 2006-05-09
Ubuntu USN-278-1 2006-05-03
Debian DSA-1040-1 2006-04-24
Fedora FEDORA-2006-338 2006-04-19

Comments (none posted)

gedit: format string vulnerability

Package(s):gedit CVE #(s):CAN-2005-1686
Created:June 9, 2005 Updated:February 5, 2009
Description: A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.
Alerts:
Fedora FEDORA-2009-1189 2009-01-29
Fedora FEDORA-2009-1187 2009-01-29
Debian DSA-753-1 2005-07-12
Mandriva MDKSA-2005:102 2005-06-15
Red Hat RHSA-2005:499-01 2005-06-13
Gentoo 200506-09 2005-06-11
Ubuntu USN-138-1 2005-06-09

Comments (1 posted)

gnupg: stack overwrite

Package(s):gnupg CVE #(s):CVE-2006-6235
Created:December 12, 2006 Updated:March 13, 2007
Description: A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
Alerts:
Fedora FEDORA-2007-316 2007-03-12
Fedora FEDORA-2007-315 2007-03-12
SuSE SUSE-SA:2006:075 2006-12-13
Mandriva MDKSA-2006:228 2006-12-11

Comments (3 posted)

GnuPG: unsigned data injection vulnerability

Package(s):gnupg CVE #(s):CVE-2007-1263
Created:March 6, 2007 Updated:March 30, 2007
Description: Core Security Technologies has reported that GnuPG and GnuPG clients are vulnerable to an unsigned data injection vulnerability.
Alerts:
SuSE SUSE-SA:2007:024 2007-03-30
rPath rPSA-2007-0056-1 2007-03-16
Red Hat RHSA-2007:0107-02 2007-03-14
Debian DSA-1266-1 2007-03-13
Ubuntu USN-432-2 2007-03-13
Mandriva MDKSA-2007:059 2006-03-08
Trustix TSLSA-2007-0009 2007-03-09
Ubuntu USN-432-1 2007-03-08
Slackware SSA:2007-066-01 2007-03-08
Red Hat RHSA-2007:0106-01 2007-03-06

Comments (none posted)

grip: buffer overflow

Package(s):grip CVE #(s):CAN-2005-0706
Created:March 10, 2005 Updated:November 19, 2008
Description: Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:
Fedora FEDORA-2008-9604 2008-11-19
Fedora FEDORA-2008-9521 2008-11-19
Fedora-Legacy FLSA:152919 2005-09-15
Mandriva MDKSA-2005:074 2005-04-20
Mandriva MDKSA-2005:075 2005-04-20
Gentoo 200504-07 2005-04-08
Mandrake MDKSA-2005:066 2005-04-01
Red Hat RHSA-2005:304-01 2005-03-28
Gentoo 200503-21 2005-03-17
Fedora FEDORA-2005-203 2005-03-09
Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

gv: stack-based buffer overflow

Package(s):gv CVE #(s):CVE-2006-5864
Created:November 20, 2006 Updated:April 9, 2007
Description: Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.
Alerts:
Gentoo 200704-06 2007-04-06
Gentoo 200703-24 2007-03-26
Debian DSA-1243-1 2006-12-28
Debian DSA-1214-2 2006-12-27
Mandriva MDKSA-2006:229 2006-12-13
rPath rPSA-2006-0230-1 2006-12-12
Fedora FEDORA-2006-1438 2006-12-11
Fedora FEDORA-2006-1437 2006-12-11
Ubuntu USN-390-3 2006-12-06
Ubuntu USN-390-2 2006-12-06
Mandriva MDKSA-2006:214-1 2006-12-04
Ubuntu USN-390-1 2006-11-30
Gentoo 200611-20 2006-11-24
Debian DSA-1214-1 2006-11-20
Mandriva MDKSA-2006:214 2006-11-17

Comments (none posted)

gzip: multiple vulnerabilities

Package(s):gzip CVE #(s):CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338
Created:September 19, 2006 Updated:January 20, 2010
Description: Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash.

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code.

Alerts:
Debian DSA-1974-1 2010-01-20
Fedora FEDORA-2007-557 2007-05-31
Gentoo 200611-24 2006-11-28
Fedora-Legacy FLSA:211760 2006-11-13
Fedora FEDORA-2006-989 2006-10-10
SuSE SUSE-SA:2006:056 2006-09-26
Gentoo 200609-13 2006-09-23
Trustix TSLSA-2006-0052 2006-09-22
Mandriva MDKSA-2006:167 2006-09-20
Slackware SSA:2006-262-01 2006-09-20
OpenPKG OpenPKG-SA-2006.020 2006-09-20
Debian DSA-1181-1 2006-09-19
rPath rPSA-2006-0170-1 2006-09-19
Ubuntu USN-349-1 2006-09-19
Red Hat RHSA-2006:0667-01 2006-09-19

Comments (1 posted)

horde-kronolith: local file inclusion

Package(s):horde-kronolith CVE #(s):CVE-2006-6175
Created:January 17, 2007 Updated:March 7, 2008
Description: Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered string is used instead of a sanitized string to view local files. An authenticated attacker could craft an HTTP GET request that uses directory traversal techniques to execute any file on the web server as PHP code, which could allow information disclosure or arbitrary code execution with the rights of the user running the PHP application (usually the webserver user).
Alerts:
Gentoo 200701-11 2007-01-16

Comments (none posted)

ImageMagick: buffer overflows

Package(s):ImageMagick CVE #(s):CVE-2006-5456
Created:October 31, 2006 Updated:March 8, 2007
Description: Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.
Alerts:
Slackware SSA:2007-066-06 2007-03-08
rPath rPSA-2007-0029-1 2007-02-08
rPath rPSA-2006-0218-1 2006-11-27
Gentoo 200611-19 2006-11-24
Fedora FEDORA-2006-1285 2006-11-22
Fedora FEDORA-2006-1286 2006-11-22
Debian DSA-1213-1 2006-11-19
SuSE SUSE-SA:2006:066 2006-11-14
Gentoo 200611-07 2006-11-13
Ubuntu USN-372-1 2006-11-01
Mandriva MDKSA-2006:193 2006-10-30

Comments (2 posted)

imlib2: arbitrary code execution

Package(s):imlib2 CVE #(s):CVE-2006-4806 CVE-2006-4807 CVE-2006-4808 CVE-2006-4809
Created:November 6, 2006 Updated:August 13, 2007
Description: M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user were tricked into viewing or processing a specially crafted image with an application that uses imlib2, the flaws could be exploited to execute arbitrary code with the user's privileges.
Alerts:
Mandriva MDKSA-2007:156 2007-08-10
Gentoo 200612-20 2006-12-20
Fedora FEDORA-EXTRAS-2006-004 2006-11-09
Mandriva MDKSA-2006:198-1 2006-11-06
Mandriva MDKSA-2006:198 2006-11-06
Ubuntu USN-376-2 2006-11-06
Ubuntu USN-376-1 2006-11-03

Comments (none posted)

java: multiple vulnerabilities

Package(s):java CVE #(s):CVE-2006-4339 CVE-2006-4790 CVE-2006-6731 CVE-2006-6736 CVE-2006-6737 CVE-2006-6745
Created:January 18, 2007 Updated:June 4, 2010
Description: java has multiple vulnerabilities, these include: an RSA exponent padding attack vulnerability, two vulnerabilities which allow untrusted applets to access data in other applets, vulnerabilities that involve applets gaining privileges due to serialization bugs in the JRE and buffer overflows in the java image handling routines that can give attackers read/write/execute capabilities for local files.
Alerts:
Pardus 2010-67 2010-06-04
Gentoo 200705-20 2007-05-26
Red Hat RHSA-2007:0073-01 2007-02-09
Red Hat RHSA-2007:0072-01 2007-02-08
Red Hat RHSA-2007:0062-02 2007-02-07
Gentoo 200701-15 2007-01-22
SuSE SUSE-SA:2007:010 2007-01-18

Comments (1 posted)

kdelibs: kate backup file permission leak

Package(s):kdelibs kate kwrite CVE #(s):CAN-2005-1920
Created:July 19, 2005 Updated:September 21, 2010
Description: Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information.
Alerts:
Gentoo 200611-21 2006-11-27
Debian DSA-804-2 2005-11-10
Debian DSA-804-1 2005-09-08
Red Hat RHSA-2005:612-01 2005-07-27
Ubuntu USN-150-1 2005-07-21
Mandriva MDKSA-2005:122 2005-07-20
Fedora FEDORA-2005-594 2005-07-19

Comments (1 posted)

kdelibs: cross-site scripting

Package(s):kdelibs konqeror CVE #(s):CVE-2007-0537
Created:February 5, 2007 Updated:August 13, 2007
Description: Konqueror 3.5.5 does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment, a related issue to CVE-2007-0478.
Alerts:
Mandriva MDKSA-2007:157 2007-08-10
Gentoo 200703-10 2007-03-10
rPath rPSA-2007-0052-1 2007-03-07
Ubuntu USN-420-1 2007-02-06
Mandriva MDKSA-2007:031 2007-02-02

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-4623
Created:October 18, 2006 Updated:November 14, 2007
Description: The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data.
Alerts:
Ubuntu USN-489-1 2007-07-19
rPath rPSA-2006-0194-1 2006-10-17

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-0007 CVE-2007-0006
Created:February 15, 2007 Updated:November 14, 2007
Description: Linux kernel versions from 2.6.9 to 2.6.20 have a denial of service vulnerability. A remote attacker can cause the key_alloc_serial function's key serial number collision avoidance code to have a null dereference, resulting in a crash.
Alerts:
Fedora FEDORA-2007-599 2007-06-21
Red Hat RHSA-2007:0099-02 2007-03-14
rPath rPSA-2007-0050-1 2007-03-06
Red Hat RHSA-2007:0085-01 2007-02-27
Mandriva MDKSA-2007:047 2007-02-21
Fedora FEDORA-2007-226 2007-02-13
Fedora FEDORA-2007-225 2007-02-13

Comments (1 posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-4535 CVE-2006-4538
Created:September 18, 2006 Updated:January 5, 2009
Description: Sridhar Samudrala discovered a local denial of service vulnerability in the handling of SCTP sockets. By opening such a socket with a special SO_LINGER value, a local attacker could exploit this to crash the kernel. (CVE-2006-4535)

Kirill Korotaev discovered that the ELF loader on the ia64 and sparc platforms did not sufficiently verify the memory layout. By attempting to execute a specially crafted executable, a local user could exploit this to crash the kernel. (CVE-2006-4538)

Alerts:
Red Hat RHSA-2008:0787-01 2009-01-05
Red Hat RHSA-2007:1049-01 2007-12-03
Mandriva MDKSA-2006:182 2006-10-11
Red Hat RHSA-2006:0689-01 2006-10-05
Debian DSA-1184-2 2006-09-26
Debian DSA-1184-1 2006-09-25
Debian DSA-1183-1 2006-09-25
Ubuntu USN-347-1 2006-09-18

Comments (none posted)

kernel: denial of service by memory consumption

Package(s):kernel CVE #(s):CVE-2006-2936
Created:July 17, 2006 Updated:November 14, 2007
Description: The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the driver can handle, which causes the data to be queued.
Alerts:
SuSE SUSE-SA:2007:035 2007-06-14
Mandriva MDKSA-2006:151 2006-08-25
Mandriva MDKSA-2006:150 2006-08-25
Ubuntu USN-331-1 2006-08-03
rPath rPSA-2006-0130-1 2006-07-17

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2007-0772
Created:February 23, 2007 Updated:November 14, 2007
Description: The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.
Alerts:
Fedora FEDORA-2007-599 2007-06-21
Ubuntu USN-451-1 2007-04-10
SuSE SUSE-SA:2007:021 2007-03-16
Mandriva MDKSA-2007:060 2006-03-09
Fedora FEDORA-2007-291 2007-03-02
Fedora FEDORA-2007-277 2007-03-02
SuSE SUSE-SA:2007:018 2007-02-27
rPath rPSA-2007-0036-1 2007-02-23

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-5757
Created:November 13, 2006 Updated:November 14, 2007
Description: From the MOKB-05-11-2006 advisory: "The ISO9660 filesystem handling code of the Linux 2.6.x kernel fails to properly handle corrupted data structures, leading to an exploitable denial of service condition. This particular vulnerability seems to be caused by a race condition and a signedness issue. When performing a read operation on a corrupted ISO9660 fs stream, the isofs_get_blocks() function will enter an infinite loop when __find_get_block_slow() callback from sb_getblk() fails ("due to various races between file io on the block device and getblk")."
Alerts:
Fedora FEDORA-2007-599 2007-06-21
Fedora FEDORA-2006-1223 2006-11-12
Fedora FEDORA-2006-1221 2006-11-10

Comments (none posted)

kernel: denial of service

Package(s):kernel CVE #(s):CVE-2006-2935 CVE-2006-4145 CVE-2006-3745
Created:September 1, 2006 Updated:July 30, 2008
Description: Previous versions of the kernel package are subject to several vulnerabilities. Certain malformed UDF filesystems can cause the system to crash (denial of service). Malformed CDROM firmware or USB storage devices (such as USB keys) could cause system crash (denial of service), and if they were intentionally malformed, can cause arbitrary code to run with elevated privileges. In addition, the SCTP protocol is subject to a remote system crash (denial of service) attack.
Alerts:
Red Hat RHSA-2008:0665-01 2008-07-24
SuSE SUSE-SA:2007:053 2007-10-12
SuSE SUSE-SA:2006:064 2006-11-10
Red Hat RHSA-2006:0710-01 2006-10-19
SuSE SUSE-SA:2006:057 2006-09-28
Trustix TSLSA-2006-0051 2006-09-15
Ubuntu USN-346-2 2006-09-14
Ubuntu USN-346-1 2006-09-14
rPath rPSA-2006-0162-1 2006-08-31

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):kernel CVE #(s):CVE-2006-5749 CVE-2006-4814 CVE-2006-6106
Created:January 5, 2007 Updated:January 8, 2009
Description: A security issue has been reported in Linux kernel due to an error in drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()" function never initializes an event timer before scheduling it with the "add_timer()" function.

The mincore function in the kernel does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock.

Another vulnerability has been reported in Linux kernel caused by a boundary error within the handling of incoming CAPI messages in net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain Kernel data structures.

Alerts:
Red Hat RHSA-2008:0787-01 2009-01-05
Red Hat RHSA-2009:0001-01 2009-01-08
CentOS CESA-2008:0211 2008-05-07
Red Hat RHSA-2008:0211-01 2008-05-07
Debian DSA-1503 2008-02-22
Debian DSA-1503-2 2008-03-06
SuSE SUSE-SA:2007:035 2007-06-14
SuSE SUSE-SA:2007:053 2007-10-12
Ubuntu USN-416-2 2007-03-01
Ubuntu USN-416-1 2007-02-01
rPath rPSA-2007-0031-1 2007-02-09
Mandriva MDKSA-2007:040 2007-02-07
Red Hat RHSA-2007:0014-01 2007-01-30
Mandriva MDKSA-2007:025 2007-01-23
Fedora FEDORA-2007-058 2007-01-18
Mandriva MDKSA-2007:012 2006-01-12
Trustix TSLSA-2007-0002 2007-01-05

Comments (none posted)

krb5: uninitialized pointers

Package(s):krb5 CVE #(s):CVE-2006-6143 CVE-2006-3084
Created:January 10, 2007 Updated:July 7, 2010
Description: The kdamind daemon can, in some situations, perform operations on uninitialized pointers. This bug could conceivably open up the system to a code execution attack by an unauthenticated remote attacker, but it appears to be difficult to exploit. See this advisory for details.
Alerts:
Mandriva MDVSA-2010:129 2010-07-07
Gentoo 200701-21 2007-01-24
Ubuntu USN-408-1 2007-01-15
rPath rPSA-2007-0006-1 2007-01-11
Mandriva MDKSA-2007:008 2006-01-10
SuSE SUSE-SA:2007:004 2007-01-10
OpenPKG OpenPKG-SA-2007.006 2007-01-10
Fedora FEDORA-2007-033 2007-01-09
Fedora FEDORA-2007-034 2007-01-09

Comments (1 posted)

krb5: local privilege escalation

Package(s):krb5 CVE #(s):CVE-2006-3083
Created:August 9, 2006 Updated:July 7, 2010
Description: Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges.
Alerts:
Mandriva MDVSA-2010:129 2010-07-07
SuSE SUSE-SR:2006:022 2006-09-08
Gentoo 200608-21 2006-08-23
Ubuntu USN-334-1 2006-08-16
Fedora FEDORA-2006-905 2006-08-09
Mandriva MDKSA-2006:139 2006-09-09
Gentoo 200608-15 2006-08-10
rPath rPSA-2006-0150-1 2006-08-09
Red Hat RHSA-2006:0612-01 2006-08-08
Debian DSA-1146-1 2006-08-09

Comments (none posted)

mod_python: information disclosure

Package(s):libapache2-mod-python CVE #(s):CVE-2004-2680
Created:March 7, 2007 Updated:March 8, 2007
Description: From the Ubuntu advisory: Miles Egan discovered that mod_python, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data.
Alerts:
rPath rPSA-2007-0051-1 2007-03-07
Ubuntu USN-430-1 2007-03-06

Comments (none posted)

libgadu: memory alignment bug

Package(s):libgadu CVE #(s):CAN-2005-2370
Created:July 29, 2005 Updated:June 25, 2007
Description: Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment error in libgadu (from ekg, console Gadu Gadu client, an instant messaging program) which is included in gaim, a multi-protocol instant messaging client, as well. This can not be exploited on the x86 architecture but on others, e.g. on Sparc and lead to a bus error, in other words a denial of service.
Alerts:
Debian DSA-813-1 2005-09-15
Red Hat RHSA-2005:627-01 2005-08-09
Debian DSA-769-1 2005-07-29

Comments (none posted)

libgtop2: buffer overflow

Package(s):libgtop2 CVE #(s):CVE-2007-0235
Created:January 15, 2007 Updated:August 9, 2007
Description: The /proc parsing routines in libgtop are vulnerable to a buffer overflow. If an attacker can run a process in a specially crafted long path then trick a user into running gnome-system-monitor, arbitrary code can be executed with the user's privileges.
Alerts:
Fedora FEDORA-2007-657 2007-08-02
Red Hat RHSA-2007:0765-01 2007-08-07
Debian DSA-1255-1 2007-01-31
rPath rPSA-2007-0014-1 2007-01-23
Gentoo 200701-17 2007-01-23
Mandriva MDKSA-2007:023 2007-01-18
Ubuntu USN-407-1 2007-01-15

Comments (none posted)

libmodplug: boundary errors

Package(s):libmodplug CVE #(s):CVE-2006-4192
Created:December 11, 2006 Updated:May 4, 2011
Description: Luigi Auriemma has reported various boundary errors in load_it.cpp and a boundary error in the "CSoundFile::ReadSample()" function in sndfile.cpp. A remote attacker can entice a user to read crafted modules or ITP files, which may trigger a buffer overflow resulting in the execution of arbitrary code with the privileges of the user running the application.
Alerts:
CentOS CESA-2011:0477 2011-05-04
Red Hat RHSA-2011:0477-01 2011-05-02
Ubuntu USN-521-1 2007-09-27
Mandriva MDKSA-2007:001 2007-01-02
Gentoo 200612-04 2006-12-10

Comments (none posted)

libpng: buffer overflow

Package(s):libpng CVE #(s):CVE-2006-3334
Created:July 19, 2006 Updated:December 15, 2008
Description: In pngrutil.c, the function png_decompress_chunk() allocates insufficient space for an error message, potentially overwriting stack data, leading to a buffer overflow.
Alerts:
Gentoo 200812-15 2008-12-14
Mandriva MDKSA-2006:213 2006-11-16
rPath rPSA-2006-0133-1 2006-07-19
Gentoo 200607-06 2006-07-19

Comments (none posted)

libpng: heap based buffer overflow

Package(s):libpng CVE #(s):CVE-2006-0481
Created:February 13, 2006 Updated:December 15, 2008
Description: A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim.
Alerts:
Gentoo 200812-15 2008-12-14
Red Hat RHSA-2006:0205-01 2006-02-13

Comments (1 posted)

libtiff: buffer overflow

Package(s):libtiff CVE #(s):CVE-2006-2193
Created:June 15, 2006 Updated:September 1, 2008
Description: The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters in the DocumentName tag to overflow a buffer, causing a denial of service, and possibly the execution of arbitrary code.
Alerts:
CentOS CESA-2008:0848 2008-08-30
Red Hat RHSA-2008:0848-01 2008-08-28
Fedora FEDORA-2006-952 2006-09-05
SuSE SUSE-SA:2006:044 2006-08-01
Gentoo 200607-03 2006-07-09
SuSE SUSE-SR:2006:014 2006-06-20
Trustix TSLSA-2006-0036 2006-06-16
Mandriva MDKSA-2006:102 2006-06-14

Comments (none posted)

libvncserver: authentication bypass

Package(s):libvncserver CVE #(s):CVE-2006-2450
Created:August 4, 2006 Updated:March 19, 2007
Description: LibVNCServer fails to properly validate protocol types effectively letting users decide what protocol to use, such as "Type 1 - None". LibVNCServer will accept this security type, even if it is not offered by the server.
Alerts:
Gentoo 200703-19 2007-03-18
Gentoo 200608-12 2006-08-07
Gentoo 200608-05 2006-08-04

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):libxml2 CVE #(s):CAN-2004-0110
Created:February 26, 2004 Updated:August 19, 2009
Description: Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Fedora-Legacy FLSA:1324 2004-07-19
Conectiva CLA-2004:836 2004-03-31
Gentoo 200403-01 2004-03-06
Trustix TSLSA-2004-0010 2004-03-05
OpenPKG OpenPKG-SA-2004.003 2004-03-05
Netwosix NW-2004-0004 2004-03-04
Debian DSA-455-1 2004-03-03
Mandrake MDKSA-2004:018 2004-03-03
Red Hat RHSA-2004:091-02 2004-03-03
Whitebox WBSA-2004:090-01 2004-03-01
Red Hat RHSA-2004:090-01 2004-02-26
Fedora FEDORA-2004-087 2004-02-25
Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):libxml2 CVE #(s):CAN-2004-0989
Created:October 28, 2004 Updated:August 19, 2009
Description: libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:
Fedora FEDORA-2009-8594 2009-08-15
Fedora FEDORA-2009-8582 2009-08-15
Ubuntu USN-89-1 2005-02-28
Red Hat RHSA-2004:650-01 2004-12-16
Conectiva CLA-2004:890 2004-11-18
Red Hat RHSA-2004:615-01 2004-11-12
Mandrake MDKSA-2004:127 2004-11-04
Debian DSA-582-1 2004-11-02
Gentoo 200411-05 2004-11-02
Trustix TSLSA-2004-0055 2004-10-29
OpenPKG OpenPKG-SA-2004.050 2004-10-31
Ubuntu USN-10-1 2004-10-28
Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

lynx: arbitrary command execution

Package(s):lynx CVE #(s):CVE-2005-2929
Created:November 14, 2005 Updated:September 14, 2009
Description: An arbitrary command execute bug was found in the lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx.
Alerts:
Gentoo 200909-15 2009-09-12
Fedora-Legacy FLSA:152832 2005-12-17
OpenPKG OpenPKG-SA-2005.026 2005-12-03
Fedora FEDORA-2005-1079 2005-11-14
Fedora FEDORA-2005-1078 2005-11-14
Gentoo 200511-09 2005-11-13
Mandriva MDKSA-2005:211 2005-11-12
Red Hat RHSA-2005:839-01 2005-11-11

Comments (none posted)

mod_jk: stack overflow

Package(s):mod_jk CVE #(s):CVE-2007-0774
Created:March 5, 2007 Updated:May 30, 2007
Description: A stack overflow flaw was found in the URI handler of mod_jk. A remote attacker could visit a carefully crafted URL being handled by mod_jk and trigger this flaw, which could lead to the execution of arbitrary code as the 'apache' user.
Alerts:
Gentoo 200703-16 2007-03-16
Red Hat RHSA-2007:0096-01 2007-03-02

Comments (none posted)

mysql: format string bug

Package(s):mysql CVE #(s):CVE-2006-3469
Created:July 21, 2006 Updated:July 30, 2008
Description: Jean-David Maillefer discovered a format string bug in the date_format() function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server.
Alerts:
Red Hat RHSA-2008:0768-01 2008-07-24
Slackware SSA:2006-211-01 2006-07-31
Ubuntu USN-321-1 2006-07-21

Comments (none posted)

MySQL: privilege violations

Package(s):mysql CVE #(s):CVE-2006-4031 CVE-2006-4226
Created:August 25, 2006 Updated:July 30, 2008
Description: MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy (CVE-2006-4031).

MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions (CVE-2006-4226).

Alerts:
Red Hat RHSA-2008:0768-01 2008-07-24
Red Hat RHSA-2008:0364-01 2008-05-21
Red Hat RHSA-2007:0152-01 2007-04-03
Red Hat RHSA-2007:0083-01 2007-02-19
Fedora FEDORA-2006-1298 2006-11-27
Fedora FEDORA-2006-1297 2006-11-27
Ubuntu USN-338-1 2006-09-05
Mandriva MDKSA-2006:149 2006-08-24

Comments (none posted)

MySQL: logging bypass

Package(s):mysql CVE #(s):CVE-2006-0903
Created:April 4, 2006 Updated:May 21, 2008
Description: MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
Alerts:
Red Hat RHSA-2008:0364-01 2008-05-21
Ubuntu USN-274-2 2006-05-15
Ubuntu USN-274-1 2006-04-27
Mandriva MDKSA-2006:064 2006-04-03

Comments (2 posted)

nbd: arbitrary code execution

Package(s):nbd CVE #(s):CVE-2005-3534
Created:January 6, 2006 Updated:March 7, 2011
Description: Kurt Fitzner discovered that the NBD (network block device) server did not correctly verify the maximum size of request packets. By sending specially crafted large request packets, a remote attacker who is allowed to access the server could exploit this to execute arbitrary code with root privileges.
Alerts:
SuSE SUSE-SR:2006:001 2006-01-13
Ubuntu USN-237-1 2006-01-06

Comments (none posted)

ncompress: buffer underflow

Package(s):ncompress CVE #(s):CVE-2006-1168
Created:August 10, 2006 Updated:February 21, 2012
Description: The ncompress compression utility has a missing boundary check. A local user can use a maliciously created file to cause a a .bss buffer underflow.
Alerts:
Gentoo 200610-03 2006-10-06
Red Hat RHSA-2006:0663-01 2006-09-12
Mandriva MDKSA-2006:140 2006-08-09
Debian DSA-1149-1 2006-08-10
Red Hat RHSA-2012:0308-03 2012-02-21
Scientific Linux SL-busy-20120321 2012-03-21
Red Hat RHSA-2012:0810-04 2012-06-20
Scientific Linux SL-busy-20120709 2012-07-09
Mageia MGASA-2012-0171 2012-07-19
Mandriva MDVSA-2012:129 2012-08-10
Mandriva MDVSA-2012:129-1 2012-08-10

Comments (none posted)

openldap: security bypass

Package(s):openldap CVE #(s):CVE-2006-4600
Created:September 29, 2006 Updated:June 12, 2007
Description: slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Alerts:
Red Hat RHSA-2007:0430-01 2007-06-11
Red Hat RHSA-2007:0310-02 2007-05-01
Trustix TSLSA-2006-0055 2006-10-06
rPath rPSA-2006-0176-1 2006-09-29
Mandriva MDKSA-2006:171 2006-09-28

Comments (none posted)

OpenSSH: denial of service

Package(s):openssh CVE #(s):CVE-2006-4925 CVE-2006-5052
Created:October 6, 2006 Updated:November 15, 2007
Description: packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.

An unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."

Alerts:
Red Hat RHSA-2007:0703-02 2007-11-15
Red Hat RHSA-2007:0540-04 2007-11-07
Fedora FEDORA-2007-394 2007-04-03
Gentoo 200611-06 2006-11-13
SuSE SUSE-SA:2006:062 2006-10-20
rPath rPSA-2006-0185-1 2006-10-05

Comments (none posted)

openssh: privilege separation issue

Package(s):openssh CVE #(s):CVE-2006-5794
Created:November 8, 2006 Updated:April 5, 2007
Description: From the OpenSSH 4.5 announcement: "Fix a bug in the sshd privilege separation monitor that weakened its verification of successful authentication. This bug is not known to be exploitable in the absence of additional vulnerabilities."
Alerts:
Fedora FEDORA-2007-395 2007-04-03
Fedora FEDORA-2006-1215 2006-11-20
Fedora FEDORA-2006-1214 2006-11-20
SuSE SUSE-SR:2006:026 2006-11-17
Trustix TSLSA-2006-0063 2006-11-15
Red Hat RHSA-2006:0738-01 2006-11-15
rPath rPSA-2006-0207-1 2006-11-09
Mandriva MDKSA-2006:204 2006-11-08
OpenPKG OpenPKG-SA-2006.032 2006-11-08

Comments (none posted)

openssh: remote denial of service

Package(s):openssh CVE #(s):CVE-2006-4924 CVE-2006-5051
Created:September 27, 2006 Updated:September 17, 2008
Description: Openssh 4.4 fixes some security issues, including a pre-authentication denial of service, an unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort could be used to determine the validity of usernames on some platforms.
Alerts:
Debian DSA-1638-1 2008-09-16
Debian DSA-1212-1 2006-11-15
Fedora FEDORA-2006-1011 2006-10-03
Debian DSA-1189-1 2006-10-04
Mandriva MDKSA-2006:179 2006-10-03
Ubuntu USN-355-1 2006-10-02
OpenPKG OpenPKG-SA-2006.022 2006-10-01
Slackware SSA:2006-272-02 2006-09-29
Red Hat RHSA-2006:0698-01 2006-09-28
Red Hat RHSA-2006:0697-01 2006-09-28
Gentoo 200609-17:02 2006-09-27
rPath rPSA-2006-0174-1 2006-09-27
Gentoo 200609-17 2006-09-27

Comments (none posted)

php: several vulnerabilities

Package(s):php CVE #(s):CVE-2006-4481 CVE-2006-4484 CVE-2006-4485
Created:September 8, 2006 Updated:June 13, 2008
Description: The file_exists and imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481).

A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484).

The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).

Alerts:
SuSE SUSE-SR:2008:013 2008-06-13
Mandriva MDVSA-2008:077 2007-03-26
SuSE SUSE-SR:2008:005 2008-03-06
Red Hat RHSA-2008:0146-01 2008-02-28
Fedora FEDORA-2008-1643 2008-02-13
Foresight FLEA-2008-0007-1 2008-02-11
Fedora FEDORA-2008-1122 2008-02-05
Fedora FEDORA-2008-1131 2008-02-05
SuSE SUSE-SR:2008:003 2008-02-07
Mandriva MDVSA-2008:038 2007-02-07
rPath rPSA-2008-0046-1 2008-02-06
Gentoo 200802-01 2008-02-06
rPath rPSA-2006-0182-1 2006-10-05
SuSE SUSE-SA:2006:052 2006-09-21
Red Hat RHSA-2006:0669-01 2006-09-21
Mandriva MDKSA-2006:162 2006-09-07

Comments (1 posted)

php: multiple vulnerabilities

Package(s):php CVE #(s):CVE-2007-0906 CVE-2007-0907 CVE-2007-0908 CVE-2007-0909 CVE-2007-0910 CVE-2007-0988
Created:February 20, 2007 Updated:March 21, 2007
Description: A number of buffer overflow flaws were found in the PHP session extension, the str_replace() function, and the imap_mail_compose() function. If very long strings under the control of an attacker are passed to the str_replace() function then an integer overflow could occur in memory allocation. If a script uses the imap_mail_compose() function to create a new MIME message based on an input body from an untrusted source, it could result in a heap overflow. An attacker who is able to access a PHP application affected by any these issues could trigger these flaws and possibly execute arbitrary code as the 'apache' user. (CVE-2007-0906)

If unserializing untrusted data on 64-bit platforms, the zend_hash_init() function can be forced to enter an infinite loop, consuming CPU resources for a limited length of time, until the script timeout alarm aborts execution of the script. (CVE-2007-0988)

If the wddx extension is used to import WDDX data from an untrusted source, certain WDDX input packets may allow a random portion of heap memory to be exposed. (CVE-2007-0908)

If the odbc_result_all() function is used to display data from a database, and the contents of the database table are under the control of an attacker, a format string vulnerability is possible which could lead to the execution of arbitrary code. (CVE-2007-0909)

A one byte memory read will always occur before the beginning of a buffer, which could be triggered for example by any use of the header() function in a script. However it is unlikely that this would have any effect. (CVE-2007-0907)

Several flaws in PHP could allows attackers to "clobber" certain super-global variables via unspecified vectors. (CVE-2007-0910)

Alerts:
Gentoo 200703-21 2007-03-20
SuSE SUSE-SA:2007:020 2007-03-15
Red Hat RHSA-2007:0082-02 2007-03-14
Ubuntu USN-424-2 2007-03-08
Debian DSA-1264-1 2007-03-07
rPath rPSA-2007-0043-1 2007-02-27
Fedora FEDORA-2007-287 2007-02-26
OpenPKG OpenPKG-SA-2007.010 2007-02-23
Slackware SSA:2007-053-01 2007-02-23
Mandriva MDKSA-2007:048 2006-02-22
Red Hat RHSA-2007:0088-01 2007-02-22
Ubuntu USN-424-1 2007-02-21
Red Hat RHSA-2007:0081-01 2007-02-21
Fedora FEDORA-2007-261 2007-02-20
Red Hat RHSA-2007:0076-01 2007-02-19

Comments (none posted)

php: buffer overflows

Package(s):php CVE #(s):CVE-2006-5465
Created:November 3, 2006 Updated:January 18, 2010
Description: The Hardened-PHP Project discovered buffer overflows in htmlentities/htmlspecialchars internal routines to the PHP Project. Of course the whole purpose of these functions is to be filled with user input. (The overflow can only be when UTF-8 is used)
Alerts:
Mandriva MDVSA-2010:007 2010-01-15
SuSE SUSE-SA:2006:067 2006-11-15
rPath rPSA-2006-0205-1 2006-11-09
Red Hat RHSA-2006:0731-01 2006-11-10
Red Hat RHSA-2006:0730-01 2006-11-06
Debian DSA-1206-1 2006-11-06
Fedora FEDORA-2006-1169 2006-11-06
Fedora FEDORA-2006-1168 2006-11-06
Slackware SSA:2006-307-01 2006-11-06
OpenPKG OpenPKG-SA-2006.028 2006-11-06
Ubuntu USN-375-1 2006-11-02
Mandriva MDKSA-2006:196 2006-11-02

Comments (none posted)

phpbb2: missing input sanitizing

Package(s):phpbb2 CVE #(s):CVE-2006-1896
Created:May 22, 2006 Updated:February 11, 2008
Description: It was discovered that phpbb2, a web based bulletin board, insufficiently sanitizes values passed to the "Font Color 3" setting, which might lead to the execution of injected code by admin users.
Alerts:
Debian DSA-1066-1 2006-05-20

Comments (none posted)

phpbb2: multiple vulnerabilities

Package(s):phpbb2 CVE #(s):CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537
Created:December 22, 2005 Updated:February 11, 2008
Description: The phpbb2 web forum has a number of vulnerabilities including: a web script injection problem, a protection mechanism bypass, a security check bypass, a remote global variable bypass, cross site scripting vulnerabilities, an SQL injection vulnerability, a remote regular expression modification problem, missing input sanitizing, and a missing request validation problem.
Alerts:
Debian DSA-925-1 2005-12-22

Comments (none posted)

postgresql: insufficient verification

Package(s):postgresql CVE #(s):CVE-2007-0555 CVE-2007-0556
Created:February 5, 2007 Updated:March 19, 2007
Description: PostgreSQL has two vulnerabilities that allow an authenticated attacker with the permissions to run arbitrary SQL to launch a denial-of-service attack or possibly read out random chunks of memory. Since attacks to require authenticated access, the security hole is only considered medium risk. See announcement for additional information.
Alerts:
Gentoo 200703-15 2007-03-16
Red Hat RHSA-2007:0068-02 2007-03-14
Debian DSA-1261-1 2007-02-15
Ubuntu USN-417-3 2007-02-09
Mandriva MDKSA-2007:037-1 2007-02-08
Red Hat RHSA-2007:0067-01 2007-02-07
Red Hat RHSA-2007:0064-01 2007-02-07
rPath rPSA-2007-0025-2 2007-02-06
Ubuntu USN-417-2 2007-02-06
Mandriva MDKSA-2007:037 2006-02-06
rPath rPSA-2007-0025-1 2007-02-06
Fedora FEDORA-2007-198 2007-02-05
Fedora FEDORA-2007-197 2007-02-05
Ubuntu USN-417-1 2007-02-05

Comments (none posted)

postgresql: SQL injection

Package(s):postgresql CVE #(s):CVE-2006-2313 CVE-2006-2314
Created:May 24, 2006 Updated:June 6, 2007
Description: The PostgreSQL team has put out a set of "urgent updates" (in the form of the 7.3.15, 7.4.13, 8.0.8, and 8.1.4 releases) closing a newly-discovered set of SQL injection issues. Details about the problem can be found on the technical information page; in short: multi-byte encodings can be used to defeat normal string sanitizing techniques. The update fixes one problem related to invalid multi-byte characters, but punts on another by simply disallowing the old, unsafe technique of escaping single quotes with a backslash.
Alerts:
Fedora FEDORA-2007-0249 2007-06-06
Trustix TSLSA-2006-0059 2006-10-27
Gentoo 200607-04 2006-07-09
SuSE SUSE-SA:2006:030 2006-06-09
Ubuntu USN-288-3 2006-06-09
Ubuntu USN-288-2 2006-06-09
Mandriva MDKSA-2006:098 2006-06-07
Debian DSA-1087-1 2006-06-03
Ubuntu USN-288-1 2006-05-29
rPath rPSA-2006-0080-1 2006-05-24
Red Hat RHSA-2006:0526-02 2006-05-23
Fedora FEDORA-2006-578 2006-05-23
Fedora FEDORA-2006-579 2006-05-23

Comments (1 posted)

quake: buffer overflow

Package(s):quake3-bin CVE #(s):CVE-2006-2236
Created:May 10, 2006 Updated:January 12, 2009
Description: Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server.
Alerts:
Gentoo 200901-06 2009-01-11
Gentoo 200605-12 2006-05-10

Comments (none posted)

rpm: arbitrary code execution

Package(s):rpm CVE #(s):CVE-2006-5466
Created:November 6, 2006 Updated:August 28, 2007
Description: An error was found in the RPM library's handling of query reports. In some locales, certain RPM packages would cause the library to crash. If a user was tricked into querying a specially crafted RPM package, the flaw could be exploited to execute arbitrary code with the user's privileges.
Alerts:
Fedora FEDORA-2007-668 2007-08-27
Gentoo 200611-08 2006-11-13
Mandriva MDKSA-2006:200 2006-11-07
Ubuntu USN-378-1 2006-11-04

Comments (none posted)

samba: several vulnerabilities

Package(s):samba CVE #(s):CVE-2007-0452 CVE-2007-0453 CVE-2007-0454
Created:February 6, 2007 Updated:March 14, 2007
Description: Three vulnerabilities have been fixed in Samba 3.0.24: a potential denial of service bug, a buffer overrun in the NSS host lookup Winbind library on Solaris and a format string bug in the afsacl.so VFS plugin.
Alerts:
Red Hat RHSA-2007:0061-02 2007-03-14
Red Hat RHSA-2007:0060-01 2007-02-15
SuSE SUSE-SA:2007:016 2007-02-15
Gentoo 200702-01 2007-02-13
Fedora FEDORA-2007-220 2007-02-08
Fedora FEDORA-2007-219 2007-02-08
Slackware SSA:2007-038-01 2007-02-07
Ubuntu USN-419-1 2007-02-06
rPath rPSA-2007-0026-1 2007-02-07
Mandriva MDKSA-2007:034 2006-02-05
Debian DSA-1257-1 2007-02-05

Comments (none posted)

Mozilla: multiple vulnerabilities

Package(s):seamonkey firefox thunderbird CVE #(s):CVE-2006-6077 CVE-2007-0008 CVE-2007-0009 CVE-2007-0775 CVE-2007-0777 CVE-2007-0778 CVE-2007-0779 CVE-2007-0780 CVE-2007-0800 CVE-2007-0981 CVE-2007-0995 CVE-2007-0996
Created:February 26, 2007 Updated:July 23, 2007
Description: Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A malicious web page could execute JavaScript code in such a way that may result in SeaMonkey crashing or executing arbitrary code as the user running SeaMonkey. (CVE-2007-0775, CVE-2007-0777)

Several cross-site scripting (XSS) flaws were found in the way SeaMonkey processed certain malformed web pages. A malicious web page could display misleading information which may result in a user unknowingly divulging sensitive information such as a password. (CVE-2006-6077, CVE-2007-0995, CVE-2007-0996)

A flaw was found in the way SeaMonkey cached web pages on the local disk. A malicious web page may be able to inject arbitrary HTML into a browsing session if the user reloads a targeted site. (CVE-2007-0778)

A flaw was found in the way SeaMonkey displayed certain web content. A malicious web page could generate content which could overlay user interface elements such as the hostname and security indicators, tricking a user into thinking they are visiting a different site. (CVE-2007-0779)

Two flaws were found in the way SeaMonkey displayed blocked popup windows. If a user can be convinced to open a blocked popup, it is possible to read arbitrary local files, or conduct an XSS attack against the user. (CVE-2007-0780, CVE-2007-0800)

Two buffer overflow flaws were found in the Network Security Services (NSS) code for processing the SSLv2 protocol. Connecting to a malicious secure web server could cause the execution of arbitrary code as the user running SeaMonkey. (CVE-2007-0008, CVE-2007-0009)

A flaw was found in the way SeaMonkey handled the "location.hostname" value during certain browser domain checks. This flaw could allow a malicious web site to set domain cookies for an arbitrary site, or possibly perform an XSS attack. (CVE-2007-0981)

Alerts:
Debian DSA-1336-1 2007-07-22
Slackware SSA:2007-085-01 2007-03-26
Gentoo 200703-22 2007-03-20
SuSE SUSE-SA:2007:022 2007-03-20
Gentoo 200703-18 2007-03-18
Red Hat RHSA-2007:0108-02 2007-03-14
Red Hat RHSA-2007:0097-02 2007-03-14
Gentoo 200703-08 2007-03-09
Slackware SSA:2007-066-03 2007-03-08
Slackware SSA:2007-066-04 2007-03-08
Slackware SSA:2007-066-05 2007-03-08
Ubuntu USN-431-1 2007-03-07
Mandriva MDKSA-2007:052 2007-03-06
SuSE SUSE-SA:2007:019 2007-03-06
Fedora FEDORA-2007-309 2007-03-05
Fedora FEDORA-2007-308 2007-03-05
rPath rPSA-2007-0040-3 2007-02-26
Gentoo 200703-05 2007-03-03
Gentoo 200703-04 2007-03-02
Mandriva MDKSA-2007:050-1 2007-03-02
Red Hat RHSA-2007:0078-01 2007-03-02
Ubuntu USN-428-2 2007-03-02
Mandriva MDKSA-2007:050 2007-02-28
Ubuntu USN-428-1 2007-02-26
Fedora FEDORA-2007-293 2007-02-27
Fedora FEDORA-2007-293 2007-02-27
Fedora FEDORA-2007-293 2007-02-27
Fedora FEDORA-2007-293 2007-02-27
Fedora FEDORA-2007-293 2007-02-27
Fedora FEDORA-2007-279 2007-02-26
Fedora FEDORA-2007-279 2007-02-26
Fedora FEDORA-2007-289 2007-02-26
Fedora FEDORA-2007-289 2007-02-26
Fedora FEDORA-2007-289 2007-02-26
Fedora FEDORA-2007-289 2007-02-26
Fedora FEDORA-2007-281 2007-02-26
Fedora FEDORA-2007-278 2007-02-26
Fedora FEDORA-2007-278 2007-02-26
rPath rPSA-2007-0040-1 2007-02-26
Red Hat RHSA-2007:0079-01 2007-02-23
Red Hat RHSA-2007:0077-01 2007-02-23

Comments (1 posted)

shadow-utils: mailbox creation vulnerability

Package(s):shadow-utils CVE #(s):CVE-2006-1174
Created:May 25, 2006 Updated:June 12, 2007
Description: The useradd tool from the shadow-utils package has a potential security problem. When a new user's mailbox is created, the permissions are set to random garbage from the stack, potentially allowing the file to be read or written during the time before fchmod() is called.
Alerts:
Red Hat RHSA-2007:0431-01 2007-06-11
rPath rPSA-2007-0096-1 2007-05-11
Red Hat RHSA-2007:0276-02 2007-05-01
Gentoo 200606-02 2006-06-07
Mandriva MDKSA-2006:090 2006-05-24

Comments (none posted)

slocate: information disclosure

Package(s):slocate CVE #(s):CVE-2007-0227
Created:February 22, 2007 Updated:September 4, 2012
Description: The slocate permission checking code has a local information disclosure vulnerability. During the reporting of matching files, slocate does not respect the parent directory's read permissions, resulting in hidden filenames being viewable by other local users.
Alerts:
Foresight FLEA-2007-0005-1 2007-03-29
Ubuntu USN-425-1 2007-02-22
Slackware SSA:2012-244-05 2012-08-31

Comments (none posted)

smb4k: multiple vulnerabilities

Package(s):smb4k CVE #(s):CVE-2007-0472 CVE-2007-0473 CVE-2007-0474 CVE-2007-0475
Created:February 13, 2007 Updated:March 12, 2007
Description: The Smb4K 0.8.0 release announcement notes that several security weaknesses in the utility programs (stack overflows / the use of strcpy instead of strncpy / a design error in smb4k_kill) and in the Smb4KFileIO class (use of mktemp instead of mkstemp for creation of the temporary files which could lead to both a race and an information leak / a race in the code that handles the lock file). Fixes for all of these issues are included in Smb4K 0.8.0 and in the patches that have been prepared for Smb4K 0.7.5 and 0.6.10a. Other versions are not supported anymore.
Alerts:
Gentoo 200703-09 2007-03-09
Mandriva MDKSA-2007:042 2007-02-12

Comments (none posted)

snort: remote arbitrary code execution

Package(s):snort CVE #(s):CVE-2006-5276
Created:March 2, 2007 Updated:September 7, 2007
Description: The Snort intrusion detection system is vulnerable to a buffer overflow in the DCE/RPC preprocessor code. Remote attackers can send specially crafted fragmented SMB or DCE/RPC packets which can be used to allow the the remote execution of arbitrary code.
Alerts:
Fedora FEDORA-2007-2060 2007-09-07
Gentoo 200703-01:02 2007-02-23
Gentoo 200703-01 2007-02-23

Comments (1 posted)

spamassassin: denial of service

Package(s):spamassassin CVE #(s):CVE-2007-0451
Created:February 16, 2007 Updated:March 14, 2007
Description: Version 3.1.8 of Spamassassin fixes some bugs and a malformed HTML denial of service vulnerability.
Alerts:
Red Hat RHSA-2007:0075-02 2007-03-14
Gentoo 200703-02 2007-03-02
Mandriva MDKSA-2007:049 2007-02-23
rPath rPSA-2007-0038-1 2007-02-23
Red Hat RHSA-2007:0074-01 2007-02-21
Fedora FEDORA-2007-242 2007-02-15
Fedora FEDORA-2007-241 2007-02-15

Comments (none posted)

STLport: buffer overflows

Package(s):STLport CVE #(s):CVE-2007-0803
Created:March 7, 2007 Updated:March 7, 2007
Description: STLport (prior to version 5.0.3) suffers from two remotely exploitable buffer overflows.
Alerts:
Gentoo 200703-07 2007-03-06

Comments (none posted)

sun-jdk: arbitrary code execution

Package(s):sun-jdk CVE #(s):CVE-2007-0243
Created:February 19, 2007 Updated:April 25, 2007
Description: A anonymous researcher discovered that an error in the handling of a GIF image with a zero width field block leads to a memory corruption flaw. An attacker could entice a user to run a specially crafted Java applet or application that would load a crafted GIF image, which could result in escalation of privileges and unauthorized access to system resources.
Alerts:
Red Hat RHSA-2007:0167-01 2007-04-25
Red Hat RHSA-2007:0166-01 2007-04-25
Gentoo 200702-08 2007-02-17
Gentoo 200702-07 2007-02-17

Comments (1 posted)

tcpdump: denial of service

Package(s):tcpdump CVE #(s):CVE-2007-1218
Created:March 5, 2007 Updated:November 15, 2007
Description: Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.
Alerts:
Red Hat RHSA-2007:0387-02 2007-11-15
Mandriva MDKSA-2007:155 2007-08-09
Debian DSA-1272-1 2007-03-22
Fedora FEDORA-2007-348 2007-03-15
Fedora FEDORA-2007-347 2007-03-15
Mandriva MDKSA-2007:056 2006-03-08
Ubuntu USN-429-1 2007-03-06
rPath rPSA-2007-0048-1 2007-03-03

Comments (none posted)

ulogd: buffer overflow

Package(s):ulogd CVE #(s):CVE-2007-0460
Created:January 29, 2007 Updated:March 19, 2007
Description: A buffer overflow in ulogd has an unknown impact and attack vectors related to "improper string length calculations."
Alerts:
Gentoo 200703-17 2007-03-18
Mandriva MDKSA-2007:028 2007-01-26

Comments (none posted)

unzip: long file name buffer overflow

Package(s):unzip CVE #(s):CVE-2005-4667
Created:February 6, 2006 Updated:May 2, 2007
Description: A buffer overflow in UnZip 5.50 and earlier allows local users to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Alerts:
Red Hat RHSA-2007:0203-02 2007-05-01
Fedora-Legacy FLSA:180159 2006-04-04
Debian DSA-1012-1 2006-03-21
Mandriva MDKSA-2006:050 2006-02-27
Ubuntu USN-248-2 2006-02-15
Ubuntu USN-248-1 2006-02-13
Fedora FEDORA-2006-098 2006-02-06

Comments (1 posted)

util-linux: information disclosure

Package(s):util-linux CVE #(s):CVE-2007-0822
Created:March 7, 2007 Updated:March 7, 2007
Description: Users can confuse util-linux by way of removable drives, leading to crashes and the possibility of information disclosure via the resulting core dumps.
Alerts:
Mandriva MDKSA-2007:053 2006-03-06

Comments (1 posted)

w3c-libwww: possible stack overflow

Package(s):w3c-libwww CVE #(s):CVE-2005-3183
Created:October 14, 2005 Updated:May 2, 2007
Description: xtensive testing of libwww's handling of multipart/byteranges content from HTTP/1.1 servers revealed multiple logical flaws and bugs in Library/src/HTBound.c
Alerts:
Red Hat RHSA-2007:0208-02 2007-05-01
Ubuntu USN-220-1 2005-12-01
Mandriva MDKSA-2005:210 2005-11-09
Fedora FEDORA-2005-953 2005-10-07
Fedora FEDORA-2005-952 2005-10-07

Comments (1 posted)

wireshark: multiple vulnerabilities

Package(s):wireshark CVE #(s):CVE-2007-0456 CVE-2007-0457 CVE-2007-0458 CVE-2007-0459
Created:February 5, 2007 Updated:March 14, 2007
Description: There are multiple problems in Wireshark versions 0.10.14 to 0.99.4.
Alerts:
Red Hat RHSA-2007:0066-01 2007-03-14
Fedora FEDORA-2007-216 2007-02-08
Fedora FEDORA-2007-207 2007-02-06
rPath rPSA-2007-0023-1 2007-02-03
Mandriva MDKSA-2007:033 2007-02-02

Comments (6 posted)

wordpress: cross-site scripting

Package(s):wordpress CVE #(s):CVE-2007-1049
Created:March 5, 2007 Updated:March 21, 2007
Description: A Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Alerts:
Gentoo 200703-23 2007-03-20
Debian-Testing DTSA-34-1 2007-03-03

Comments (none posted)

xine: format string vulnerabilities

Package(s):xine CVE #(s):CVE-2007-0017
Created:January 23, 2007 Updated:August 10, 2007
Description: Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.
Alerts:
Mandriva MDKSA-2007:154 2007-08-09
Debian DSA-1252-1 2007-01-27
Mandriva MDKSA-2007:027 2007-01-26
Gentoo 200701-24 2007-01-26
SuSE SUSE-SA:2007:013 2007-01-23

Comments (none posted)

xine-lib: buffer overflow

Package(s):xine-lib CVE #(s):CVE-2006-6172
Created:December 5, 2006 Updated:June 5, 2007
Description: A buffer overflow was discovered in the Real Media input plugin in xine-lib. If a user were tricked into loading a specially crafted stream from a malicious server, the attacker could execute arbitrary code with the user's privileges.
Alerts:
Mandriva MDKSA-2007:112 2007-06-04
Gentoo 200702-11 2007-02-27
Debian DSA-1244-1 2006-12-28
Gentoo 200612-02 2006-12-09
SuSE SUSE-SR:2006:028 2006-12-08
Mandriva MDKSA-2006:224 2006-12-05
Ubuntu USN-392-1 2006-12-04

Comments (none posted)

xine-lib: buffer overflow

Package(s):xine-lib CVE #(s):CVE-2006-1664
Created:April 27, 2006 Updated:February 27, 2008
Description: xine-lib does an improper input data boundary check on MPEG streams. A specially crafted MPEG file can be created that can cause arbitrary code execution when the file is accessed.
Alerts:
Gentoo 200802-12 2008-02-26
Gentoo 200604-16 2006-04-26

Comments (none posted)

xinit: race condition

Package(s):xinit CVE #(s):CVE-2006-5214
Created:October 17, 2006 Updated:August 9, 2007
Description: A race condition allows local users to see error messages generated during another user's X session. This could allow potentially sensitive information to be leaked.
Alerts:
Fedora FEDORA-2007-659 2007-08-08
Fedora FEDORA-2007-1409 2007-08-02
Ubuntu USN-364-1 2006-10-16

Comments (1 posted)

X.org: local privilege escalations

Package(s):xorg-x11 CVE #(s):CVE-2006-4447
Created:August 28, 2006 Updated:April 30, 2007
Description: Several X.org libraries and X.org itself contain system calls to set*uid() functions, without checking their result. Local users could deliberately exceed their assigned resource limits and elevate their privileges after an unsuccessful set*uid() system call. This requires resource limits to be enabled on the machine.
Alerts:
Gentoo 200704-22 2007-04-27
Mandriva MDKSA-2006:160 2006-08-31
Gentoo 200608-25 2006-08-28

Comments (none posted)

X.org: integer overflows

Package(s):xorg, xorg-server CVE #(s):CVE-2006-6101 CVE-2006-6102 CVE-2006-6103
Created:January 10, 2007 Updated:March 8, 2007
Description: A number of integer overflows have turned up in the X.org server. Some of these overflows involve calls to alloca(), and thus make corruption of the stack relatively easy. This vulnerability is exploitable by anybody who can make a connection to the server, meaning that it is a local root exploit in most settings. See this advisory for details.
Alerts:
Slackware SSA:2007-066-02 2007-03-08
Gentoo 200701-25 2007-01-27
Debian DSA-1249-1 2007-01-15
SuSE SUSE-SA:2007:008 2007-01-12
rPath rPSA-2007-0005-1 2007-01-09
Red Hat RHSA-2007:0002-01 2007-01-10
Red Hat RHSA-2007:0003-01 2007-01-10
Mandriva MDKSA-2007-005 2007-01-09
Fedora FEDORA-2007-035 2007-01-09
Fedora FEDORA-2007-036 2007-01-09
Ubuntu USN-403-1 2007-01-09

Comments (none posted)

xpdf: buffer overflow

Package(s):xpdf CVE #(s):CAN-2005-0064
Created:January 19, 2005 Updated:March 15, 2007
Description: iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details.
Alerts:
Fedora FEDORA-2007-1219 2007-03-14
Gentoo 200506-06 2005-06-09
Red Hat RHSA-2005:026-01 2005-03-16
Red Hat RHSA-2005:066-01 2005-02-15
Red Hat RHSA-2005:057-01 2005-02-15
Red Hat RHSA-2005:053-01 2005-02-15
Red Hat RHSA-2005:034-01 2005-02-15
Fedora-Legacy FLSA:2353 2005-02-10
Fedora-Legacy FLSA:2352 2005-02-10
Gentoo 200502-10 2005-02-09
Red Hat RHSA-2005:049-01 2005-02-01
SuSE SUSE-SR:2005:002 2005-01-26
Red Hat RHSA-2005:059-01 2005-01-26
Mandrake MDKSA-2005:020 2005-01-25
Mandrake MDKSA-2005:019 2005-01-25
Mandrake MDKSA-2005:016 2005-01-25
Mandrake MDKSA-2005:021 2005-01-25
Mandrake MDKSA-2005:018 2005-01-25
Mandrake MDKSA-2005:017 2005-01-25
Fedora FEDORA-2005-061 2005-01-25
Fedora FEDORA-2005-062 2005-01-25
Fedora FEDORA-2005-059 2005-01-25
Fedora FEDORA-2005-060 2005-01-25
Conectiva CLA-2005:921 2005-01-25
Fedora FEDORA-2004-049 2005-01-24
Fedora FEDORA-2004-048 2005-01-24
Gentoo 200501-32 2005-01-23
Gentoo 200501-31 2005-01-23
Gentoo 200501-30 2005-01-22
Gentoo 200501-28 2005-01-21
Fedora FEDORA-2005-052 2005-01-20
Fedora FEDORA-2005-051 2005-01-20
Ubuntu USN-64-1 2005-01-19
Debian DSA-645-1 2005-01-19
Debian DSA-648-1 2005-01-19

Comments (1 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch remains 2.6.21-rc3. About 250 patches have found their way into the mainline repository since -rc3 was released; -rc4 will likely come out shortly after LWN is published this week.

There are two current -mm trees, differing only in their inclusion of one patch set: 2.6.21-rc3-mm1 (which includes the RSDL scheduler) and 2.6.21-rc3-mm2 (which does not).

The current stable 2.6 kernel is 2.6.20.3, released on March 13 with a couple dozen fixes. 2.6.20.2 was released on March 9 with a full 100 patches.

For older kernels: 2.6.16.43 was released on March 8. 2.6.16.44-rc1 is out with a number of fixes, including a couple of security patches.

Comments (2 posted)

Kernel development news

Quotes of the week

-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0])		      \
+	+ sizeof(typeof(int[1 - 2*!!__builtin_types_compatible_p(typeof(arr), \
+		 typeof(&arr[0]))]))*0)

-- Rusty Russell

Rusty, that's a work of art.

However, I would suggest that you never show it to anybody ever again. I'm sure that in fifty years, it will be worth much more. So please keep it tightly under wraps, to keep people from gouging their eyes out^W^W^W^W^W^W^W make a killing in the art market.

-- Linus Torvalds

Comments (30 posted)

Kernel events without kevents

The long story of the kevent subsystem has appeared on this page a number of times. Kevents are designed to give applications a single system call which they can use to wait for any events of interest: I/O, timers, signals, and more. While quite a bit of work has been done on this code, its path into the kernel has been long. A number of developers are still unconvinced that the interface is needed, and, if it is, that the proposed kevent API (which would have to be maintained forever) is the right one. Now there is a competing approach which may prove easier for the community to accept.

Davide Libenzi is the creator of the epoll_wait() system call; it is a version of poll() which is intended to be scalable to large numbers of file descriptors. This API seems to be well regarded for what it does, but it is limited to waiting on file descriptors. Many of the things that kevents address are not associated with files, and so cannot be handled through the epoll interface.

Kevents fix that shortcoming with the creation of a new subsystem and user-space API. Davide has now shown up with a different strategy: make a way for applications to request delivery of events via a file descriptor. Consider, for example, the case of signals. Signals tend to be tricky for applications to handle; they are asynchronous events which are delivered to a special signal handler function, but that function is seriously limited in what it can do. In response, application developers have resorted to tricks like writing a byte to an internal pipe so that the signal can be handled in the main event loop.

Davide has proposed a new system call named signalfd() which can help developers avoid much of the hassle of working with signals:

    int signalfd(int ufd, const sigset_t *mask, size_t masksize);

If ufd is -1, this call will create (and return) a new file descriptor. The signals described in mask will be caught and returned to the process by way of that file descriptor. It is pollable, allowing signals to be handled in an event loop based on select(), poll() or epoll_wait(). When signals are available, they can be read from the descriptor as data; the signalfd_siginfo structure returned by read() has the signal number and all of the related information that comes with it.

If ufd is set to an existing signal file descriptor, the signalfd() call will change to the new mask. It is worth noting that reading from this file descriptor competes with normal signal delivery for queued signals; there is no way to predict whether the signal will be delivered in the usual way or will be read from the file descriptor. This situation can be avoided by using sigprocmask() to block normal delivery of the signal(s) of interest.

There is a similar interface for timer events:

    int timerfd(int ufd, int clockid, int timertype, 
                const struct timespec *when);

Once again, ufd is -1 to create a new file descriptor, or an existing timer file descriptor which is to be modified. The clockid parameter describes which clock is wanted: CLOCK_MONOTONIC or CLOCK_REALTIME. The type of timer is described by timertype: TFD_TIMER_REL for a time relative to the current time, TFD_TIMER_ABS for an absolute time, or TFD_TIMER_SEQ for a repeating timer at a given interval. The when structure contains the requested expiration time.

Once again, this file descriptor can be polled. Reading from it yields an integer value saying how many times the timer has fired since the last time it was read.

Evgeniy Polyakov, the author of the kevent patches, has not been sitting still while these patches have gone around. His proposal is called eventfs; it is a special filesystem which offers the ability to bind events to file descriptors. The first version of the patch only handles signals, via a system call named (yes) signalfd():

    int signalfd(int signal, int flags);

This call creates a new file descriptor for the given signal (a separate file descriptor is required for each signal in this scheme). In the current code, if flags is nonzero, the signal will only be delivered through eventfs and will never go into the signal queue. The file descriptor is pollable, but there is no way to read any information from it. So any associated signal information is lost; multiple deliveries of the same signal between polls will also be lost.

One assumes that Evgeniy's patches could be improved over time, but Davide's version seems to be ahead in terms of features, coverage, and community review. Davide has also avoided the need to create a new filesystem to back the whole thing up. So if bets were being taken on which approach might make it into the kernel, Davide would seem to be in the lead at the moment.

There are certainly things to be said for this approach. It brings Linux toward a single interface for event delivery without the need for a new, complex API. It also reinforces the role of the file descriptor as a fundamental object for interaction with the kernel. On the other hand, the poll interfaces do not provide a way for applications to receive events without the need to call into the kernel - a feature which has been requested by some interested parties. There are also event types (asynchronous I/O completion, for example) which are not yet covered. So, if things do go this way, it would not be surprising to see patches trying to fill in those gaps in the near future.

Comments (39 posted)

paravirt_ops considered harmful?

As flame wars go, this one was somewhat more technical and inscrutable than most. It was, however, still a flame war. The core issue was this: is the addition of the paravirt_ops layer, now beginning to be used to support running Linux under hypervisors, a good thing or a long-term maintenance disaster for the Linux kernel?

It all started with a patch added to the -mm tree; it seems that some work on the new clockevents code broke the VMI virtualization layer. So the developers at VMware put together a fix, but that fix did not sit well with the core clockevents developers. In their view, it took much of the older time-related code, which they had worked so hard to get rid of, and shoved it back under the VMI layer. Thomas Gleixner did not like this solution:

This is ugly as hell. NO_HZ enables the dyntick functions in idle(), irq_enter() and irq_exit() so the clockevents code is actually invoked. I have not looked close enough why this does work at all. I have the feeling that "working fine" means something like "does not explode".

The right solution, according to Thomas, is for all of the people who are working on hypervisors and Linux to get together and come up with a single timer interface based on clockevents. This should not be all that hard of a job, in his opinion. The VMI hackers may well be willing to do that over time, but they don't see that as something which can be done in the near future. Their current code works, and, besides, they are on the verge of a product release and would rather not thrash things up at this time.

"On the verge of a product release" is not an excuse which flies far on linux-kernel. This is doubly true in this case, where some of the people involved feel that the VMI developers should have seen clockevents coming and developed for that interface over the last year. They see the current VMI timer code as being the beginning of a long-term maintenance nightmare.

Ingo Molnar widened the discussion to the problems he sees with paravirt_ops in general. The posting is long, but the core point seems to be this: every hypervisor connection implemented with paravirt_ops becomes an ABI that the kernel must then maintain forever. The paravirt_ops interface itself is supposed to insulate the kernel from changes, and that API can change. But each hypervisor interface done through paravirt_ops must continue to work into the future, meaning that certain sorts of fundamental design changes cannot be made. Maintaining compatibility with several hypervisors will be hard, and Ingo sees bad things when one inevitably breaks:

And it doesn't matter whether we think that it was VMWare who messed up. Users/customers _will_ blame us: "v2.6.25 regresses, it wont run under ESX v1.12 anymore". Distro will yield and will undo whatever change breaks backwards compatibility with older hypervisors. (most likely it will be undone upstream already) Backwards compatibility acts as a very heavy barrier against certain types of paravirt_ops design changes.

There have not been a whole lot of others supporting this point of view, though. The current abuses are seen as things which can be fixed, people seem to be sanguine about the ability to maintain compatibility in the paravirt_ops interface code, and, most likely, many people simply tune out of virtualization discussions. Linus suggests that Ingo point out specific problems (and fix them if he desires) rather than complaining about general problems. Ingo's response is that hypervisor interfaces should be treated like system calls, and added with the same degree of care and deliberation.

In the end, it is not clear that anything will change. There is a high level of interest in getting hypervisor support into the kernel, and that process is unlikely to stop. So expect to see some more serious squabbles about what is done in hypervisor interfaces in the future. If we are lucky, that process, while noisy, will result in the evolution of the paravirt_ops code toward something which proves to be maintainable over the long term.

Comments (none posted)

RSDL hits a snag

In last week's episode, the Rotating Staircase Deadline Scheduler (RSDL) had appeared out of the blue and was busily impressing testers left and right. One person even called for it to go straight into 2.6.21. In reality, the replacement of something as fundamental as the CPU scheduler was never going to be an entirely smooth operation. So it's not all that surprising that the RSDL has run into an obstacle or two.

The biggest snag would appear to be this workload reported by Mike Galbraith. Mike is trying to run some CPU hogs (MP3 encoding, in particular) in the background while watching some interactive eye candy. It's a load that works with the current scheduler, but it becomes sluggish when running under RSDL. There have been a couple of other reports of a visible interactive slowdown when serious computation is going on - though others have reported better results.

There is little surprise in the appearance of behavioral regressions for certain workloads. Few people would have expected RSDL to be perfect within a week of its first posting. The real difficulty, instead, is that RSDL creator Con Kolivas has reacted in a somewhat defensive manner, refusing to see the behavior as a regression:

Your expectations of what you should be able to do are simply skewed. Find what cpu balance you loved in the old one (and I believe it wasn't that much more cpu in favour of X if I recall correctly) and simply change the nice setting on your lame encoder - since you're already setting one anyway.

We simply cannot continue arguing that we should dish out unfairness in any manner any more. It will always come back and bite us where we don't want it. We are getting good interactive response with a fair scheduler yet you seem intent on overloading it to find fault with it.

Con's position is that the scheduler should strive to provide fairness and low latency; any further expectations about interactive response should then be addressed by playing with nice levels. The interactivity estimator built into the current scheduler is just too difficult to work with; the kernel should not be in that particular business. The problem is that this approach conflicts with how Linux users have come to expect things to work.

As soon as one looks at improving RSDL for these situations, one gets into the same old discussions on improving interactive response in general. Linus pointed out that RSDL's way of scheduling is not quite as fair as it could be, since it does not always account for work in the right place:

And the problem is that a lot of clients actually end up doing *more* in the X server than they do themselves directly. Doing things like showing a line of text on the screen is a lot more expensive than just keeping track of that line of text, so you end up with the X server easily being marked as getting "too much" CPU time, and the clients as being starved for CPU time. And then you get bad interactive behaviour.

There are a couple of ways of handling problems like this. One is to just favor the X server, either by somehow marking it as the core of interactive behavior or by simply raising its priority. Con has been in favor of the latter approach; to that end, he has posted a separate patch which is aimed at improving latencies for all processes, even when they are not all running at the same priority levels. There have not been any follow-up results reported as of this writing.

This difficulty may well not keep RSDL out of the mainline kernel. The advantages inherent in dumping the interactivity heuristics are large, and RSDL does seem to improve life for a number of users. Noticeable performance regressions for some workloads are a problem, though; nobody wants to field a bunch of "2.6.x turned my response to crap" messages from unhappy users. So expect some iterations on this project yet - and, perhaps, an additional kernel cycle or two before it can be merged.

Comments (13 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

Filesystems and block I/O

Memory management

Networking

Architecture-specific

Security-related

Virtualization and containers

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

CentOS

The CentOS development team has announced the first beta release of CentOS 5 for i386 and x86_64. See the release notes for more information about the beta.

According to the CentOS website, "CentOS is an Enterprise-class Linux Distribution derived from sources freely provided to the public by a prominent North American Enterprise Linux vendor. CentOS conforms fully with the upstream vendors redistribution policy and aims to be 100% binary compatible. (CentOS mainly changes packages to remove upstream vendor branding and artwork.) CentOS is free."

The prominent North American vendor is Red Hat, but the Red Hat legal department defends the Red Hat trademarks and requires that all mention of that trademarked name be absent from the CentOS site and software. However, it's no coincidence that CentOS releases follow closely after those prominent EL releases.

Of the various EL clones that showed up a few years ago, CentOS has done an exceptional job of attracting developers and users and keeping up with its upstream parent. Security advisories are posted regularly to the centos-announce mailing list.

CentOS supports i386 and x86_64 hardware and there are mailing lists available in English, Czech, German, Spanish, French, Dutch and Brazilian Portuguese.

Looking down the road a ways it looks like there is some possibility for collaboration between Fedora and CentOS. See this thread on centos-devel which looks at the Fedora EPEL (Extra Packages for Enterprise Linux) project. This project is still quite young but some packages are available for download and testing. The epel-devel-list is available for EPEL development discussion.

Comments (none posted)

New Releases

Mandriva Corporate Desktop 4.0: The desktop you were waiting for

Mandriva has announced the launch of the beta program for Corporate Desktop 4.0. "Ergonomic, secure, comprehensive, easy to use and to administer: by consulting its corporate clients and by exploiting its experience in the desktop area, Mandriva developed Corporate Desktop 4.0, a distribution that can be installed in less than 10 minutes and extensively customized thanks to a new post-installation tool."

Full Story (comments: none)

RHEL 5 released

It's official: Red Hat Enterprise Linux 5 is available. See the list of features to learn more about what's new.

Comments (3 posted)

Distribution News

The new Debian etch release schedule

There is an update from the Debian release team: "You might not remember who the release team is, but we still want to inform you about the final leg of the etch release cycle. Our original schedule did not work out due to problems with the kernel and the slower than expected reduction of release critical bugs." The new schedule calls for some aggressive bug fixing and a final release at the beginning of April.

Full Story (comments: 6)

Debian Votes

The Debian Project Leader election is still in the campaigning period. The IRC debate was held recently and the logs have been posted.

Debian developers have until March 18 to vote on this General Resolution. "The Debian project resolves that Debian developers allowed to perform combined source and binary packages uploads should be allowed to perform binary-only packages uploads for the same set of architectures."

Comments (none posted)

Alioth goes Mercurial

Debian's Alioth team has announced the availability of Mercurial for source control. "Alioth can now host your Mercurial repositories in pretty much the same way as it can host your CVS, Subversion, Arch/Bazaar, Bzr and Git repositories."

Full Story (comments: none)

Gentoo fights flamewars and bad behaviour!

The Gentoo Council has drafted a new Code of Conduct that will be enforced for both developers and users. The draft version of the Code of Conduct is currently being discussed on the Gentoo-dev mailing list. "The Code of Conduct will be voted upon by the Gentoo Council Thursday, March 15th; implementation will be immediate upon final approval. The Code of Conduct describes what the Gentoo Council has deemed acceptable and unacceptable behavior. It also describes the punishment that will be enforced if the Code of Conduct is breached."

Full Story (comments: 1)

SUSE Linux 9.3 security support discontinued soon

SUSE Security has announced that SUSE Linux 9.3 will be discontinued soon. "Having provided security-relevant fixes for more than two years, vulnerabilities found in SUSE Linux 9.3 after April 15th 2007 will not be fixed any more for this product. We expect to release the last updates around April 30th 2007."

Full Story (comments: 5)

Ubuntu beta freeze imminent

The Ubuntu beta freeze is scheduled for March 15, with the beta release happening one week after on March 22.

Full Story (comments: none)

Google Summer of Code 2007

Several distributions have announced that they will be participating in the 2007 Summer of Code. Debian is looking for proposal ideas and mentors and has two wiki pages set up collect them. Mandriva has this announcement with links to a wiki page for ideas and another page for mentors. Ubuntu is also participating and looking for project ideas, mentors and students.

Comments (none posted)

New Distributions

pg_live announcement

Pg_live is a free Linux Live CD community project. It is an enhanced adaptation of one of the Ubuntu family of distributions, known as Xubuntu, and has been designed and optimized expressly for the PostgreSQL Database administrator and enthusiast.

Full Story (comments: none)

Distribution Newsletters

Debian Weekly News - March 13th, 2007

The Debian Weekly News for March 13, 2007 covers spring list cleaning, GIF patent has expired, Second Life runs on Debian servers, the release status of the Motorola 680x0 port, handling of inactive Debian accounts, One Laptop per Child Software on Debian, Google's Summer of Code 2007, and much more.

Full Story (comments: none)

Fedora Weekly News Issue 80

The Fedora Weekly News for March 12, 2007 looks at 2 Million Fedora Core 6 Installs, Fedora Core 6 Linux Eclipses 2M User Mark, Talking points for Fedora 7 release, Fedora Infrastructure needs your help!, Fedora 7 and the wireless world, Ambassadors Report: Chemnitz LinuxTag, Review: Fedora 7 Test 2, and several other topics.

Comments (none posted)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for March 5, 2007 covers the Opengear donation of two CM4008, Xfce becomes an official project, Developer of the Week (nightmorph), FOSDEM, Chemnitzer Linux-Tage, Linuxforum 07, and several other topics.

Comments (none posted)

Ubuntu Weekly News: Issue #30

The Ubuntu Weekly News for February 28, 2007 covers New Team: Ubuntu Scribes, Feisty Fawn Herd5 Released, No Beryl or Compiz for Feisty, Weekly Quiz Update, Changes in Feisty, Upcoming meetings and events, and much more.

Full Story (comments: none)

Ubuntu Weekly News: Issue #31

The Ubuntu Weekly Newsletter for March 10, 2007 looks at Linspire now based on Ubuntu, Statistics of Ubuntuforums, Ohio US Team approved and official, Weekly Quiz Update, Upcoming meetings and events and several other topics.

Full Story (comments: none)

DistroWatch Weekly, Issue 193

The DistroWatch Weekly for March 12, 2007 is out. "Twenty news announcements on the main page of DistroWatch turned last week into the busiest one so far this year, but things are unlikely to slow down much in the coming days either. The new GNOME 2.18, whose bits and pieces are slowly starting to appear on some mirrors, will be followed by the much awaited Red Hat Enterprise Linux 5 later this week, while new development releases from Mandriva Linux (2007.1 RC1) and openSUSE (10.3 alpha 2) are also expected shortly. In other news: How OpenBSD and an old IBM laptop saved a construction project in a Central American jungle, an introduction to Conary - a package management system done right, and a brief comparison between Linux Mint and Freespire - two distributions with similar goals and identical base systems. The feature story of this week's issue looks at the deepening management crisis at Gentoo Linux."

Comments (none posted)

Newsletters and articles of interest

Candidates for Debian Project Leader sound off (Linux.com)

Linux.com talks with some DPL candidates. "Once again, the Debian project is gearing up to elect a new project leader, with voting set to begin late this month. As we did last year, we asked the DPL candidates to sound off on some of the issues that will face the Debian Project in the next year. Out of nine candidates, six took the time to respond to our questions via email. Steve McIntyre, Sven Luther, and incumbent DPL Anthony Towns failed to respond in time for this article. We received responses from Wouter Verhelst, Aigars Mahinovs, Gustavo Franco, Sam Hocevar, Simon Richter, and Raphaël Hertzog." Update: Sven Luther has withdrawn his nomination, leaving only eight candidates.

Comments (none posted)

Mandriva moves in on business Linux desktop (DesktopLinux)

DesktopLinux covers the release of Mandriva Corporate Desktop 4.0 beta. "For its desktop environment, Corporate Desktop 4.0 features the X.org 7.1 window manager and the KDE 3.5.4 desktop environment. While GNOME 2.16 is also included, this distribution is optimized for KDE. It also includes a new tool to set KDE user rights from an LDAP (Lightweight Directory Access Protocol) directory, to complement directory-based authentication."

Comments (5 posted)

Distribution reviews

Linux Mint freshens Ubuntu's palate (Linux.com)

Linux.com reviews Linux Mint. "Ubuntu is a strong desktop distro, but it falls short for some users in a few areas. Where are the multimedia codecs and DVD support, and what's with all the brown, for heaven's sake? If you'd like multimedia support with a minty fresh theme, try Linux Mint 2.2, an Ubuntu-based distro that throws in support for Flash 9, Windows Media Format, DVDs, MP3s, and troublesome wireless cards."

Comments (none posted)

Dual-licensed Linux router distro ships v2.0 (LinuxDevices)

LinuxDevices looks at Vyatta Subscription Edition 2.0 (VS2). "Vyatta two weeks ago released Vyatta Community Edition 2.0 (VC2), which featured a move to a full Debian Linux undercarriage, for enhanced user serviceability. Vyatta does not specify whether VS2 is also based on Debian; however, it seems likely that the two platforms are similar, except for their licensing terms."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Mirage: a fast and simple image viewer

Mirage is a relatively new image viewing application which has been designed with speed in mind:

Mirage is a fast and simple GTK+ image viewer. Because it depends only on PyGTK, Mirage is ideal for users who wish to keep their computers lean while still having a clean image viewer.

The project was started in March, 2006 according to the CHANGELOG file. Mirage has undergone rapid development since then, with fifteen releases so far.

[Mirage] In 2004, LWN's Jon Corbet wrote The Grumpy Editor's Guide to Image Viewers. One conclusion of the article was that none of the current image viewers were as useful as xv:

Your editor stands by his original claim: xv, even after nine years of absolutely no development, is still superior to any of the free alternatives. No other tool provides the same ease of use, speed, features, and quality of results.

[Mirage]

Nothing has changed in regards to xv development, but xv is still the standard that other viewers are judged against. Let's see how Mirage stacks up.

Here are some of the features offered by Mirage:

  • Supported image formats include png, jpg, svg, xpm, gif, bmp, tiff, and others.
  • Has the ability to cycle through large collections of images.
  • Images can be dynamically resized, full-screen and best fit modes are available.
  • A built-in slide show viewer is included.
  • Has a random image viewing function.
  • A user-selectable status bar shows basic image metadata.
  • An image properties pulldown shows more detailed image metadata.
  • Images can be rotated, zoomed, cropped, resized and flipped.
  • Panning through zoomed-in images can be performed with the mouse.
  • Many of the program's options are user-configurable.
  • A number of command-line switches are available.
  • A number of shortcuts are bound to various key combinations.
The online documentation explains the application in more detail.

Some of the features that your author has come to depend on in xv, but are not available in Mirage include:

  • A grab function for turning windows into images.
  • The ability to convert and save images to another format.
  • A full-featured color editor window, especially the R/G/B/mono linearity adjustments.
  • The lack of a spinning clock as an indication of ongoing image processing.
  • Cropping via mouse clicks in the main window.

Some of these missing functions, such as image grab and convert, can be handled by external commands. Perhaps that is in line with the Mirage lightweight design philosophy, but the omissions come at the cost of user inconvenience.

Your author tried out version 0.8.1 of Mirage on an Ubuntu Edgy Eft system, for the most part, the application behaved as advertised. There was a slight problem starting up the slideshow mode, when the application was opened up with a *.jpg command line option, the slideshow button was grayed-out until several images were first viewed manually. A repeat slideshow option would also be useful if the application were to be used in an unattended mode.

Mirage has a nice look and feel, for the basic job of viewing large collections of images, it performs quite well and your author will keep it on his machine.

The Mirage source code and packages are available for download here.

Comments (6 posted)

System Applications

Database Software

pg8000 1.02 released

Version 1.02 of pg8000 has been released. "pg8000 is a Pure-Python interface to the PostgreSQL database engine. It is one of many PostgreSQL interfaces for the Python programming language. pg8000 is somewhat distinctive in that it is written entirely in Python and does not rely on any external libraries (such as a compiled python module, or PostgreSQL's libpq library). pg8000's name comes from the belief that it is probably about the 8000th PostgreSQL interface for Python." This version adds support for DB-API 2.0, and a few more features.

Comments (none posted)

MySQL Community Server 5.0.37 has been released

Version 5.0.37 of MySQL Community Server is available. "This is our second full (source and binary) release of the MySQL Community Server since we made the split between the Community and Enterprise Version. It includes all bug fixes applied to up to and including the MySQL 5.0.36 Enterprise Server. This release also resolves a crashing bug that could be exploited as a potential local Denial of Service attack".

Full Story (comments: none)

PostgreSQL Weekly News

The March 11, 2007 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

Embedded Systems

The Free ECB_AT91 V1 SBC

Open Collector notes the release of the Free ECB_AT91 V1 single board computer. "The design of the ECB_AT91 Single-Board Computer is free. It already runs Debian, OpenEmbedded (Angstrom Distribution) and Buildroot. You can buy one or more, or download the design and build your own. The board is powered by an Atmel AT91RM9200 processor, which features an ARM9 core clocked at 180MHz. It supports up to 64MB of SDRAM, has one SD/MMC slot, 2 MB of serial flash, one 10/100 Ethernet interface, USB host and two serial ports."

Comments (none posted)

LDAP Software

Linbox Directory Server 1.1.3 available

Version 1.1.3 of Linbox Directory Server, an identity and network services management system, is out with new features and bug fixes.

Full Story (comments: none)

Networking Tools

IPCop 1.4.14 released (SourceForge)

Version 1.4.14 of IPCop has been announced. "IPCop is a friendly firewall solution protecting networks running on linux. It will be geared towards home and SOHO users. Interface is task based. Hardware requirement could be very minimal and grow with services used. This release update timezone to support US daylight saving time occuring March 11 and mainly update squid and snort. You are encouraged to update from previous releases once some bugs introduced in 1.4.14 are fixed on 1.4.15."

Comments (none posted)

Seagull 1.5.0 released (SourceForge)

Version 1.5.0 of Seagull is out. "Seagull is a multi-protocol traffic generator. Especially targeted towards IMS, Seagull supports Diameter (RFC3588 and all applications) over TCP/SCTP and IPv4/IPv6 , TCAP (over SS7 or Sigtran), XCAP over HTTP and Radius."

Comments (none posted)

Web Site Development

Midgard Weekly Summary #69: March 8th 2007

The March 8, 2007 edition of the Midgard Weekly Summary is out with the latest news about the Midgard web content management system.

Full Story (comments: none)

Release of remo 0.1.3 alpha

Version 0.1.3 alpha of Remo is out. "Remo stands for "Rule Editor for ModSecurity". It's a project, attempting to bring easier configuration to ModSecurity, an apache application firewall. The second and goal is to make a whitelist/positive security model feasible for ModSecurity deployments. This new release brings support for query string arguments and cookies. Additionally, every request parameter can be optional or mandatory."

Full Story (comments: none)

Desktop Applications

Audio Applications

Ardour at the Google Summer of Code

The Ardour multi-track audio recorder project has applied for participation in the 2007 Google Summer of Code. "So, my own personal ideas for projects are: Scripting support, Batch command support, Graph-based connection UI, MIDI interface (perhaps on top of the midi support from last year’s GSoC?? perhaps!), Video tracks, YOUR IDEA HERE".

Comments (none posted)

Data Visualization

Asymptote 1.22 released (SourceForge)

Version 1.22 of Asymptote is available. "Asymptote is a powerful descriptive vector graphics language for technical drawing, inspired by MetaPost but with an improved C++-like syntax. Asymptote provides for figures the same high-quality level of typesetting that LaTeX does for scientific text. Problems with loading LaTeX packages and slide presentations were fixed. Non-static variables in every loop iteration are now allocated anew. Formatting under locales with nonperiod decimal separators was fixed, along with logarithmic tick labels near the machine epsilon..."

Comments (none posted)

Desktop Environments

GNOME 2.18 released

The announcement has gone out: GNOME 2.18 is available. See the release notes for an introduction to the new features in this version of the GNOME desktop environment.

Full Story (comments: 24)

GNOME Software Announcements

The following new GNOME software has been announced this week: You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

Dropped network-manager-applet from GNOME 2.18.0

The GNOME 2.18.0 release will apparently be missing the network-manager-applet. "The GNOME Release Team has dropped network-manager-applet from GNOME 2.18.0, as no releases were ever made. It can be proposed again for inclusion in 2.20".

Full Story (comments: 1)

KDE Commit-Digest (KDE.News)

The March 11, 2007 edition of the KDE Commit-Digest has been announced. The content summary says: "The Oxygen iconset is moved from playground to kdelibs, changes made throughout KDE to support the new icon names specification. The Crystal iconset is moved from kdelibs to its kdeartwork retirement home. More work on the Oxygen widget style. Security fixes in KTorrent. Initial work on "uninstall" functionality for the KDE Windows installation utility. New "Snowish" theme for the Kamion user information migration utility. Continued graphics improvements across kdegames. Improved wireless network encryption support in Solid. Further work on the Amarok 2.0 porting, with particular attention to the Music Store integration elements. KPilot is to make a surprise return for the KDE 4.0 release."

Comments (none posted)

Draft KDE 4.0 release roadmap

A draft KDE 4.0 release roadmap has been posted for comments. Should the current schedule hold, we should expect the 4.0 release to happen toward the end of October (of this year!). "KDE 4.0 will not contain all features announced nor promised: these will come during the lifetime of KDE 4. We can probably switch quickly to a KDE 4.1 release if there are major subsystems ready for merging soon after the KDE 4.0 hits the streets."

Full Story (comments: none)

The Road to KDE 4: Oxygen Artwork and Icons (KDE.News)

KDE.News looks at Oxygen in the Road to KDE 4 series. "One of the big visual changes just happened in KDE 4, the transition of kdelibs to the Oxygen Icon set. This transition is still in progress, and it includes a massive icon naming scheme change that affects thousands of files. But, the Oxygen artwork project much is more than just an icon set, it's a unified way to do artwork for KDE 4. SVG an essential part of Oxygen, so many applications that are now capable of SVG display are also using Oxygen styled artwork."

Comments (8 posted)

KDE Software Announcements

The following new KDE software has been announced this week: You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

Xorg Software Announcements

The following new Xorg software has been announced this week: More information can be found on the X.Org Foundation wiki.

Comments (none posted)

Encryption Software

GnuPG 2.0.3 released

Version 2.0.3 of GnuPG, an encryption application, has been announced. "This is bug fix release. There are also some minor enhancements."

Full Story (comments: none)

OpenSSH 4.6 released

Version 4.6 of OpenSSH has been released with bug fixes and: "sshd now allows the enabling and disabling of authentication methods on a per user, group, host and network basis via the Match directive in sshd_config."

Full Story (comments: none)

Financial Applications

SQL-Ledger 2.6.26 released

Version 2.6.26 of SQL-Ledger, a web-based accounting system, is out with one change: "added check password check in admin.pl when called with wget or similar commandline utilities".

Comments (none posted)

Games

Bullet Physics SDK 2.45 released (SourceForge)

Version 2.45 of Bullet Physics SDK is available with a number of new capabilities. "Bullet is a state-of-the-art 3D Collision Detection and Rigid Body Dynamics Library for games. ZLib license, free for commercial use, including Playstation 3. Supports COLLADA Physics."

Comments (none posted)

Kimboot 1.00 released

Version 1.00 of Kimboot, an arcade-style game, has been announced on the PyGame site. Changes include: "Major code cleanup; some parts were rewritten from scratch. This release uses OpenGL for drawing. Theme support: you can make your own graphics and sounds, and then just choose your custom theme in Options. Background image support (theme-dependent). New graphical effects. New kinds of enemies (Drunken, Genius, and Boss). Enemies are now animated."

Comments (2 posted)

GUI Packages

wxWidgets 2.8.2 released

Release 2.8.2 of wxWidgets, a cross-platform GUI toolkit, has been announced. "This is mainly a bug fix release; please see changes.txt for details."

Comments (none posted)

Interoperability

Wine Weekly Newsletter

The March 12, 2007 edition of the Wine Weekly Newsletter is online with coverage of the Wine project. Topics include: NetTunes, GDIPlus, Cairo Winelib Port, DirectX 10 For SoC?, Developing For Fun While Under a Contract, Winetricks and Lotus Notes Printing Regression.

Comments (none posted)

Multimedia

The Road to KDE 4: Amarok 2 Development is Underway (KDE.News)

KDE.News continues on the Road to KDE 4 with a look at Amarok 2. "This week we'll take a brief look at some of the many features that are making their way into Amarok 2, which is the development branch for Amarok in KDE 4. The features discussed are all in progress features which have reached varying stages of completion. Read on for information about Amarok's engines (including Phonon), UI changes, changes to the Magnatune music store, OS X support, and more."

Comments (none posted)

Dissent 0.1 announced

Versions 0.1 of Dissent and the associated Dissent-Gstreamer are available. "The Dissent Project attempts to be a full featured multimedia application that can play audio and video files as well as internet radio streams by using powerful media engines such as GStreamer. It also has robust functionality for both RSS feeds and Podcasts which can be viewed in the built in web browser. The Dissent Project aims to tightly integrate services from various organizations such as Amnesty International."

Comments (none posted)

Music Applications

Csound 5.05 announced

Version 5.05 of Csound, a language for music synthesis, is out. "This largely a maintenence release, but as usual there are some new opcodes and facilities. This is the first release to include a French manual".

Full Story (comments: none)

MMA 1.1 announced

Version 1.1 of MMA (Musical MIDI Accompaniment) is out with several new features and bug fixes.

Full Story (comments: none)

Digital Photography

UFRaw 0.11 released

Version 0.11 of UFRaw, a utility to read and manipulate raw images from digital cameras, is out. "The highlight of this release is the new handling of image highlights, which takes care of both highlight restoration and highlight clipping."

Full Story (comments: none)

Web Browsers

Firekeeper - IDS for Firefox available

The Firekeeper project has been launched. "Firekeeper is an Intrusion Detection and Prevention System for Firefox. It is able to detect, block and warn the user about malicious sites. Firekeeper uses flexible rules similar to Snort ones to describe browser based attack attempts. Rules can also be used to effectively filter different kinds of unwanted content."

Full Story (comments: none)

Miscellaneous

Pytables 2.0 beta 1 released

Version 2.0 beta 1 of Pytables, a package for managing hierarchical datasets, has been announced. "The PyTables development team is very happy to announce the public availability of the first *beta* version of PyTables 2.0. Starting with this release, both the API and the file format have entered in the stage of freezing (i.e. nothing will be modified unless something is clearly *wrong*), so people can use it in order to begin with the migration of their existing PyTables 1.x scripts as well as start enjoying the new exciting features in this major version ;)"

Comments (none posted)

Languages and Tools

C

ACC 0.5 released

ACC 0.5, a version of the GCC compiler aimed at aspect-oriented C programming, has been released. "Besides some new features, the ACC 0.5 release also includes a set of experimental weave adapters that help integrate aspeCts in the build process of large C-based software projects." Should be an interesting release for people into new approaches to programming languages.

Full Story (comments: 5)

OSELAS.Toolchain launched

Robert Schwebel has sent in an announcement for the launch of the OSELAS.Toolchain. "... we came to the conclusion that, with PTXdist, we already have most of the infrastructure we need for building toolchains: a staging model (get, prepare, extract, compile, install, targetinstall), a Kconfig frontend for easy configuration, autogenerated dependencies, a clean patch management system. So we tried it out and the result is OSELAS.Toolchain(). It is now able to build a full suite of gcc-4.1.2 toolchains for many different arm platforms, including big endian, iwmmxt etc., for mips, powerpc and x86."

Full Story (comments: none)

Caml

Caml Weekly News

The March 13, 2007 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

Haskell

Haskell Weekly News

The March 12, 2007 edition of the Haskell Weekly News is online. This week we see the 2007 Haskell Workshop announcement, Haskell.org's participation in the Google Summer of Code gets underway, and of course, new libraries!

Comments (none posted)

Ruby

Ruby Weekly News

The March 11th, 2007 edition of the Ruby Weekly News takes a look at the latest discussions on the ruby-talk mailing list and comp.lang.ruby newsgroup.

Comments (none posted)

Tcl/Tk

Tcl-URL!

The March 14, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

Emulators

DOSBox 0.70 has been released (SourceForge)

Version 0.7.0 of DOSBox, an x86 emulator which can be used for running DOS games, is available. "There were a lot of changes since the last version and here is a short list of the larger changes: - Faster dynamic core for certain games. - Improve the cycle guessing code and make it default! - Foreign keyboard layout support."

Comments (none posted)

Libraries

GUASI 0.17 released

Stable version 0.17 of GUASI has been announced. "The GUASI library implements a thread based generic asyncronous execution engine, to be used to give otherwise syncronous calls an asyncronous behaviour. It can be used to wrap any syncronous call, so that it can be scheduled for execution, and whose result can be fetched at later time (hence not blocking the submitter thread). The GUASI library can be used as complement to standard event retrieval interfaces like poll(2), select(2) or epoll(4)."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Internet Radio on Death Row (Linux Journal)

Doc Searls looks at Internet Radio. "Internet Radio has been sentenced to death. In a move that recalls the Vogons' decision to destroy Earth to clear the way for a highway bypass through space (a thankfully fictional premise of Douglas Adams' Hitchhikers Guide to the Galaxy), the judges comprising the Copyright Royalty Board have decided to destroy the Internet radio industry so the Recording Industry won't be inconvenienced by something it doesn't know, like or understand."

Comments (6 posted)

FSFE reaches out with new Freedom Task Force (NewsForge)

NewsForge looks into the Free Software Foundation Europe's Freedom Task Force. "In the United States, the Free Software Foundation (FSF) has reached out to the community with advocacy campaigns and the consultation process on the next version of the GNU General Public License. By contrast, the Free Software Foundation Europe (FSFE) is focusing much of its community outreach on the creation of a group it calls the Freedom Task Force (FTF). Although relatively new, the FTF is already starting to make its mark on free software in Europe in the fields of education and compliance, and with its unique approach to the problems of copyright."

Comments (none posted)

Trade Shows and Conferences

FSF looks to 2007 as the year of GPLv3 (Linux-Watch)

Linux-Watch looks forward to the Free Software Foundation's annual associate member and activist meeting. "The Free Software Foundation (FSF) holds its annual associate member and activist meeting at MIT in Cambridge, Mass., on March 24. This year's conference theme is the "Year of the Update." The update in question is the upcoming GPLv3, the latest version of the GNU General Public License."

Comments (none posted)

PyCon 2007 Wrapup (O'ReillyNet)

Jeremy Jones reports on PyCon 2007. "I recently attended PyCon 2007. It's interesting to look back on the previous year when trying to figure out where to focus my attention in the next year. In organizing my thoughts, I hope to give you some useful information on what's coming. I also had the pleasure of sitting down with Guido van Rossum, Python's creator and benevolent dictator for life. This is the first time that backward compatibility is an issue, and Guido addresses what you need to do to prepare, discusses the strengths and weaknesses of the new conversion tool, and points out the benefits of several new language features (for example, full support for Unicode strings). He also discusses the controversy and misunderstanding some of these changes have caused in the Python community, and how they're being resolved."

Comments (none posted)

Companies

If you think selling Linux is easy, why not beat Dell to it? (Guardian)

This Guardian article argues that selling Linux-installed systems is not as easy a thing for Dell to do as one might expect. "Cost savings also come directly from Microsoft and Intel in the form of discounts and cooperative advertising support for the use of logos, and so on. These schemes don't exist for Linux. But will the tens of thousands of Linux supporters 'Digging' the idea on IdeaStorm ever turn into paying customers? I can't speak for Dell on this, but I suspect very few will. Worse, those few are mostly the sort of buyer no-one really wants."

Comments (34 posted)

Psst. Wanna hear about Novell's secretive virtualization company buyout? (LinuxWorld)

LinuxWorld covers Novell's acquisition of RedMojo. "Novell in November quietly acquired a company whose resource virtualization software is being used to bolster the data center automation capabilities of Novell's ZENworks management package. The company acquired RedMojo for $9.72 million, though chose not to make an official announcement at the time."

Comments (1 posted)

Red Hat hopes to solidify lead with new Linux (ZDNet)

ZDNet looks forward to the release of RHEL 5. "Red Hat will permit up to four virtual machines to run atop RHEL 5 Server, but it's adding a new product called RHEL Advanced Platform that supports unlimited virtual machines and includes the company's Global File System software."

Comments (none posted)

Linux Adoption

FAA May Ditch Microsoft's Windows Vista (InformationWeek)

InformationWeek reports that the US Federal Aviation Administration is not planning to make the move to Windows Vista. "March is coming in like a lion for Microsoft's public sector business. Days after InformationWeek reported that the Department of Transportation has placed a moratorium on upgrades to Windows Vista, Office 2007, and Internet Explorer 7, the top technology official at the Federal Aviation Administration revealed that he is considering a permanent ban on the Microsoft software in favor of a combination of Google's new online business applications running on Linux-based hardware."

Comments (5 posted)

Japan may migrate 400,000 Windows school desktops to Linux (DesktopLinux.com)

DesktopLinux.com reports on a possible large-scale Linux migration effort in Japan. "Japan's public broadcasting network, NHK, reported late last week that the Japanese Ministry of Economy, Trade, and Industry plans to introduce Linux for use within classrooms across the country in the near future, according to Japanese non-profit educational website Gyaku. Japan has been considering Linux for use in its schools since 2004, Gyaku noted. An investigation conducted in Spring 2006 found that more than 400,000 computers at schools in Japan were running on Windows 98 or Windows ME -- systems no longer supported by Microsoft."

Comments (none posted)

Tories want open source Whitehall (BBC News)

BBC News reports on an effort to use more open-source software in the UK government. "The government could save more than £600 million a year if it used more open source software, the shadow chancellor has estimated. George Osborne said the savings would cut 5% off Whitehall's annual IT bill. He called for a more "level playing field" for all software companies, and urged "cultural change" in government." (Thanks to Richard Stevens).

Comments (none posted)

Interviews

Three Minutes With IBM's Linux Leader (PC World)

PC World talks with IBM VP Scott Handy. "Scott Handy started with IBM in 1983 as a systems engineer and went on to sales, marketing, and strategy positions covering large accounts, channels, small and medium business, and IBM products for Windows NT, Sun Solaris, and OS/2 Warp. Now, as vice president for Linux and open source, he is one of the main public faces articulating IBM's open-source strategy. IDG News Service Senior Writer Elizabeth Montalbano caught up with Handy at the sidelines of the recent LinuxWorld Open Solutions Summit in New York. He talked about how the industry giant manages to support a vast product portfolio for Linux and open-source initiatives."

Comments (none posted)

Resources

Debug your Web code with Firebug (Linux.com)

Mayank Sharma explores Firebug on Linux.com. "Developing Web sites isn't as straightforward a task as it used to be at the turn of the century. With an influx of new tools, technologies, and development methodologies, a Web page is no longer a string of plain ol' HTML, but instead a complex mix of stylesheets, markup languages, and scripts. Debugging this complicated blend is no easy task. Firebug is an open source add-on to the Firefox Web browser that lets you edit and debug everything from simple CSS and JavaScript templates to complex AJAX applications."

Comments (none posted)

Remote kernel debugging in FreeBSD using serial communication (developerWorks)

IBM developerWorks takes a look at debugging a FreeBSD kernel. "Explore how to remotely debug a FreeBSD kernel that is running on a target machine without affecting system performance. In this article, examine setting up the debug environment using serial communication port, compiling modified kernel code, debugging, and troubleshooting tips."

Comments (1 posted)

A dozen tips for testing free software (Linux.com)

Linux.com has some tips for software testers. "One of the best ways you can participate in the free and open source software (FOSS) revolution is by helping to test software and reporting bugs and issues to project developers to help them improve their code. Even in the wild and woolly, sometimes undisciplined approach to development that we see in FOSS projects, there are ways to test more effectively. Here are more than a dozen tips suggested by testing gurus and developers that can help you become a successful tester."

Comments (1 posted)

Reviews

K3b enters new era with approaching 1.0 release (Linux.com)

Linux.com reviews K3b. "One of free software's premier applications, KDE's CD and DVD burning suite K3b, is about to hit the big 1-0. This milestone touts rewritten DVD video ripping and a refocused interface design. The new release represents a level of feature-completeness and stability that surpasses all previous K3b releases and, perhaps, all free software competitors."

Comments (16 posted)

Thunar file manager - versatile and impressive (Linux On Desktop)

Linux On Desktop reviews the Thunar file manager. "Thunar is a file manager that is shipped by default with XFCE and is a integral part of XFCE desktop environment. Thunar is developed by Benedikt Meurer and has been named after the god Thor of Norse mythology. It is similar to Nautilus but uses much less resource as compared to Nautilus, and in fact one of the goals of creating Thunar was to create a file manager that was fast, clean and easy to use." (Found on GnomeDesktop)

Comments (3 posted)

Tiny surveillance camera has Linux smarts (Linux Devices)

Linux Devices takes a look at the Nuvation IP camera. "Nuvation is demonstrating an ultra-compact, Linux-powered, intelligent IP camera reference design, at the TI Developer Conference in Dallas this week. The engineering consultancy firm says its camera can encode and stream D1 (720x480) video over Ethernet at 30fps. The Nuvation design measures just 3.25 x 1.7 x 1.8 inches (79 x 43 x 47mm), yet it incorporates a full 300MHz ARM9 processor capable of running Linux or another embedded OS, according to the company."

Comments (1 posted)

Zabbix: State-of-the-art network monitoring (Linux.com)

Linux.com looks at Zabbix. "Zabbix is a server-agent type of monitoring software, meaning you have a Zabbix server where all gathered data is collected, and a Zabbix agent running on each host. Note that you can have more than one Zabbix server installed, but you cannot consolidate data from multiple servers in one single central server. All Zabbix data, including configuration and performance data, is stored in a relational database -- MySQL, PostgreSQL, or Oracle -- on the server. Zabbix server can run on all Unix/Linux distributions, and Zabbix agents are available for Linux, Unix (AIX, HP-UX, Mac OS X, Solaris, FreeBSD), Netware, Windows, and network devices running SNMP v1, v2, and v3."

Comments (13 posted)

Miscellaneous

Australia's LinuxChix unite to form AussieChix (Linux.com)

Melissa Draper discusses the launch of the AussieChix group on Linux.com. "Following discussions at the Linux.Conf.Au conference in Sydney in January, members realised that a national group would better serve the country. Last month the groups united to form AussieChix, a new nationwide chapter that makes the group more accommodating to women from across Australia, whilst also improving the communications between the members of the previous chapters."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

EFF Kills Clear Channel Patent

The Electronic Frontier Foundation has sent out a press release on its role in successfully challenging a patent being asserted by Clear Channel. "The patent covered a system and method of creating digital recordings of live performances. Clear Channel claimed the bogus patent created a monopoly on all-in-one technologies that produce post-concert digital recordings and threatened to sue those who made such recordings. This locked musical acts into using Clear Channel technology and blocked innovations by others."

Full Story (comments: none)

EFF: Who controls your television?

The EFF has published a report on the workings of the Digital Video Broadcasting project, which is creating television standards for much of the world outside of the Americas. Unsurprisingly, there is a lot of DRM involved. "Consumers would never choose this future, so Hollywood will try to force it on them by regulatory fiat. DVB's imprimatur may put restrictive standards on the fast-track to becoming legally-enforced mandates, and existing laws already limit evasion of DRM even for lawful purposes. In effect, private DRM standards will trump national laws that have traditionally protected the public's interests and carefully circumscribed copyright holders' rights."

Comments (2 posted)

OLPC systems available for developers

We have received a note from the One Laptop Per Child project saying that the current build of beta-test systems is going well - well enough that they have some systems available to expand their developer program. If you have a project which you think might help out the OLPC folks and would like a cute green laptop to run it on, have a look at the OLPC Developers Program page and let them know what you are thinking.

Comments (9 posted)

OpenOffice.org sends Dell a letter

The OpenOffice.org project has sent an open letter to Dell in support of installing their software on Dell's systems. "Let's have a conversation about how we could build an 'OpenOffice.org supplied by Dell' product to give your customers what they are asking for. We'd also be happy to accept any financial contribution that Dell might offer to help ensure that OpenOffice.org continues to evolve in the future."

Full Story (comments: 2)

Commercial announcements

Centric releases Centric CRM 4.1

Centric CRM has announced the release of Centric CRM 4.1, a Customer Relationship Management system. "Centric CRM 4.1 introduces Action Plans, a new tool that allows a company to quickly establish workflow best practices, as well as expanded support for a total of eleven leading database systems".

Comments (none posted)

Announcing CrossOver 6.0.1, a bug fix release

Version 6.0.1 of CrossOver has been announced. "This version is entirely a bug fix release. Notably, it contains a fix so that time sensitive applications will continue to work correctly after the new Daylight Savings Time switch. It also contains a few bug fixes for Outlook and handling multiple CD installers, as well as a range of other minor issues."

Full Story (comments: none)

Funambol and db4objects enable complex data for mobile devices

Funambol and db4objects have announced Funambol Connector for db4o. "The Funambol Connector for db4o makes it easy for software developers to store and manage complex information in an embedded database on mobile devices such as laptops, smartphones and PDAs. The combination of Funambol and db4o eliminates the need to write extensive code to manage and extract data from complicated data structures and gives users a wide range of mobile devices to access complex data while on the go."

Comments (none posted)

NetBeans Community announces support for Ruby and JRuby

Sun Microsystems, Inc. and the NetBeans(TM) Community have announced an early release of the NetBeans Ruby Pack. "The NetBeans plug-in offers developers added support for dynamic and scripting languages and includes editing features for both Ruby and JRuby -- a 100% pure-Java(TM) implementation of the Ruby programming language that runs on the Java(TM) Virtual Machine. The NetBeans Ruby Pack goes beyond basic editing, syntax highlighting, navigation outline, project support and unit test execution to provide developers with a rich set of features to enhance productivity."

Comments (none posted)

NetXen announces Linux Sockets Acceleration

NetXen, Inc. has announced the availability of their Linux Sockets Acceleration product. NetXen "... introduced Linux Sockets Acceleration(tm) (LSA), a solution that delivers far higher network performance while greatly reducing host CPU overhead. It is the first network acceleration solution for Linux that requires no modifications to the kernel, host TCP stack or applications, and can offload both user- and kernel-mode applications. NetXen's LSA is also the first solution to support NIC and offload modes simultaneously."

Full Story (comments: none)

OpenVZ software for Red Hat Enterprise Linux 5

The OpenVZ project has announced the availability of its operating system server virtualization software for Red Hat Enterprise Linux 5. ""This provides a great base with solid device support and code stability, which we will use as the basis for future OpenVZ software," said Kir Kolyshkin, manager of the OpenVZ project. "We continue to keep in step with the latest Linux releases to serve users in the open source community.""

Full Story (comments: none)

Open-Xchange to build next generation open-source collaboration suite

Open-Xchange Inc. has announced the Open-Xchange Community project. "Open-Xchange and the world's leading web-hosting company, 1&1 Internet, recently announced the availability of MailXchange, 1&1's hosted email and collaboration solution based upon Open-Xchange Inc.'s award winning Smart Collaboration(TM) technology. Open-Xchange today is releasing the source code of 1&1 MailXchange server components under General Public License (GPL) and the AJAX-based user interface under Creative Commons License "Attribution- NonCommercial-ShareAlike 2.5"."

Comments (none posted)

Oracle becomes an Eclipse Foundation board member

Oracle Corporation has announced its joining of the Eclipse Foundation board of directors. "Oracle today announced it will extend its participation in the Eclipse Foundation by becoming a Board Member and Strategic Developer. An Eclipse member since its inception, Oracle's increased role further demonstrates the company's efforts to help drive open source innovations and furthers its commitment to the developer community. Oracle's increased role in the Eclipse community also includes a new proposal to open source its Oracle(R) TopLink technology, a component of Oracle Fusion Middleware, through the Eclipse Foundation."

Comments (none posted)

Oracle Proposes Open Source Persistence Project at Eclipse Foundation

Oracle Corporation has announced its plans to release Oracle TopLink as open-source software. "Today, at the EclipseCon Conference, Oracle (Nasdaq: ORCL), a newly appointed Eclipse Board Member and Strategic Developer, announced it will donate its award winning Java persistence framework, Oracle(R) TopLink, to the open source community. In addition, Oracle announced the proposal of a new Eclipse project to deliver a comprehensive persistence platform based on the contribution of Oracle TopLink, a component of Oracle Fusion Middleware, source code and test cases."

Comments (none posted)

Palamida adds Python support to compliance library

Palamida has announced the addition of Python language support to its compliance library. "Palamida(TM), the leader in software intellectual property management solutions and audit services, today announced that it has expanded its extensive compliance library to include over 6,200 new open source projects while adding support for the popular Python programming language."

Comments (none posted)

Paradigma Software announces Valentina Server Beta 1

Paradigma Software has announced the release of a free beta version of Valentina Server for Linux. "Valentina is a pioneering database system that, built on a unique object-relational model, outperforms almost all commercially available database servers – disk based or RAM based. Recent customer provided data compares equivalent search operations with mySQL server at five minutes to complete, down to five seconds with Valentina Server."

Full Story (comments: none)

SLES with Xen available for SAP NetWeaver and mySAP Business Suite

Novell, Inc. has announced the availability of SUSE Linux Enterprise Server 10 with integrated Xen* virtualization technology for the SAP NetWeaver and mySAP Business Suite.

Comments (none posted)

STMicroelectronics unveils two new System-on-Chip ICs

STMicroelectronics has announced two new SPEAr family configurable System-on-Chip ICs. "The dual-core SPEAr Plus600, complemented with a single-core variant, SPEAr Head600, represents a market-unique solution that enables printer, fax, point-of-sale (POS) and other equipment manufacturers to develop complex yet flexible digital engines at a fraction of the time and cost required by a full-custom design approach. Additionally, the possibility to choose between a single- and a dual-processor device with the same footprint and architecture will enable manufacturers to address different market segments for the same application."

Comments (none posted)

Sun Microsystems announces open source of online game technology

Sun Microsystems, Inc. has announced plans to release the online game server platform Project Darkstar as open-source code. "Sun Microsystems, Inc. announced plans today at the 2007 Game Developers Conference in San Francisco to open source Project Darkstar, a ground-breaking online game server platform written entirely in Java(TM) technology, at the 2007 Game Developers Conference in San Francisco. The company also announced the opening of registration for the Darkstar Playground, which will enable developers to create a wide variety of games that can be provisioned through a single server platform."

Comments (none posted)

New Books

Ajax on Java - New from O'Reilly

O'Reilly has published the book Ajax on Java by Steven Douglas Olson.

Full Story (comments: none)

Resources

FSFE Newsletter

The March 13, 2007 edition of the FSFE Newsletter is online with the latest Free Software Foundation Europe news. Topics include: Fiduicary License Agreement released under GFDL/CC-by-sa, FSFE announces big raffle among all Fellows, FSFE at FOSDEM in Brussels (Belgium), Ciará¡n O'Riordan at SkyCon in Limerick (Ireland), End of internship of Maria Luisa Carli, System administration murphy weeks and Get Active: Join the SELF project!

Full Story (comments: none)

Summer of Code Mentoring HOWTO

Federico Mena-Quintero has published a Summer of Code Mentoring HOWTO document. "The Summer of Code, initiated by Google, is a wonderful opportunity for students to learn how to contribute to free software in a short time, while making a nice chunk of money in the process. Each participating student gets a mentor, who is normally a member of an existing free software project. This document intends to give some advice to mentors, so that they'll be able to help their students to complete their projects successfully."

Comments (none posted)

Contests and Awards

EFF announces Pioneer Awards

The Electronic Frontier Foundation has announced the recipients of its 2007 Pioneer Awards: Yochai Benkler, Cory Doctorow, and Bruce Schneier.

Comments (1 posted)

Second Annual Mellon Awards for Technology Collaboration Announced

The Andrew W. Mellon Foundation has announced that nominations are open for the 2007 Mellon Awards. "The Mellon Awards, in values of $50,000 and $100,000, honor not-for-profit organizations for leadership in the collaborative development of open source software tools with particular application to higher education and not-for-profit activities. More information on the awards, including a listing of last year's winners and the 2007 online nomination form, is available at http://matc.mellon.org."

Comments (none posted)

PyWeek #4 in April

The fourth PyWeek Challenge has been announced, it will take place from April 1-4, 2007. "The PyWeek challenge: 1. Invites entrants to write a game in one week from scratch either as an individual or in a team, 2. Is intended to be challenging and fun, 3. Will hopefully increase the public body of game tools, code and expertise, 4. Will let a lot of people actually finish a game, and 5. May inspire new projects (with ready made teams!)"

Comments (none posted)

Mainsoft, Novell, IBM and DevX announce 'Race to Linux 2.0'

Mainsoft Corporation has announced the Race to Linux 2.0 challenges, to be held in March and April, 2007. "The 3-series Race to Linux 2.0 challenges Visual Studio developers to experiment with .NET 2.0-to-Linux porting options. DevX will announce the target applications at the beginning of each race. More than 100 developers have registered to date. The first developer to deliver the application running successfully under SUSE Linux on an IBM System x will win a Nintendo Wii and games package."

Comments (none posted)

XMMS2 Logo competition 2007

An XMMS2 logo contest has been launched. "XMMS2 Team officially announced it's graphic competition today. The competition goal is for the popular media player to gain a new look and to increase awareness of the project. The competition will be split up in two parts: the first will be for a new logotype. The second part, which will be launched after the conclusion of the first, will aim for a new look for the wiki with reusable elements for client authors to use. First prize in both competitions is an Amazon.com gift certificate valid for $400."

Full Story (comments: none)

Surveys

Dell: what sort of Linux systems would you like?

Dell has decided to follow up on requests for Linux-installed systems by running a survey on just what people would like. Questions cover the types of systems, which distributions, etc. There is, however, no question on whether customers want systems with 100% free software. The survey is open through March 23.

Comments (38 posted)

Education and Certification

LPI offers discounted certification exams at LinuxWorld Belgium

The Linux Professional Institute will offer discounted certification exams at LinuxWorld Belgium on March 21 and 22, 2007.

Full Story (comments: none)

TimeSys expands educational webinar series

TimeSys Corporation "... is adding more sessions to its popular series of educational webinars for embedded Linux developers. Running through March and April, the new topics cover best practices for embedded Linux development through an examination of project risk and the benefits of a common toolset. Later sessions in the series look at technology choices for developers building devices with a graphical interface and an in-depth look at the QEMU processor emulator."

Full Story (comments: none)

Calls for Presentations

Black Hat USA CFP

A call for papers has gone out for the Black Hat USA security conference. The event takes place at Caesars Palace in Las Vegas, NV on July 28 - August 2, 2007. Submissions are due by May 1.

Full Story (comments: none)

DeepSec IDSC 2007 Europe/Vienna CFP

A call for papers has gone out for the DeepSec In-Depth Security Conference. The event will take place on November 20-23, 2007 in Vienna, Austria. Proposals are due before June 10.

Full Story (comments: none)

GUADEC 2007 call for papers deadline extended

GUADEC 2007 call for papers deadline has been extended until March 15.

Full Story (comments: none)

Upcoming Events

GUADEMY: GNOME+KDE Hackmeeting (GnomeDesktop)

GnomeDesktop.org has announced the GUADEMY GNOME+KDE Hack-meeting. The event will be held in Coruña, Spain on March 23-25, 2007. "KDE will be represented by Aaron Seigo, Larrosa, Astals and Rafael Fernandez, and from GNOME, Rodrigo Moya, Álvaro del Castilo, Álvaro López Ortega, Carlos Garnacho, Andrés Gómez and Iago Toral will be there."

Comments (none posted)

The 2007 JavaOne Conference

Sun Microsystems, Inc. has announced the 2007 JavaOne Conference. The event will take place in San Francisco, CA on May 8-11, 2007.

Comments (none posted)

Linux Installfest workshop in Davis, CA

The Linux Users' Group of Davis will hold the next Linux Installfest in Davis, CA on Saturday March 31, 2007.

Full Story (comments: none)

The 2007 MySQL Conference and Expo

The 2007 MySQL Conference & Expo will take place in Santa Clara, California on April 23-26, 2007. "This year's program promises to be the most exciting ever, offering more than 110 sessions and workshops for every type of user -- from experienced database administrators and programmers to MySQL beginners. Attendees who register by March 14 will save $200 off the standard fee. Other discounts are also available that may be used in conjunction with early registration for additional savings."

Full Story (comments: none)

Perens to rain on Novell's parade

Bruce Perens has announced a press conference during the Novell Brainshare conference in Salt Lake City, UT during the week of March 19. "The topics will be: The Microsoft-Novell agreement, GPL version 3 and how it will impede Novell from making use of new innovation by the Free Software community and Software patents vs. Free Software."

Full Story (comments: none)

Samba eXPerience 2007

Some of the Samba eXPerience 2007 speakers have been announced. "The organizers are happy to welcome Howard Chu (Chief Architect of OpenLDAP) as the keynote speaker. Other topics include: talks from the WINE project and OpenChange to show the link to other projects, a talk regarding Samba and GPLv3 reflecting current legal discussions and, of course, developers, users, and vendors fill out the rest of the program with 25 talks in two days."

Comments (none posted)

SciPy’07 dates announced

The dates for the 2007 Scientific Python conference have been announced. "According to www.scipy.org, The SciPy 2007 Conference will be on August 16-17 this year; tutorials and sprints will run on the 14th, 15th, and 18th. I won’t be able to attend (new baby), but I’d like to organize a half-day or one-day session to update and extend the Software Carpentry notes. Lots of modules need writing, both on Python-specific stuff and on general software engineering skills for scientists and engineers."

Comments (none posted)

Events: March 22, 2007 to May 21, 2007

The following event listing is taken from the LWN.net Calendar.

Date(s)EventLocation
March 18
March 23
Novell BrainShare 2007 Salt Lake City, Utah, USA
March 22
March 25
Linux Audio Conference Berlin, Germany
March 23
March 25
ShmooCon Washington DC, USA
March 23
March 25
Guademy Coruña, Spain
March 24 FSF Associate Membership Meeting Cambridge, MA, USA
March 26
March 29
Emerging Technology Conference San Diego, CA, USA
April 1
April 4
International Lisp Conference 2007 Cambridge, England
April 1
April 5
Embedded Systems Conference San Jose, CA, USA
April 1 GPLv3: Improving a Great Licence (discussion draft 3) Brussels, Belgium
April 2
April 6
DJango Bootcamp Atlanta, Georgia, USA
April 2
April 5
Hack in The Box Security Conference 2007 Dubai, United Arab Emirates
April 3
April 8
Make Art 2007 Poitiers, France
April 12
April 14
International Free Software Forum (Forum Internacional Software Livre) Porto Alegre, Brazil,
April 14
April 15
Ruby and Python Conference 2007 Poznan, Poland
April 15
April 18
Gelato ICE: Itanium® Conference & Expo San Jose, California, USA
April 17
April 19
Embedded Linux Conference San Jose, USA
April 18
April 20
CanSecWest Applied Security Conference 2007 Vancouver, Canada
April 19 Linux 2007 Lisbon, Portugal
April 19 Power Architecture Software Summit Austin, TX, USA
April 20
April 22
International Conference on Availability, Reliability and Security Conference on Availability, Reliability and Security Vienna, Austria,
April 20
April 22
Penguicon 5.0 Open Source Software & Science Fiction Convention Troy, Michigan, USA
April 21 Romanian Open Source Development Meeting Bucharest, Romania
April 23
April 25
Samba eXPerience 2007 Göttingen, Germany
April 23
April 27
PostgreSQL Bootcamp at the Big Nerd Ranch Atlanta, USA
April 23
April 26
MySQL Conference and Expo Santa Clara, CA, USA
April 28
April 29
Linuxfest Northwest Bellingham, WA, USA
May 3
May 4
Ubuntu Education Summit Sevilla, Spain
May 3
May 5
SugarCRM Global Developer Conference San Jose, CA, USA
May 4
May 6
Libre Graphics Meeting 2007 Montreal, Quebec, Canada
May 5
May 6
LayerOne Security Conference Pasadena, CA, USA
May 5 Ubucon - Sevilla Sevilla, Spain
May 6
May 11
Ubuntu Developer Summit Sevilla, Spain
May 7 CommunityOne San Francisco, CA, USA
May 8
May 9
World Summit on Intrusion Prevention Baltimore, MD, USA
May 8
May 11
Annual Java Technology Conference San Francisco, CA, USA
May 8
May 11
OSHCA 2007 Kuala Lumpur, Malaysia
May 9
May 11
Red Hat Summit San Diego, CA, USA
May 10
May 11
IEEE International Workshop on Open Source Test Technology Tools Berkeley, CA, USA
May 10 NLUUG Spring Conference 2007 Ede, The Netherlands
May 11
May 13
Conferenze Italiana sul Software Libero Cosenza, Italy
May 12
May 13
KOffice ODF Weekend Berlin, Germany
May 14
May 25
The Pure Data Spring School 2007 Glasgow, Scotland
May 16
May 18
php|tek Chicago, IL, USA
May 17
May 20
RailsConf 2007 Portland, Oregon
May 18
May 19
eLiberatica Open Source and Free Software Conference Brasov, Romania
May 18
May 19
FreedomHEC Los Angeles, CA
May 18
May 19
BSDCan 2007 Ottawa, Canada
May 19
May 20
The 3rd International Workshop on Software Engineering for Secure Systems Minneapolis, Minnesota, USA
May 19
May 20
Rockbox International Developers Conference 2007 Stockholm, Sweden
May 19 Grazer LinuxDays 2007 Graz, Austria
May 19
May 20
Make Magazine Maker Faire 2007 San Mateo, CA, USA
May 19 Linuxwochen Austria - Graz Graz, Austria

If your event does not appear here, please tell us about it.

Page editor: Forrest Cook

Copyright © 2007, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds