LWN.net Weekly Edition for October 11, 2007

Linux in consumer electronics

Linux is embedded in a huge number of different devices, but the high-profile gadgets – the Nokia N800 and OpenMoko phone for example – get all the attention. Those gadgets use Linux as a selling point and a differentiator, trying to appeal to developers and power users who can customize the devices to do exactly what they want. Meanwhile, the vast majority of embedded Linux devices are running it quietly. For those systems, Linux provides a stable platform, with support for a large number of architectures and devices, that just works.

Consumer electronics makers are turning to Linux in a big way. Sony provides an eye-opening list of their devices that run Linux, which covers a wide spectrum of the products that Sony makes; things like digital cameras, video cameras, televisions, audio gear, and professional video equipment. Other companies also have Linux web pages, none quite like the one that Sony provides, and the Consumer Electronics Linux Forum (CELF) has started gathering links to those sites on their embedded Linux wiki.

Linux provides a number of advantages for embedded developers, the most obvious is its price. Commercial embedded operating systems typically charge royalties on a per-device basis, which can be a significant factor, especially for low-end devices. For high-end devices, especially professional grade equipment, the cost of the OS is much less of an issue, but the Linux feature set and hardware support still make it an attractive choice.

One of the advantages that Linux provides is virtual memory – commercial embedded operating systems often rely on a flat memory layout. Virtual memory has a number of useful benefits: process isolation, shared code segments, as well as the ability to overcommit memory. Tim Bird, Sony kernel hacker and architecture group chair for CELF, puts it this way:

Another area of importance to the embedded world is the variety of hardware supported by Linux. Not only is there support for many of the CPU architectures used in embedded devices, but there are drivers for all kinds of peripherals that might be used in the design. If a driver does not exist for the specific peripheral device being used, there is probably a driver for something similar that can be used as a template for a new driver. Alternatively, the Linux Driver Project – which we covered last week – is willing to write the driver given some information about how the device operates.

Support for multiple network protocols, different bus architectures, and various peripheral connections (USB, Firewire, etc.) are also very important, depending on the intent of the device. Because the Linux community is large, and growing, it can support many more options than the commercial embedded OS vendors can. In addition, as the development staff at a consumer electronics company come up to speed on Linux, it will make sense to use it in more devices. This will lead to more supported devices, CPUs, bus architectures, network protocols, and so on.

The added features of Linux do come with a cost, which Bird refers to, of larger kernels and libraries. The linux-tiny project is an effort to reduce the size of the kernel, so-called kernel bloat, for embedded and small systems, which has been pretty well received by kernel hackers. It is a testament to the Linux developers that it already runs on everything from mainframes to mobile phones; it is a rare OS indeed that will make the effort to scale over that wide a range, with the inherent tensions between the needs of the various constituencies.

It probably isn't possible to get a shell prompt on your television or video camera, as these devices aren't meant to be user serviceable, at least at the OS level. User modifications or updates to the code may well be difficult or impossible as well. For devices that are not connected to the internet, which is presumably the case for the majority of them, this is probably a non-issue. Presumably the device manufacturers have ways of upgrading if bugs or security flaws are discovered, but those would be handled by service centers or the like. Those who are opposed to the "Tivo-ization" of the kernel will be less than pleased, but most kernel hackers seem willing to have it used that way, so long as the code is made available.

We will be seeing Linux in more places as time goes on as it is proving a robust solution for all kinds of applications. Perhaps you stare at Linux all day, hacking on code, working on graphics, or running a word processor, it is quite possible that you may also be staring at Linux at night, inside the television in your living room.

Comments (10 posted)

Interview with Google's Chris DiBona

Chris DiBona started using free software on his home PC when he was at college, and for the same reason that Linus wrote Linux: because he couldn't get on the machines in the computer lab. Later, DiBona joined VA Linux, which sold open source-based hardware systems, and ended up as one of the editors on Slashdot. After an ill-fated attempt to start a game company, he joined Google in August 2004, and is Open Source Programs Manager there. He explains to Glyn Moody why open source is good for Google's business – and its soul.

What platform was Google running on when it started at Stanford?

Was that a conscious decision, or did it just happen?

To what extent did that early use of GNU/Linux drive the uptake of other open source programs?

[PULL QUOTE: You can do all the things that you can do to your own code to open source: you can ship it, you don't have to pay any money or anything, you can fix any bugs, you can have a new feature. These all sound like trivial things, but you can do them all without getting permission, without having to check with anybody, without having to go to your legal team. Once the code's in your company, people are going to be able to use it like their own. And that's incredibly powerful. END QUOTE]

What's the advantage for Google in choosing open source rather than writing it yourself?

What open source does Google use?

What were you tasked with doing when you joined?

Where did the idea of taking on key hackers like Andrew Morton, Jeremy Allison and Guido van Rossum come from?

What's the deal for them in terms of time to work on their projects?

How did the Summer of Code scheme came about?

And how has that evolved?

What's the success rate?

What does this scheme achieve for Google?

What about for the projects – what are the advantages for them?

One of the most significant open source releases from Google is Gears. Could you say a little about what it is, and why you decided to open source it?

Which licenses do you prefer to use?

How do you choose?

There's been some discussion about whether Google should give back more of the code derived from open source that it uses internally to power its web services: what's your view?

So what open source code will we see coming from Google in the future?

What do you see as the long-term importance of open source for Google?

Glyn Moody writes about open source at opendotdotdot.

Comments (2 posted)

Memory part 3: Virtual Memory

[Editor's note: this the third installment of Ulrich Drepper's "What every programmer should know about memory" document; this section talks about virtual memory, and TLB performance in particular. Those who have not read part 1 and part 2 may wish to do so now. As always, please send typo reports and the like to lwn@lwn.net rather than posting them as comments here.]

4 Virtual Memory

The virtual memory subsystem of a processor implements the virtual address spaces provided to each process. This makes each process think it is alone in the system. The list of advantages of virtual memory are described in detail elsewhere so they will not be repeated here. Instead this section concentrates on the actual implementation details of the virtual memory subsystem and the associated costs.

A virtual address space is implemented by the Memory Management Unit (MMU) of the CPU. The OS has to fill out the page table data structures, but most CPUs do the rest of the work themselves. This is actually a pretty complicated mechanism; the best way to understand it is to introduce the data structures used to describe the virtual address space.

The input to the address translation performed by the MMU is a virtual address. There are usually few—if any—restrictions on its value. Virtual addresses are 32-bit values on 32-bit systems, and 64-bit values on 64-bit systems. On some systems, for instance x86 and x86-64, the addresses used actually involve another level of indirection: these architectures use segments which simply cause an offset to be added to every logical address. We can ignore this part of address generation, it is trivial and not something that programmers have to care about with respect to performance of memory handling. {Segment limits on x86 are performance-relevant but that is another story.}

4.1 Simplest Address Translation

The interesting part is the translation of the virtual address to a physical address. The MMU can remap addresses on a page-by-page basis. Just as when addressing cache lines, the virtual address is split into distinct parts. These parts are used to index into various tables which are used in the construction of the final physical address. For the simplest model we have only one level of tables.

Figure 4.1: 1-Level Address Translation

Figure 4.1 shows how the different parts of the virtual address are used. A top part is used to select an entry in a Page Directory; each entry in that directory can be individually set by the OS. The page directory entry determines the address of a physical memory page; more than one entry in the page directory can point to the same physical address. The complete physical address of the memory cell is determined by combining the page address from the page directory with the low bits from the virtual address. The page directory entry also contains some additional information about the page such as access permissions.

The data structure for the page directory is stored in memory. The OS has to allocate contiguous physical memory and store the base address of this memory region in a special register. The appropriate bits of the virtual address are then used as an index into the page directory, which is actually an array of directory entries.

For a concrete example, this is the layout used for 4MB pages on x86 machines. The Offset part of the virtual address is 22 bits in size, enough to address every byte in a 4MB page. The remaining 10 bits of the virtual address select one of the 1024 entries in the page directory. Each entry contains a 10 bit base address of a 4MB page which is combined with the offset to form a complete 32 bit address.

4.2 Multi-Level Page Tables

4MB pages are not the norm, they would waste a lot of memory since many operations an OS has to perform require alignment to memory pages. With 4kB pages (the norm on 32-bit machines and, still, often on 64-bit machines), the Offset part of the virtual address is only 12 bits in size. This leaves 20 bits as the selector of the page directory. A table with 2²⁰ entries is not practical. Even if each entry would be only 4 bytes the table would be 4MB in size. With each process potentially having its own distinct page directory much of the physical memory of the system would be tied up for these page directories.

The solution is to use multiple levels of page tables. These can then represent a sparse huge page directory where regions which are not actually used do not require allocated memory. The representation is therefore much more compact, making it possible to have the page tables for many processes in memory without impacting performance too much.

Today the most complicated page table structures comprise four levels. Figure 4.2 shows the schematics of such an implementation.

Figure 4.2: 4-Level Address Translation

The virtual address is, in this example, split into at least five parts. Four of these parts are indexes into the various directories. The level 4 directory is referenced using a special-purpose register in the CPU. The content of the level 4 to level 2 directories is a reference to next lower level directory. If a directory entry is marked empty it obviously need not point to any lower directory. This way the page table tree can be sparse and compact. The entries of the level 1 directory are, just like in Figure 4.1, partial physical addresses, plus auxiliary data like access permissions.

To determine the physical address corresponding to a virtual address the processor first determines the address of the highest level directory. This address is usually stored in a register. Then the CPU takes the index part of the virtual address corresponding to this directory and uses that index to pick the appropriate entry. This entry is the address of the next directory, which is indexed using the next part of the virtual address. This process continues until it reaches the level 1 directory, at which point the value of the directory entry is the high part of the physical address. The physical address is completed by adding the page offset bits from the virtual address. This process is called page tree walking. Some processors (like x86 and x86-64) perform this operation in hardware, others need assistance from the OS.

Each process running on the system might need its own page table tree. It is possible to partially share trees but this is rather the exception. It is therefore good for performance and scalability if the memory needed by the page table trees is as small as possible. The ideal case for this is to place the used memory close together in the virtual address space; the actual physical addresses used do not matter. A small program might get by with using just one directory at each of levels 2, 3, and 4 and a few level 1 directories. On x86-64 with 4kB pages and 512 entries per directory this allows the addressing of 2MB with a total of 4 directories (one for each level). 1GB of contiguous memory can be addressed with one directory for levels 2 to 4 and 512 directories for level 1.

Assuming all memory can be allocated contiguously is too simplistic, though. For flexibility reasons the stack and the heap area of a process are, in most cases, allocated at pretty much opposite ends of the address space. This allows either area to grow as much as possible if needed. This means that there are most likely two level 2 directories needed and correspondingly more lower level directories.

But even this does not always match current practice. For security reasons the various parts of an executable (code, data, heap, stack, DSOs, aka shared libraries) are mapped at randomized addresses [nonselsec]. The randomization extends to the relative position of the various parts; that implies that the various memory regions in use in a process are widespread throughout the virtual address space. By applying some limits to the number of bits of the address which are randomized the range can be restricted, but it certainly, in most cases, will not allow a process to run with just one or two directories for levels 2 and 3.

If performance is really much more important than security, randomization can be turned off. The OS will then usually at least load all DSOs contiguously in virtual memory.

4.3 Optimizing Page Table Access

All the data structures for the page tables are kept in the main memory; this is where the OS constructs and updates the tables. Upon creation of a process or a change of a page table the CPU is notified. The page tables are used to resolve every virtual address into a physical address using the page table walk described above. More to the point: at least one directory for each level is used in the process of resolving a virtual address. This requires up to four memory accesses (for a single access by the running process) which is slow. It is possible to treat these directory table entries as normal data and cache them in L1d, L2, etc., but this would still be far too slow.

From the earliest days of virtual memory, CPU designers have used a different optimization. A simple computation can show that only keeping the directory table entries in the L1d and higher cache would lead to horrible performance. Each absolute address computation would require a number of L1d accesses corresponding to the page table depth. These accesses cannot be parallelized since they depend on the previous lookup's result. This alone would, on a machine with four page table levels, require at the very least 12 cycles. Add to that the probability of an L1d miss and the result is nothing the instruction pipeline can hide. The additional L1d accesses also steal precious bandwidth to the cache.

So, instead of just caching the directory table entries, the complete computation of the address of the physical page is cached. For the same reason that code and data caches work, such a cached address computation is effective. Since the page offset part of the virtual address does not play any part in the computation of the physical page address, only the rest of the virtual address is used as the tag for the cache. Depending on the page size this means hundreds or thousands of instructions or data objects share the same tag and therefore same physical address prefix.

The cache into which the computed values are stored is called the Translation Look-Aside Buffer (TLB). It is usually a small cache since it has to be extremely fast. Modern CPUs provide multi-level TLB caches, just as for the other caches; the higher-level caches are larger and slower. The small size of the L1TLB is often made up for by making the cache fully associative, with an LRU eviction policy. Recently, this cache has been growing in size and, in the process, was changed to be set associative. As a result, it might not be the oldest entry which gets evicted and replaced whenever a new entry has to be added.

As noted above, the tag used to access the TLB is a part of the virtual address. If the tag has a match in the cache, the final physical address is computed by adding the page offset from the virtual address to the cached value. This is a very fast process; it has to be since the physical address must be available for every instruction using absolute addresses and, in some cases, for L2 look-ups which use the physical address as the key. If the TLB lookup misses the processor has to perform a page table walk; this can be quite costly.

Prefetching code or data through software or hardware could implicitly prefetch entries for the TLB if the address is on another page. This cannot be allowed for hardware prefetching because the hardware could initiate page table walks that are invalid. Programmers therefore cannot rely on hardware prefetching to prefetch TLB entries. It has to be done explicitly using prefetch instructions. TLBs, just like data and instruction caches, can appear in multiple levels. Just as for the data cache, the TLB usually appears in two flavors: an instruction TLB (ITLB) and a data TLB (DTLB). Higher-level TLBs such as the L2TLB are usually unified, as is the case with the other caches.

4.3.1 Caveats Of Using A TLB

The TLB is a processor-core global resource. All threads and processes executed on the processor core use the same TLB. Since the translation of virtual to physical addresses depends on which page table tree is installed, the CPU cannot blindly reuse the cached entries if the page table is changed. Each process has a different page table tree (but not the threads in the same process) as does the kernel and the VMM (hypervisor) if present. It is also possible that the address space layout of a process changes. There are two ways to deal with this problem:

• The TLB is flushed whenever the page table tree is changed.

• The tags for the TLB entries are extended to additionally and uniquely identify the page table tree they refer to.

In the first case the TLB is flushed whenever a context switch is performed. Since, in most OSes, a switch from one thread/process to another one requires executing some kernel code, TLB flushes are restricted to entering and leaving the kernel address space. On virtualized systems it also happens when the kernel has to call the VMM and on the way back. If the kernel and/or VMM does not have to use virtual addresses, or can reuse the same virtual addresses as the process or kernel which made the system/VMM call, the TLB only has to be flushed if, upon leaving the kernel or VMM, the processor resumes execution of a different process or kernel.

Flushing the TLB is effective but expensive. When executing a system call, for instance, the kernel code might be restricted to a few thousand instructions which touch, perhaps, a handful of new pages (or one huge page, as is the case for Linux on some architectures). This work would replace only as many TLB entries as pages are touched. For Intel's Core2 architecture with its 128 ITLB and 256 DTLB entries, a full flush would mean that more than 100 and 200 entries (respectively) would be flushed unnecessarily. When the system call returns to the same process, all those flushed TLB entries could be used again, but they will be gone. The same is true for often-used code in the kernel or VMM. On each entry into the kernel the TLB has to be filled from scratch even though the page tables for the kernel and VMM usually do not change and, therefore, TLB entries could, in theory, be preserved for a very long time. This also explains why the TLB caches in today's processors are not bigger: programs most likely will not run long enough to fill all these entries.

This fact, of course, did not escape the CPU architects. One possibility to optimize the cache flushes is to individually invalidate TLB entries. For instance, if the kernel code and data falls into a specific address range, only the pages falling into this address range have to evicted from the TLB. This only requires comparing tags and, therefore, is not very expensive. This method is also useful in case a part of the address space is changed, for instance, through a call to munmap.

A much better solution is to extend the tag used for the TLB access. If, in addition to the part of the virtual address, a unique identifier for each page table tree (i.e., a process's address space) is added, the TLB does not have to be completely flushed at all. The kernel, VMM, and the individual processes all can have unique identifiers. The only issue with this scheme is that the number of bits available for the TLB tag is severely limited, while the number of address spaces is not. This means some identifier reuse is necessary. When this happens the TLB has to be partially flushed (if this is possible). All entries with the reused identifier must be flushed but this is, hopefully, a much smaller set.

This extended TLB tagging is of general advantage when multiple processes are running on the system. If the memory use (and hence TLB entry use) of each of the runnable processes is limited, there is a good chance the most recently used TLB entries for a process are still in the TLB when it gets scheduled again. But there are two additional advantages:

1. Special address spaces, such as those used by the kernel and VMM, are often only entered for a short time; afterward control is often returned to the address space which initiated the call. Without tags, two TLB flushes are performed. With tags the calling address space's cached translations are preserved and, since the kernel and VMM address space do not often change TLB entries at all, the translations from previous system calls, etc. can still be used.

2. When switching between two threads of the same process no TLB flush is necessary at all. Without extended TLB tags the entry into the kernel destroys the first thread's TLB entries, though.

Some processors have, for some time, implemented these extended tags. AMD introduced a 1-bit tag extension with the Pacifica virtualization extensions. This 1-bit Address Space ID (ASID) is, in the context of virtualization, used to distinguish the VMM's address space from that of the guest domains. This allows the OS to avoid flushing the guest's TLB entries every time the VMM is entered (for instance, to handle a page fault) or the VMM's TLB entries when control returns to the guest. The architecture will allow the use of more bits in the future. Other mainstream processors will likely follow suit and support this feature.

4.3.2 Influencing TLB Performance

There are a couple of factors which influence TLB performance. The first is the size of the pages. Obviously, the larger a page is, the more instructions or data objects will fit into it. So a larger page size reduces the overall number of address translations which are needed, meaning that fewer entries in the TLB cache are needed. Most architectures allow the use of multiple different page sizes; some sizes can be used concurrently. For instance, the x86/x86-64 processors have a normal page size of 4kB but they can also use 4MB and 2MB pages respectively. IA-64 and PowerPC allow sizes like 64kB as the base page size.

The use of large page sizes brings some problems with it, though. The memory regions used for the large pages must be contiguous in physical memory. If the unit size for the administration of physical memory is raised to the size of the virtual memory pages, the amount of wasted memory will grow. All kinds of memory operations (like loading executables) require alignment to page boundaries. This means, on average, that each mapping wastes half the page size in physical memory for each mapping. This waste can easily add up; it thus puts an upper limit on the reasonable unit size for physical memory allocation.

It is certainly not practical to increase the unit size to 2MB to accommodate large pages on x86-64. This is just too large a size. But this in turn means that each large page has to be comprised of many smaller pages. And these small pages have to be contiguous in physical memory. Allocating 2MB of contiguous physical memory with a unit page size of 4kB can be challenging. It requires finding a free area with 512 contiguous pages. This can be extremely difficult (or impossible) after the system runs for a while and physical memory becomes fragmented.

On Linux it is therefore necessary to pre-allocate these big pages at system start time using the special hugetlbfs filesystem. A fixed number of physical pages are reserved for exclusive use as big virtual pages. This ties down resources which might not always be used. It also is a limited pool; increasing it normally means restarting the system. Still, huge pages are the way to go in situations where performance is a premium, resources are plenty, and cumbersome setup is not a big deterrent. Database servers are an example.

Increasing the minimum virtual page size (as opposed to optional big pages) has its problems, too. Memory mapping operations (loading applications, for example) must conform to these page sizes. No smaller mappings are possible. The location of the various parts of an executable have, for most architectures, a fixed relationship. If the page size is increased beyond what has been taken into account when the executable or DSO was built, the load operation cannot be performed. It is important to keep this limitation in mind. Figure 4.3 shows how the alignment requirements of an ELF binary can be determined. It is encoded in the ELF program header.

$ eu-readelf -l /bin/ls
Program Headers:
  Type   Offset   VirtAddr           PhysAddr           FileSiz  MemSiz   Flg Align
...
  LOAD   0x000000 0x0000000000400000 0x0000000000400000 0x0132ac 0x0132ac R E 0x200000
  LOAD   0x0132b0 0x00000000006132b0 0x00000000006132b0 0x001a71 0x001a71 RW  0x200000
...

Figure 4.3: ELF Program Header Indicating Alignment Requirements

In this example, an x86-64 binary, the value is 0x200000 = 2,097,152 = 2MB which corresponds to the maximum page size supported by the processor.

There is a second effect of using larger page sizes: the number of levels of the page table tree is reduced. Since the part of the virtual address corresponding to the page offset increases, there are not that many bits left which need to be handled through page directories. This means that, in case of a TLB miss, the amount of work which has to be done is reduced.

Beyond using large page sizes, it is possible to reduce the number of TLB entries needed by moving data which is used at the same time to fewer pages. This is similar to some optimizations for cache use we talked about above. Only now the alignment required is large. Given that the number of TLB entries is quite small this can be an important optimization.

4.4 Impact Of Virtualization

Virtualization of OS images will become more and more prevalent; this means another layer of memory handling is added to the picture. Virtualization of processes (basically jails) or OS containers do not fall into this category since only one OS is involved. Technologies like Xen or KVM enable—with or without help from the processor—the execution of independent OS images. In these situations there is one piece of software alone which directly controls access to the physical memory.

Figure 4.4: Xen Virtualization Model

In the case of Xen (see Figure 4.4) the Xen VMM is that piece of software. The VMM does not implement many of the other hardware controls itself, though. Unlike VMMs on other, earlier systems (and the first release of the Xen VMM) the hardware outside of memory and processors is controlled by the privileged Dom0 domain. Currently, this is basically the same kernel as the unprivileged DomU kernels and, as far as memory handling is concerned, they do not differ. Important here is that the VMM hands out physical memory to the Dom0 and DomU kernels which, themselves, then implement the usual memory handling as if they were running directly on a processor.

To implement the separation of the domains which is required for the virtualization to be complete, the memory handling in the Dom0 and DomU kernels does not have unrestricted access to physical memory. The VMM does not hand out memory by giving out individual physical pages and letting the guest OSes handle the addressing; this would not provide any protection against faulty or rogue guest domains. Instead, the VMM creates its own page table tree for each guest domain and hands out memory using these data structures. The good thing is that access to the administrative information of the page table tree can be controlled. If the code does not have appropriate privileges it cannot do anything.

This access control is exploited in the virtualization Xen provides, regardless of whether para- or hardware (aka full) virtualization is used. The guest domains construct their page table trees for each process in a way which is intentionally quite similar for para- and hardware virtualization. Whenever the guest OS modifies its page tables the VMM is invoked. The VMM then uses the updated information in the guest domain to update its own shadow page tables. These are the page tables which are actually used by the hardware. Obviously, this process is quite expensive: each modification of the page table tree requires an invocation of the VMM. While changes to the memory mapping are not cheap without virtualization they become even more expensive now.

The additional costs can be really large, considering that the changes from the guest OS to the VMM and back themselves are already quite expensive. This is why the processors are starting to have additional functionality to avoid the creation of shadow page tables. This is good not only because of speed concerns but it also reduces memory consumption by the VMM. Intel has Extended Page Tables (EPTs) and AMD calls it Nested Page Tables (NPTs). Basically both technologies have the page tables of the guest OSes produce virtual physical addresses. These addresses must then be further translated, using the per-domain EPT/NPT trees, into actual physical addresses. This will allow memory handling at almost the speed of the no-virtualization case since most VMM entries for memory handling are removed. It also reduces the memory use of the VMM since now only one page table tree for each domain (as opposed to process) has to be maintained.

The results of the additional address translation steps are also stored in the TLB. That means the TLB does not store the virtual physical address but, instead, the complete result of the lookup. It was already explained that AMD's Pacifica extension introduced the ASID to avoid TLB flushes on each entry. The number of bits for the ASID is one in the initial release of the processor extensions; this is just enough to differentiate VMM and guest OS. Intel has virtual processor IDs (VPIDs) which serve the same purpose, only there are more of them. But the VPID is fixed for each guest domain and therefore it cannot be used to mark separate processes and avoid TLB flushes at that level, too.

The amount of work needed for each address space modification is one problem with virtualized OSes. There is another problem inherent in VMM-based virtualization, though: there is no way around having two layers of memory handling. But memory handling is hard (especially when taking complications like NUMA into account, see Section 5). The Xen approach of using a separate VMM makes optimal (or even good) handling hard since all the complications of a memory management implementation, including “trivial” things like discovery of memory regions, must be duplicated in the VMM. The OSes have fully-fledged and optimized implementations; one really wants to avoid duplicating them.

Figure 4.5: KVM Virtualization Model

This is why carrying the VMM/Dom0 model to its conclusion is such an attractive alternative. Figure 4.5 shows how the KVM Linux kernel extensions try to solve the problem. There is no separate VMM running directly on the hardware and controlling all the guests; instead, a normal Linux kernel takes over this functionality. This means the complete and sophisticated memory handling functionality in the Linux kernel is used to manage the memory of the system. Guest domains run alongside the normal user-level processes in what the creators call “guest mode”. The virtualization functionality, para- or full virtualization, is controlled by another user-level process, the KVM VMM. This is just another process which happens to control a guest domain using the special KVM device the kernel implements.

The benefit of this model over the separate VMM of the Xen model is that, even though there are still two memory handlers at work when guest OSes are used, there only needs to be one implementation, that in the Linux kernel. It is not necessary to duplicate the same functionality in another piece of code like the Xen VMM. This leads to less work, fewer bugs, and, perhaps, less friction where the two memory handlers touch since the memory handler in a Linux guest makes the same assumptions as the memory handler in the outer Linux kernel which runs on the bare hardware.

Overall, programmers must be aware that, with virtualization used, the cost of memory operations is even higher than without virtualization. Any optimization which reduces this work will pay off even more in virtualized environments. Processor designers will, over time, reduce the difference more and more through technologies like EPT and NPT but it will never completely go away.

Comments (16 posted)

Page editor: Jonathan Corbet

Security

Home routers and security flaws

A message to Bugtraq about vulnerabilities in the British Telecom (BT) Home Hub this week had a familiar ring to it. We covered a cautionary posting about these kinds of problems in May, now we have a report of easily exploited flaws in a home router that is widely deployed in the UK. Unfortunately, we will probably have to cover the problem again, as these devices are becoming ubiquitous, while the manufacturers and distributors are, seemingly, leaving the security testing to their users.

The Home Hub is a standard Thompson/Alcatel DSL router, branded and distributed by BT, that provides VoIP and digital television in addition to internet access. It also has Wi-Fi connectivity which can provide shared access to the neighborhood via the Fon network. Overall, it sounds like a nice device, providing multiple useful features, but it evidently can be completely taken over ("owned") rather easily.

The exact details of the exploits used are not revealed, but the video linked from the discoverer's website shows web access to the router's administration screen after luring the victim into following a malicious link. The description of the flaws found read like a laundry list of web application flaws: cross-site scripting, cross-site request forgery, and authentication bypass. Though the router runs Linux, presumably the flaws are specific to the application software or configuration of the router; at least no more widespread vulnerability was reported.

Full access to the router configuration allows for a mind-boggling number of malicious uses. As is pointed out in the posting, one could steal VoIP credentials, reroute VoIP calls for eavesdropping, steal the WEP keys, change the DNS to point to a server under the attacker's control in order to steal credentials, etc. Most of these would be completely undetectable in normal use and the owner might go a long time before noticing that the settings had changed – if they can even log in anymore.

According to the website, BT has responded and is investigating the flaws, presumably some kind of update will be forthcoming. Home routers are particularly sensitive targets, precisely because of the undetectable nature of the attack. If the attacker is careful enough not to interrupt normal functioning, the owner will have no reason to check the configuration.

These kinds of problems are not restricted to routers or embedded networking devices, of course, but they do make tempting targets. Because of that, and the difficulty of ensuring that all customers get a critical security update, vendors of these products and the internet providers that push them need to test very carefully. Someone other than the developers should be tasked with strenuous penetration testing on a device like this, before it gets in the hands of customers.

Updating the devices in the field pose a number of problems; the obvious solution is to do it automatically, without customer intervention. But, as iPhone unlockers recently found out, that can lead to unwanted "upgrades". It is an uneasy balancing act – customers will need to trust the device providers to only update for bugs or security holes, while the providers will need to earn that trust by not breaking functionality the customer relies upon. Otherwise, folks will figure out ways to disable the auto-update functionality, completely defeating the purpose.

This particular incident seems not to exploit any particular Linux problem, but we might not be so lucky the next time. It would be a tragedy to see Linux linked with an in-the-wild exploit of a vulnerable device. An unknown exploit (a so-called "zero day") would be bad enough, but a known kernel bug that did not get properly updated would be a far worse black eye.

Comments (7 posted)

Brief items

Gathering 'Storm' Superworm Poses Grave Threat to PC Nets (Wired)

Bruce Schneier worries about the Storm worm on Wired. "Rather than having all hosts communicate to a central server or set of servers, Storm uses a peer-to-peer network for C2. This makes the Storm botnet much harder to disable. The most common way to disable a botnet is to shut down the centralized control point. Storm doesn't have a centralized control point, and thus can't be shut down that way."

Comments (none posted)

New vulnerabilities

debian-goodies: privilege escalation

Package(s):	debian-goodies	CVE #(s):	CVE-2007-3912
Created:	October 5, 2007	Updated:	March 24, 2008
Description:	Thomas de Grenier de Latour discovered that the checkrestart program included in debian-goodies did not correctly handle shell meta-characters. A local attacker could exploit this to gain the privileges of the user running checkrestart.
Alerts:	Debian DSA-1527-1 2008-03-24 Ubuntu USN-526-1 2007-10-04

Comments (none posted)

gforge: cross-site scripting

Package(s):	gforge	CVE #(s):	CVE-2007-3918
Created:	October 5, 2007	Updated:	October 10, 2007
Description:	It was discovered that a cross site scripting vulnerability in GForge, a collaborative development tool, allows remote attackers to inject arbitrary web script or HTML in the context of a logged in user's session.
Alerts:	Debian DSA-1383-1 2007-10-04

Comments (none posted)

imagemagick: multiple vulnerabilities

Package(s):	imagemagick	CVE #(s):	CVE-2007-4985 CVE-2007-4986 CVE-2007-4987 CVE-2007-4988
Created:	October 4, 2007	Updated:	August 11, 2009
Description:	The ImageMagick image decoders have multiple vulnerabilities. If a user can be tricked into processing a specially crafted DCM, DIB, XBM, XCF, or XWD image, arbitrary code may be executed with the user's privileges.
Alerts:	Debian DSA-1858-1 2009-08-10 Red Hat RHSA-2008:0145-01 2008-04-16 Red Hat RHSA-2008:0165-01 2008-04-16 Mandriva MDVSA-2008:035 2007-02-05 Foresight FLEA-2007-0066-1 2007-11-11 Gentoo 200710-27 2007-10-24 rPath rPSA-2007-0220-1 2007-10-18 Ubuntu USN-523-1 2007-10-03 Oracle ELSA-2012-0301 2012-03-07

Comments (none posted)

opal: denial of service

Package(s):	opal	CVE #(s):	CVE-2007-4924
Created:	October 8, 2007	Updated:	January 9, 2008
Description:	From the Red Hat advisory: A flaw was discovered in the way opal handled certain Session Initiation Protocol (SIP) packets. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with opal. (CVE-2007-4924)
Alerts:	Ubuntu USN-562-1 2008-01-08 Mandriva MDKSA-2007:205 2007-11-02 Red Hat RHSA-2007:0957-01 2007-10-08

Comments (none posted)

pwlib: denial of service

Package(s):	pwlib	CVE #(s):	CVE-2007-4897
Created:	October 8, 2007	Updated:	January 9, 2008
Description:	From the Red Hat advisory: A memory management flaw was discovered in PWLib. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with pwlib (CVE-2007-4897).
Alerts:	Ubuntu USN-561-1 2008-01-08 Mandriva MDKSA-2007:206 2007-11-02 Red Hat RHSA-2007:0932-01 2007-10-08

Comments (none posted)

ruby: insufficient SSL certificate validation

Package(s):	ruby	CVE #(s):	CVE-2007-5162 CVE-2007-5770
Created:	October 8, 2007	Updated:	October 10, 2008
Description:	The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
Alerts:	Fedora FEDORA-2008-6094 2008-07-04 Fedora FEDORA-2008-6033 2008-07-03 Ubuntu USN-596-1 2008-03-26 Fedora FEDORA-2008-2443 2008-03-13 Fedora FEDORA-2008-2458 2008-03-13 Mandriva MDVSA-2008:029 2007-01-31 Debian DSA-1411-1 2007-11-24 SuSE SUSE-SR:2007:024 2007-11-22 Debian DSA-1412-1 2007-11-24 Debian DSA-1410-1 2007-11-24 Red Hat RHSA-2007:0961-01 2007-11-13 Red Hat RHSA-2007:0965-01 2007-11-13 Foresight FLEA-2007-0068-1 2007-11-11 Fedora FEDORA-2007-2812 2007-11-06 Fedora FEDORA-2007-738 2007-11-05 Fedora FEDORA-2007-2685 2007-10-29 Fedora FEDORA-2007-2406 2007-10-08 Fedora FEDORA-2007-718 2007-10-08

Comments (none posted)

tk: arbitrary code execution via malformed GIF

Package(s):	tk	CVE #(s):	CVE-2007-4851
Created:	October 8, 2007	Updated:	October 10, 2007
Description:	From the Gentoo advisory: Reinhard Max discovered a boundary error in Tk when processing an interlaced GIF with two frames where the second is smaller than the first one.
Alerts:	Gentoo 200710-07 2007-10-07

Comments (1 posted)

util-linux: privilege escalation

Package(s):	util-linux	CVE #(s):	CVE-2007-5191
Created:	October 9, 2007	Updated:	January 7, 2008
Description:	mount and umount in util-linux call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.
Alerts:	Debian DSA-1450-1 2008-01-05 Debian DSA-1449-1 2008-01-05 Red Hat RHSA-2007:0969-01 2007-11-15 SuSE SUSE-SR:2007:022 2007-10-26 Ubuntu USN-533-1 2007-10-22 Gentoo 200710-18 2007-10-18 Mandriva MDKSA-2007:198 2007-10-15 Fedora FEDORA-2007-722 2007-10-15 Fedora FEDORA-2007-2462 2007-10-10 rPath rPSA-2007-0212-1 2007-10-08

Comments (none posted)

x11: xfs font server overflows

Package(s):	x11	CVE #(s):	CVE-2007-4568 CVE-2007-4989 CVE-2007-4990
Created:	October 4, 2007	Updated:	January 18, 2008
Description:	xorg-x11 has a number of integer and heap overflow vulnerabilities in the xfs font server. A local attacker may be able to use these for the execution of arbitrary code with elevated privileges.
Alerts:	Red Hat RHSA-2008:0029-01 2008-01-18 Red Hat RHSA-2008:0030-01 2008-01-17 Fedora FEDORA-2007-4263 2007-12-10 Mandriva MDKSA-2007:210 2007-11-06 Gentoo 200710-11 2007-10-12 SuSE SUSE-SA:2007:054 2007-10-12 Debian DSA-1385-1 2007-10-09 rPath rPSA-2007-0205-1 2007-10-03

Comments (none posted)

xen: privilege escalation

Package(s):	xen	CVE #(s):	CVE-2007-4993
Created:	October 9, 2007	Updated:	November 2, 2007
Description:	pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec statements.
Alerts:	Fedora FEDORA-2007-2708 2007-11-01 Mandriva MDKSA-2007:203 2007-11-01 Ubuntu USN-527-1 2007-10-05 rPath rPSA-2007-0210-1 2007-10-08

Comments (1 posted)

Updated vulnerabilities

acroread: multiple vulnerabilities

Package(s):	acroread	CVE #(s):	CVE-2006-5857 CVE-2007-0045 CVE-2007-0046
Created:	January 11, 2007	Updated:	October 26, 2009
Description:	Adobes acrobat reader has the following vulnerabilities: The Adobe Reader Plugin has a cross site scripting vulnerability that can be triggered by processes malformed URLs. Arbitrary JavaScript can be served by a malicious web server, leading to a cross-site scripting attack. Maliciously crafted PDF files can be used to trigger two vulnerabilities, if an attacker can trick a user into viewing the files, arbitrary code can be executed with the user's privileges.
Alerts:	SuSE SUSE-SA:2009:049 2009-10-26 Gentoo 200910-03 2009-10-25 Red Hat RHSA-2007:0021-01 2007-01-22 Gentoo 200701-16 2007-01-22 SuSE SUSE-SA:2007:011 2007-01-22 Red Hat RHSA-2007:0017-01 2007-01-11

Comments (1 posted)

apache2: information disclosure

Package(s):	apache	CVE #(s):	CVE-2007-1862
Created:	June 20, 2007	Updated:	February 18, 2008
Description:	From the Mandriva advisory: "The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously-used data, which could be used to obtain potentially sensitive information by unauthorized users."
Alerts:	Fedora FEDORA-2008-1711 2008-02-15 Fedora FEDORA-2007-0704 2007-06-26 Mandriva MDKSA-2007:127 2007-06-19

Comments (2 posted)

apache: multiple vulnerabilities

Package(s):	apache	CVE #(s):	CVE-2007-3304 CVE-2006-5752
Created:	June 27, 2007	Updated:	February 18, 2008
Description:	The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker who has the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated, which could lead to a denial of service. (CVE-2007-3304) A flaw was found in the Apache HTTP Server mod_status module. Sites with the server-status page publicly accessible and ExtendedStatus enabled were vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available. (CVE-2006-5752)
Alerts:	Fedora FEDORA-2008-1711 2008-02-15 SuSE SUSE-SA:2007:061 2007-11-19 Fedora FEDORA-2007-2214 2007-09-18 rPath rPSA-2007-0182-1 2007-09-14 Ubuntu USN-499-1 2007-08-16 Red Hat RHSA-2007:0662-01 2007-07-13 Red Hat RHSA-2007:0557-01 2007-07-13 Fedora FEDORA-2007-615 2007-07-12 Mandriva MDKSA-2007:142 2007-07-04 Mandriva MDKSA-2007:141 2007-07-04 Mandriva MDKSA-2007:140 2007-07-04 Fedora FEDORA-2007-617 2007-07-02 rPath rPSA-2007-0136-1 2007-06-27 Red Hat RHSA-2007:0556-01 2007-06-26 Red Hat RHSA-2007:0534-01 2007-06-26 Red Hat RHSA-2007:0533-01 2007-06-27 Red Hat RHSA-2007:0532-01 2007-06-26

Comments (1 posted)

apache: cross-site scripting

Package(s):	apache	CVE #(s):	CVE-2006-3918
Created:	August 9, 2006	Updated:	April 4, 2008
Description:	From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header."
Alerts:	SuSE SUSE-SA:2008:021 2008-04-04 Ubuntu USN-575-1 2008-02-04 SuSE SUSE-SA:2006:051 2006-09-08 Debian DSA-1167-1 2005-09-04 Red Hat RHSA-2006:0619-01 2006-08-10 Red Hat RHSA-2006:0618-01 2006-08-08

Comments (none posted)

httpd: denial of service, cross-site scripting

Package(s):	apache httpd	CVE #(s):	CVE-2007-3847 CVE-2007-4465
Created:	September 25, 2007	Updated:	February 15, 2008
Description:	A flaw was found in the mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-3847) A flaw was found in the mod_autoindex module. On sites where directory listings are used, and the AddDefaultCharset directive has been removed from the configuration, a cross-site-scripting attack may be possible against browsers which do not correctly derive the response character set following the rules in RFC 2616. (CVE-2007-4465)
Alerts:	Slackware SSA:2008-045-02 2008-02-15 Ubuntu USN-575-1 2008-02-04 Red Hat RHSA-2008:0008-01 2008-01-15 Red Hat RHSA-2008:0006-01 2008-01-15 Red Hat RHSA-2008:0005-01 2008-01-15 Red Hat RHSA-2008:0004-01 2008-01-15 Mandriva MDKSA-2007:235 2007-12-03 SuSE SUSE-SA:2007:061 2007-11-19 Red Hat RHSA-2007:0747-02 2007-11-15 Gentoo 200711-06 2007-11-07 Red Hat RHSA-2007:0746-04 2007-11-07 Red Hat RHSA-2007:0911-01 2007-10-25 Fedora FEDORA-2007-707 2007-09-24

Comments (none posted)

avahi: denial of service

Package(s):	avahi	CVE #(s):	CVE-2007-3372
Created:	June 28, 2007	Updated:	December 23, 2008
Description:	Avahi is vulnerable to a local denial of service that can be caused by making an erroneous call to the assert() function.
Alerts:	Debian DSA-1690-1 2008-12-22 Ubuntu USN-696-1 2008-12-18 Mandriva MDKSA-2007:185 2007-09-17 Foresight FLEA-2007-0030-1 2007-06-28

Comments (none posted)

bochs: buffer overflow

Package(s):	bochs	CVE #(s):	CVE-2007-2893
Created:	July 20, 2007	Updated:	November 19, 2007
Description:	A heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."
Alerts:	Gentoo 200711-21 2007-11-17 Fedora FEDORA-2007-1778 2007-08-23 Debian DSA-1351-1 2007-08-07 Fedora FEDORA-2007-1153 2007-07-19

Comments (none posted)

bugzilla: multiple vulnerabilities

Package(s):	bugzilla	CVE #(s):	CVE-2007-4543 CVE-2007-4538 CVE-2007-4539
Created:	October 1, 2007	Updated:	October 3, 2007
Description:	Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the "buildid" parameter when filing bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla 2.23.3 or later, hence the stable Gentoo Portage tree does not contain these two vulnerabilities: Loic Minier reported that the "Email::Send::Sendmail()" function does not properly sanitise "from" email information before sending it to the "-f" parameter of /usr/sbin/sendmail (CVE-2007-4538), and Frédéric Buclin discovered that the XML-RPC interface does not correctly check permissions in the time-tracking fields (CVE-2007-4539).
Alerts:	Gentoo 200709-18 2007-09-30

Comments (1 posted)

cacti: denial of service

Package(s):	cacti	CVE #(s):	CVE-2007-3112 CVE-2007-3113
Created:	September 18, 2007	Updated:	December 16, 2009
Description:	A vulnerability in Cacti 0.8.6i and earlier versions allows remote authenticated users to cause a denial of service (CPU consumption) via large values of the graph_start, graph_end, graph_height, or graph_width parameters.
Alerts:	Debian DSA-1954-1 2009-12-16 Fedora FEDORA-2008-1737 2008-02-15 Fedora FEDORA-2007-3683 2007-11-22 Fedora FEDORA-2007-2199 2007-09-18 Mandriva MDKSA-2007:184 2007-09-17

Comments (none posted)

centericq: buffer overflows

Package(s):	centericq	CVE #(s):	CVE-2007-3713
Created:	July 20, 2007	Updated:	December 17, 2007
Description:	Multiple buffer overflows in Konst CenterICQ 4.9.11 through 4.21 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this might overlap CVE-2007-0160.
Alerts:	Debian DSA-1433-1 2007-12-16 Debian-Testing DTSA-55-1 2007-09-03 Fedora FEDORA-2007-1160 2007-07-19

Comments (none posted)

clamav: denial of service

Package(s):	clamav	CVE #(s):	CVE-2007-3725
Created:	July 24, 2007	Updated:	February 27, 2008
Description:	A NULL pointer dereference has been discovered in the RAR VM of Clam Antivirus (ClamAV) which allows user-assisted remote attackers to cause a denial of service via a specially crafted RAR archives.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Gentoo 200708-04 2007-08-09 Mandriva MDKSA-2007:150 2007-07-25 Debian DSA-1340-1 2007-07-24

Comments (none posted)

clamav: multiple vulnerabilities

Package(s):	clamav	CVE #(s):	CVE-2007-4510 CVE-2007-4560
Created:	September 3, 2007	Updated:	February 13, 2008
Description:	Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-4510: It was discovered that the RTF and RFC2397 parsers can be tricked into dereferencing a NULL pointer, resulting in denial of service. CVE-2007-4560: It was discovered clamav-milter performs insufficient input sanitizing, resulting in the execution of arbitrary shell commands.
Alerts:	Fedora FEDORA-2008-1608 2008-02-13 Fedora FEDORA-2008-0170 2008-01-22 Gentoo 200709-14 2007-09-20 Fedora FEDORA-2007-2050 2007-09-07 Mandriva MDKSA-2007:172 2007-08-31 Debian DSA-1366-1 2007-09-01

Comments (none posted)

cpio: arbitrary code execution

Package(s):	cpio	CVE #(s):	CVE-2005-4268
Created:	January 2, 2006	Updated:	March 17, 2010
Description:	Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).
Alerts:	CentOS CESA-2010:0145 2010-03-17 Red Hat RHSA-2010:0145-01 2010-03-15 rPath rPSA-2007-0094-1 2007-05-07 Red Hat RHSA-2007:0245-02 2007-05-01 Ubuntu USN-234-1 2006-01-02

Comments (none posted)

vixie-cron: privilege escalation

Package(s):	cron	CVE #(s):	CVE-2006-2607
Created:	May 31, 2006	Updated:	June 1, 2009
Description:	The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root.
Alerts:	Ubuntu USN-778-1 2009-06-01 Red Hat RHSA-2006:0539-01 2006-07-12 Gentoo 200606-07 2006-06-09 SuSE SUSE-SA:2006:027 2006-05-31 rPath rPSA-2006-0082-1 2006-05-25

Comments (1 posted)

cscope: buffer overflows

Package(s):	cscope	CVE #(s):	CVE-2006-4262
Created:	October 2, 2006	Updated:	June 16, 2009
Description:	Will Drewry of the Google Security Team discovered several buffer overflows in cscope, a source browsing tool, which might lead to the execution of arbitrary code.
Alerts:	CentOS CESA-2009:1101 2009-06-16 Red Hat RHSA-2009:1101-01 2009-06-15 Gentoo 200610-08 2006-10-20 Debian DSA-1186-1 2006-09-30

Comments (none posted)

cscope: buffer overflows

Package(s):	cscope	CVE #(s):	CVE-2004-2541
Created:	May 22, 2006	Updated:	June 19, 2009
Description:	A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.
Alerts:	CentOS CESA-2009:1102 2009-06-19 CentOS CESA-2009:1101 2009-06-16 Red Hat RHSA-2009:1102-01 2009-06-15 Red Hat RHSA-2009:1101-01 2009-06-15 Gentoo 200606-10 2006-06-11 Debian DSA-1064-1 2006-05-19

Comments (1 posted)

cups: denial of service

Package(s):	cups	CVE #(s):	CVE-2007-0720
Created:	March 26, 2007	Updated:	February 7, 2008
Description:	Previous versions of the cups package could be forced to hang via a client "partially negotiating" an ssl connection. In this state, cups would not allow other connections to be made, a denial of service.
Alerts:	Mandriva MDVSA-2008:036 2007-02-06 Mandriva MDKSA-2007:086 2007-04-16 Red Hat RHSA-2007:0123-01 2007-04-16 Gentoo 200703-28 2007-03-31 Foresight FLEA-2007-0003-1 2007-03-25

Comments (none posted)

gpdf: integer overflow

Package(s):	cups poppler xpdf	CVE #(s):	CVE-2007-3387
Created:	July 31, 2007	Updated:	November 28, 2007
Description:	The gpdf library contains an integer overflow which can be exploited via a malicious PDF file. This code finds its way into multiple packages, including xpdf, kpdf, poppler, cups, and more.
Alerts:	Fedora FEDORA-2007-3390 2007-11-20 Fedora FEDORA-2007-3308 2007-11-20 Gentoo 200710-20 2007-10-18 Gentoo 200710-08 2007-10-09 Gentoo 200709-12 2007-09-19 Fedora FEDORA-2007-685 2007-08-30 Debian-Testing DTSA-54-1 2007-08-22 Fedora FEDORA-2007-669 2007-08-13 Fedora FEDORA-2007-644 2007-08-13 Debian DSA-1357-1 2007-08-19 Mandriva MDKSA-2007:162 2007-08-14 Mandriva MDKSA-2007:165 2007-08-15 Foresight FLEA-2007-0046-1 2007-08-14 Fedora FEDORA-2007-1614 2007-08-15 Mandriva MDKSA-2007:164 2007-08-14 Mandriva MDKSA-2007:163 2007-08-14 Foresight FLEA-2007-0045-1 2007-08-14 Foresight FLEA-2007-0044-1 2007-08-14 Mandriva MDKSA-2007:158 2007-08-13 Mandriva MDKSA-2007:160 2007-08-13 Mandriva MDKSA-2007:161 2007-08-13 Mandriva MDKSA-2007:159 2007-08-13 Fedora FEDORA-2007-1594 2007-08-13 Debian DSA-1355-1 2007-08-13 Slackware SSA:2007-222-05 2007-08-13 Slackware SSA:2007-222-02 2007-08-13 Fedora FEDORA-2007-1547 2007-08-10 Fedora FEDORA-2007-1541 2007-08-10 Debian DSA-1354-1 2007-08-13 rPath rPSA-2007-0154-1 2007-08-10 SuSE SUSE-SR:2007:016 2007-08-10 Ubuntu USN-496-2 2007-08-07 Debian DSA-1352-1 2007-08-07 Debian DSA-1350-1 2007-08-06 Debian DSA-1349-1 2007-08-05 Debian DSA-1348-1 2007-08-04 Debian DSA-1347-1 2007-08-04 SuSE SUSE-SR:2007:015 2007-08-03 Ubuntu USN-496-1 2007-08-03 Red Hat RHSA-2007:0731-01 2007-08-01 Red Hat RHSA-2007:0735-01 2007-07-30 Red Hat RHSA-2007:0732-01 2007-07-30 Red Hat RHSA-2007:0729-01 2007-07-30 Red Hat RHSA-2007:0730-01 2007-07-30 Red Hat RHSA-2007:0720-01 2007-07-30

Comments (1 posted)

dovecot: privilege escalation

Package(s):	dovecot	CVE #(s):	CVE-2007-4211
Created:	August 15, 2007	Updated:	May 21, 2008
Description:	From the rPath advisory: "Previous versions of the dovecot package are vulnerable to a minor privilege escalation attack in which an authenticated user may exploit an ACL plugin weakness to save message flags without having proper permissions."
Alerts:	Red Hat RHSA-2008:0297-02 2008-05-21 Fedora FEDORA-2007-664 2007-08-20 rPath rPSA-2007-0161-1 2007-08-14

Comments (none posted)

dovecot: directory traversal

Package(s):	dovecot	CVE #(s):	CVE-2007-2231
Created:	May 8, 2007	Updated:	May 21, 2008
Description:	Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
Alerts:	Red Hat RHSA-2008:0297-02 2008-05-21 Debian DSA-1359-1 2007-08-28 Ubuntu USN-487-1 2007-07-17 Fedora FEDORA-2007-493 2007-05-07

Comments (none posted)

eggdrop: stack-based buffer overflow

Package(s):	eggdrop	CVE #(s):	CVE-2007-2807
Created:	September 7, 2007	Updated:	December 8, 2009
Description:	A stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, malicious remote IRC servers to execute arbitrary code via a long private message.
Alerts:	Mandriva MDVSA-2009:126-1 2009-12-08 Debian DSA-1826-1 2009-07-04 Mandriva MDVSA-2009:126 2009-06-01 Fedora FEDORA-2009-5572 2009-05-28 Fedora FEDORA-2009-5568 2009-05-28 Debian DSA-1448-1 2008-01-05 Fedora FEDORA-2007-4325 2007-12-10 Fedora FEDORA-2007-4305 2007-12-10 Gentoo 200709-07 2007-09-15 Mandriva MDKSA-2007:175 2007-09-06

Comments (none posted)

elinks: remote data sniffing

Package(s):	elinks	CVE #(s):	CVE-2007-5034
Created:	September 25, 2007	Updated:	October 9, 2007
Description:	ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Alerts:	Fedora FEDORA-2007-710 2007-10-08 rPath rPSA-2007-0209-1 2007-10-05 Red Hat RHSA-2007:0933-01 2007-10-03 Debian DSA-1380-1 2007-10-02 Ubuntu USN-519-1 2007-09-25 Fedora FEDORA-2007-2224 2007-09-24

Comments (none posted)

elinks: code execution

Package(s):	elinks	CVE #(s):	CVE-2007-2027
Created:	May 7, 2007	Updated:	October 30, 2009
Description:	Arnaud Giersch discovered that elinks incorrectly attempted to load gettext catalogs from a relative path. If a user were tricked into running elinks from a specific directory, a local attacker could execute code with user privileges.
Alerts:	Red Hat RHSA-2009:1471-01 2009-10-01 CentOS CESA-2009:1471 2009-10-06 CentOS CESA-2009:1471 2009-10-30 Gentoo 200706-03 2007-06-06 Ubuntu USN-457-1 2007-05-07 Oracle ELSA-2013-0250 2013-02-11

Comments (none posted)

elinks: arbitrary file access

Package(s):	elinks	CVE #(s):	CVE-2006-5925
Created:	November 16, 2006	Updated:	October 22, 2009
Description:	The elinks text-mode browser has an arbitrary file access vulnerability in the Elinks SMB protocol handler. If a user can be tricked into visiting a specially crafted web page, arbitrary files may be read or written with the user's permissions.
Alerts:	Ubuntu USN-851-1 2009-10-21 Gentoo 200701-27 2007-01-30 OpenPKG OpenPKG-SA-2006.043 2006-12-26 Debian DSA-1240-1 2006-12-21 Gentoo 200612-16 2006-12-14 Debian DSA-1228-1 2006-12-05 Debian DSA-1226-1 2006-12-03 Fedora FEDORA-2006-1278 2006-11-21 Fedora FEDORA-2006-1277 2006-11-21 Mandriva MDKSA-2006:216 2006-11-20 Red Hat RHSA-2006:0742-01 2006-11-15

Comments (none posted)

evolution: format string error

Package(s):	evolution	CVE #(s):	CVE-2007-1002
Created:	March 27, 2007	Updated:	February 27, 2008
Description:	A format string error in the "write_html()" function in calendar/gui/ e-cal-component-memo-preview.c when displaying a memo's categories can potentially be exploited to execute arbitrary code via a specially crafted shared memo containing format specifiers.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Gentoo 200706-02 2007-06-06 Red Hat RHSA-2007:0158-01 2007-05-03 Foresight FLEA-2007-0010-1 2007-04-05 Fedora FEDORA-2007-404 2007-04-04 Fedora FEDORA-2007-393 2007-04-04 Mandriva MDKSA-2007:070 2007-03-27

Comments (1 posted)

evolution-data-server: malicious server arbitrary code execution

Package(s):	evolution-data-server	CVE #(s):	CVE-2007-3257
Created:	June 18, 2007	Updated:	November 7, 2007
Description:	From the GNOME bugzilla: "The "SEQUENCE" value in the GData of the IMAP code (camel-imap-folder.c) is converted from a string using strtol. This allows for negative values. The imap_rescan uses this value as an int. It checks for !seq and seq>summary.length. It doesn't check for seq < 0. Although seq is used as the index of an array."
Alerts:	Gentoo 200711-04 2007-11-06 Gentoo 200707-03 2007-07-02 SuSE SUSE-SA:2007:042 2007-07-05 Debian DSA-1325-1 2007-06-29 Fedora FEDORA-2007-594 2007-06-27 Fedora FEDORA-2007-595 2007-06-27 Mandriva MDKSA-2007:136 2007-06-26 Red Hat RHSA-2007:0510-01 2007-06-25 Red Hat RHSA-2007:0509-01 2007-06-25 Debian DSA-1321-1 2007-06-23 Ubuntu USN-475-1 2007-06-21 Fedora FEDORA-2007-0464 2007-06-16

Comments (1 posted)

pop mail man-in-the-middle attacks

Package(s):	evolution thunderbird mutt fetchmail	CVE #(s):	CVE-2007-1558
Created:	May 8, 2007	Updated:	July 3, 2009
Description:	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird, (2) Evolution, (3) mutt, and (4) fetchmail.
Alerts:	CentOS CESA-2009:1140 2009-07-02 Red Hat RHSA-2009:1140-02 2009-07-02 Fedora FEDORA-2007-1447 2007-08-06 rPath rPSA-2007-0127-1 2007-06-19 Foresight FLEA-2007-0026-1 2007-06-18 rPath rPSA-2007-0122-1 2007-06-14 Red Hat RHSA-2007:0385-01 2007-06-07 rPath rPSA-2007-0114-1 2007-06-04 Mandriva MDKSA-2007:113 2007-06-04 Red Hat RHSA-2007:0386-01 2007-06-04 Fedora FEDORA-2007-0001 2007-06-01 Fedora FEDORA-2007-552 2007-05-31 Fedora FEDORA-2007-552 2007-05-31 Fedora FEDORA-2007-552 2007-05-31 Fedora FEDORA-2007-552 2007-05-31 Fedora FEDORA-2007-550 2007-05-31 Fedora FEDORA-2007-551 2007-05-31 Red Hat RHSA-2007:0401-01 2007-05-30 Fedora FEDORA-2007-539 2007-05-30 Fedora FEDORA-2007-540 2007-05-30 Red Hat RHSA-2007:0344-01 2007-05-30 Mandriva MDKSA-2007:107 2007-05-19 Mandriva MDKSA-2007:105 2007-05-17 Red Hat RHSA-2007:0353-01 2007-05-17 Fedora FEDORA-2007-484 2007-05-07 Fedora FEDORA-2007-485 2007-05-07

Comments (none posted)

fetchmail: denial of service

Package(s):	fetchmail	CVE #(s):	CVE-2007-4565
Created:	September 5, 2007	Updated:	October 30, 2009
Description:	fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.
Alerts:	CentOS CESA-2009:1427 2009-09-08 Red Hat RHSA-2009:1427-01 2009-09-08 CentOS CESA-2009:1427 2009-10-30 Ubuntu USN-520-1 2007-09-26 Debian DSA-1377-2 2007-09-21 Debian DSA-1377 2007-09-21 Mandriva MDKSA-2007:179 2007-09-11 Foresight FLEA-2007-0053-1 2007-09-06 rPath rPSA-2007-0178-1 2007-09-05 Fedora FEDORA-2007-1983 2007-09-04 Fedora FEDORA-2007-689 2007-09-04

Comments (none posted)

file: integer overflow

Package(s):	file	CVE #(s):	CVE-2007-2799
Created:	June 1, 2007	Updated:	October 19, 2007
Description:	Colin Percival from FreeBSD reported that the previous fix for the file_printf() buffer overflow introduced a new integer overflow. A remote attacker could entice a user to run the file program on an overly large file (more than 1Gb) that would trigger an integer overflow on 32-bit systems, possibly leading to the execution of arbitrary code with the rights of the user running file.
Alerts:	Gentoo 200710-19 2007-10-18 Debian DSA-1343-2 2007-09-25 Debian DSA-1343-1 2007-07-31 SuSE SUSE-SA:2007:040 2007-07-04 Fedora FEDORA-2007-0836 2007-07-03 Fedora FEDORA-2007-538 2007-06-11 Fedora FEDORA-2007-541 2007-06-11 Ubuntu USN-439-2 2007-06-11 Mandriva MDKSA-2007:114 2007-06-05 Gentoo 200705-25 2007-05-31

Comments (3 posted)

firebird: buffer overflow

Package(s):	firebird	CVE #(s):	CVE-2007-3181
Created:	July 2, 2007	Updated:	March 27, 2008
Description:	The Firebird DBMS has a buffer overflow vulnerability involving the processing of connect requests with an overly large p_cnct_count value. Remote attackers can send a specially crafted request to the server in order to potentially execute arbitrary code with the permissions of the Firebird user.
Alerts:	Debian DSA-1529-1 2008-03-24 Gentoo 200707-01 2007-07-01

Comments (none posted)

firefox: multiple vulnerabilities

Package(s):	firefox	CVE #(s):	CVE-2007-3844 CVE-2007-3845
Created:	August 1, 2007	Updated:	February 20, 2008
Description:	A flaw was discovered in handling of "about:blank" windows used by addons. A malicious web site could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3844) Jesper Johansson discovered that spaces and double-quotes were not correctly handled when launching external programs. In rare configurations, after tricking a user into opening a malicious web page, an attacker could execute helpers with arbitrary arguments with the user's privileges. (CVE-2007-3845)
Alerts:	Mandriva MDVSA-2007:047 2007-02-19 Fedora FEDORA-2007-3414 2007-11-16 Fedora FEDORA-2007-3431 2007-11-16 Red Hat RHSA-2007:0981-01 2007-10-19 Red Hat RHSA-2007:0980-01 2007-10-19 Red Hat RHSA-2007:0979-01 2007-10-19 Debian DSA-1391-1 2007-10-19 Gentoo 200708-09 2007-08-14 rPath rPSA-2007-0157-1 2007-08-10 Slackware SSA:2007-215-01 2007-08-06 Debian DSA-1346-1 2007-08-04 Debian DSA-1345-1 2007-08-04 Debian DSA-1344-1 2007-08-03 Foresight FLEA-2007-0040-1 2007-08-03 Slackware SSA:2007-213-01 2007-08-02 Mandriva MDKSA-2007:152 2007-08-01 Foresight FLEA-2007-0039-1 2007-08-01 Ubuntu USN-493-1 2007-07-31

Comments (none posted)

firefox, thunderbird, seamonkey: multiple vulnerabilities

Package(s):	firefox, thunderbird, seamonkey	CVE #(s):	CVE-2007-3738 CVE-2007-3656 CVE-2007-3670 CVE-2007-3285 CVE-2007-3737 CVE-2007-3089 CVE-2007-3736 CVE-2007-3734 CVE-2007-3735
Created:	July 18, 2007	Updated:	May 12, 2008
Description:	shutdown and moz_bug_r_a4 reported two separate ways to modify an XPCNativeWrapper such that subsequent access by the browser would result in executing user-supplied code. (CVE-2007-3738) Michal Zalewski reported that it was possible to bypass the same-origin checks and read from cached (wyciwyg) documents It is possible to access wyciwyg:// documents without proper same domain policy checks through the use of HTTP 302 redirects. This enables the attacker to steal sensitive data displayed on dynamically generated pages; perform cache poisoning; and execute own code or display own content with URL bar and SSL certificate data of the attacked page (URL spoofing++). (CVE-2007-3656) Internet Explorer calls registered URL protocols without escaping quotes and may be used to pass unexpected and potentially dangerous data to the application that registers that URL Protocol. (CVE-2007-3670) Ronald van den Heetkamp reported that a filename URL containing %00 (encoded null) can cause Firefox to interpret the file extension differently than the underlying Windows operating system potentially leading to unsafe actions such as running a program. This is only accessible locally. (CVE-2007-3285) An attacker can use an element outside of a document to call an event handler allowing content to run arbitrary code with chrome privileges. (CVE-2007-3737) Ronen Zilberman and Michal Zalewski both reported that it was possible to exploit a timing issue to inject content into about:blank frames in a page. When opening a window from a script, it is possible to spoof the content of the newly opened window's frames within a short time frame, while the window is loading. (CVE-2007-3089) Mozilla contributor moz_bug_r_a4 demonstrated that the methods addEventListener and setTimeout could be used to inject script into another site in violation of the browser's same-origin policy. This could be used to access or modify private or valuable information from that other site. (CVE-2007-3736) As part of the Firefox 2.0.0.5 update releases Mozilla developers fixed many bugs to improve the stability of the product. Some of these crashes that showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Note: Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript, such as large images. (CVE-2007-3734, CVE-2007-3735)
Alerts:	Debian DSA-1574-1 2008-05-12 Debian DSA-1534-2 2008-04-24 Debian DSA-1535-1 2008-03-30 Debian DSA-1534-1 2008-03-28 Debian DSA-1532-1 2008-03-27 Mandriva MDVSA-2007:047 2007-02-19 Ubuntu USN-503-1 2007-08-24 Slackware SSA:2007-222-04 2007-08-13 SuSE SUSE-SA:2007:049 2007-08-02 Slackware SSA:2007-205-02 2007-07-25 Slackware SSA:2007-205-01 2007-07-25 Foresight FLEA-2007-0033-1 2007-07-24 Debian DSA-1339-1 2007-07-23 Debian DSA-1338-1 2007-07-23 Fedora FEDORA-2007-1181 2007-07-20 Fedora FEDORA-2007-1180 2007-07-20 Debian DSA-1337-1 2007-07-22 Fedora FEDORA-2007-642 2007-07-20 Fedora FEDORA-2007-641 2007-07-20 rPath rPSA-2007-0148-1 2007-07-20 Ubuntu USN-490-1 2007-07-19 Slackware SSA:2007-200-01 2007-07-20 Fedora FEDORA-2007-1159 2007-07-19 Fedora FEDORA-2007-1157 2007-07-19 Fedora FEDORA-2007-1155 2007-07-19 Red Hat RHSA-2007:0724-01 2007-07-18 Red Hat RHSA-2007:0723-01 2007-07-18 Red Hat RHSA-2007:0722-01 2007-07-18 Fedora FEDORA-2007-1143 2007-07-18 Fedora FEDORA-2007-1144 2007-07-18 Fedora FEDORA-2007-1142 2007-07-18 Fedora FEDORA-2007-1138 2007-07-18

Comments (none posted)

flac123: arbitrary code execution

Package(s):	flac123	CVE #(s):	CVE-2007-3507
Created:	July 13, 2007	Updated:	October 22, 2007
Description:	A stack-based buffer overflow in the local__vcentry_parse_value function in vorbiscomment.c in flac123 (aka flac-tools or flac) before 0.0.10 allows user-assisted remote attackers to execute arbitrary code via a large comment value_length.
Alerts:	Gentoo 200709-06 2007-09-14 Fedora FEDORA-2007-1045 2007-07-12

Comments (none posted)

freetype: arbitrary code execution

Package(s):	freetype	CVE #(s):	CVE-2007-2754
Created:	May 24, 2007	Updated:	June 1, 2010
Description:	The Freetype font rendering library versions 2.3.4 and below has an integer sign error. Remote attackers may be able to create a specially crafted TrueType Font file with a negative n_points value that will cause an integer overflow and heap-based buffer overflow, allowing the execution of arbitrary code.
Alerts:	Gentoo 201006-01 2010-06-01 Fedora FEDORA-2009-5644 2009-05-28 Fedora FEDORA-2009-5558 2009-05-28 CentOS CESA-2009:0329 2009-05-22 Red Hat RHSA-2009:1062-01 2009-05-22 Red Hat RHSA-2009:0329-02 2009-05-22 Debian DSA-1334 2007-07-18 SuSE SUSE-SA:2007:041 2007-07-04 Fedora FEDORA-2007-561 2007-06-18 Mandriva MDKSA-2007:121 2007-06-13 Foresight FLEA-2007-0025-1 2007-06-13 Red Hat RHSA-2007:0403-01 2007-06-11 Debian DSA-1302-1 2007-06-10 Fedora FEDORA-2007-0033 2007-06-01 Ubuntu USN-466-1 2007-05-30 Gentoo 200705-22 2007-05-30 Trustix TSLSA-2007-0019 2007-05-25 rPath rPSA-2007-0108-1 2007-05-23 Foresight FLEA-2007-0020-1 2007-05-21 OpenPKG OpenPKG-SA-2007.018 2007-05-24

Comments (none posted)

freetype: integer overflows

Package(s):	freetype	CVE #(s):	CVE-2006-0747 CVE-2006-1861 CVE-2006-2493 CVE-2006-2661 CVE-2006-3467
Created:	June 8, 2006	Updated:	June 1, 2010
Description:	The FreeType library has several integer overflow vulnerabilities. If a user can be tricked into installing a specially crafted font file, arbitrary code can be executed with the privilege of the user.
Alerts:	Gentoo 201006-01 2010-06-01 Fedora FEDORA-2009-5644 2009-05-28 Fedora FEDORA-2009-5558 2009-05-28 CentOS CESA-2009:0329 2009-05-22 Red Hat RHSA-2009:1062-01 2009-05-22 Red Hat RHSA-2009:0329-02 2009-05-22 Gentoo 200710-09 2007-10-09 Debian DSA-1178-1 2006-09-16 Ubuntu USN-341-1 2006-09-06 Gentoo 200609-04 2006-09-06 rPath rPSA-2006-0157-1 2006-08-25 Mandriva MDKSA-2006:148 2006-08-24 Red Hat RHSA-2006:0635-01 2006-08-21 Red Hat RHSA-2006:0634-01 2006-08-21 Fedora FEDORA-2006-912 2006-08-14 SuSE SUSE-SA:2006:045 2006-08-01 OpenPKG OpenPKG-SA-2006.017 2006-07-28 Ubuntu USN-324-1 2006-07-27 Slackware SSA:2006-207-02 2006-07-27 Mandriva MDKSA-2006:129 2006-07-20 Gentoo 200607-02 2006-07-09 SuSE SUSE-SA:2006:037 2006-06-27 Mandriva MDKSA-2006:099-1 2006-06-13 Mandriva MDKSA-2006:099 2006-06-12 rPath rPSA-2006-0100-1 2006-06-12 Debian DSA-1095-1 2006-06-10 Ubuntu USN-291-1 2006-06-08

Comments (none posted)

gallery2: multiple unspecified vulnerabilities

Package(s):	gallery2	CVE #(s):	CVE-2007-4650
Created:	September 5, 2007	Updated:	November 9, 2007
Description:	Multiple unspecified vulnerabilities in Gallery before 2.2.3 allow attackers to (1) rename items, (2) read and modify item properties, or (3) lock and replace items via unknown vectors in (a) the WebDAV module; and (4) edit unspecified data files using "linked items" in (a) WebDAV and (b) Reupload modules.
Alerts:	Debian DSA-1404-1 2007-11-08 Gentoo 200711-03 2007-11-01 Fedora FEDORA-2007-2020 2007-09-04

Comments (none posted)

gcc: file overwrite vulnerability

Package(s):	gcc	CVE #(s):	CVE-2006-3619
Created:	September 6, 2006	Updated:	March 14, 2008
Description:	The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree.
Alerts:	Mandriva MDVSA-2008:066 2007-03-13 Red Hat RHSA-2007:0473-01 2007-06-11 Red Hat RHSA-2007:0220-02 2007-05-01 Debian DSA-1170-1 2006-09-06

Comments (none posted)

gd: buffer overflow

Package(s):	gd	CVE #(s):	CVE-2007-0455
Created:	February 7, 2007	Updated:	November 18, 2009
Description:	The gd graphics library contains a buffer overflow which could enable a remote attacker to execute arbitrary code. Note that various other packages include code from gd and could also be vulnerable.
Alerts:	Debian DSA-1936-1 2009-11-17 Red Hat RHSA-2008:0146-01 2008-02-28 Ubuntu USN-473-1 2007-06-11 OpenPKG OpenPKG-SA-2007.016 2007-05-18 Trustix TSLSA-2007-0007 2007-02-13 Fedora FEDORA-2007-150 2007-02-12 Fedora FEDORA-2007-149 2007-02-12 rPath rPSA-2007-0028-1 2007-02-08 Mandriva MDKSA-2007:038 2006-02-06 Mandriva MDKSA-2007:036 2006-02-06 Mandriva MDKSA-2007:035 2006-02-06

Comments (2 posted)

gd: multiple vulnerabilities

Package(s):	gd	CVE #(s):	CVE-2007-3472 CVE-2007-3473 CVE-2007-3474 CVE-2007-3475 CVE-2007-3476 CVE-2007-3477 CVE-2007-3478
Created:	August 6, 2007	Updated:	November 6, 2009
Description:	Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472) The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473) Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact. (CVE-2007-3474) The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475) Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault. (CVE-2007-3476) The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477) Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support. (CVE-2007-3478)
Alerts:	Ubuntu USN-854-1 2009-11-05 Debian DSA-1613-1 2008-07-22 Red Hat RHSA-2008:0146-01 2008-02-28 SuSE SUSE-SR:2007:015 2007-08-03 Fedora FEDORA-2007-692 2007-09-18 Fedora FEDORA-2007-2055 2007-09-07 Foresight FLEA-2007-0052-1 2007-09-06 rPath rPSA-2007-0176-1 2007-09-05 Trustix TSLSA-2007-0024 2007-08-10 Gentoo 200708-05 2007-08-09 Mandriva MDKSA-2007:153 2007-08-03

Comments (none posted)

gd: denial of service

Package(s):	gd	CVE #(s):	CVE-2007-2756
Created:	June 14, 2007	Updated:	February 28, 2008
Description:	Libgd2 has a denial of service vulnerability involving the incorrect validation of PNG callback results. If an application that is linked against libgd2 is used to process a specially-crafted PNG file, a denial of service involving CPU resource consumption can be caused.
Alerts:	Red Hat RHSA-2008:0146-01 2008-02-28 Slackware SSA:2007-178-01 2007-06-27 SuSE SUSE-SR:2007:013 2007-06-22 Mandriva MDKSA-2007:124 2007-06-13 Mandriva MDKSA-2007:123 2007-06-13 Mandriva MDKSA-2007:122 2007-06-13

Comments (none posted)

gedit: format string vulnerability

Package(s):	gedit	CVE #(s):	CAN-2005-1686
Created:	June 9, 2005	Updated:	February 5, 2009
Description:	A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.
Alerts:	Fedora FEDORA-2009-1189 2009-01-29 Fedora FEDORA-2009-1187 2009-01-29 Debian DSA-753-1 2005-07-12 Mandriva MDKSA-2005:102 2005-06-15 Red Hat RHSA-2005:499-01 2005-06-13 Gentoo 200506-09 2005-06-11 Ubuntu USN-138-1 2005-06-09

Comments (1 posted)

gimp: multiple vulnerabilities

Package(s):	gimp	CVE #(s):	CVE-2007-2949
Created:	June 28, 2007	Updated:	February 27, 2008
Description:	The gimp image editor has several vulnerabilities, including a problem where it can open PSD files with excessive dimensions and a possible stack overflow in the Sunras loader.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Red Hat RHSA-2007:0513-01 2007-09-26 Mandriva MDKSA-2007:170 2007-08-23 Slackware SSA:2007-222-01 2007-08-13 Foresight FLEA-2007-0038-1 2007-08-01 Gentoo 200707-09 2007-07-25 Fedora FEDORA-2007-627 2007-07-16 Debian DSA-1335-1 2007-07-18 Fedora FEDORA-2007-1099 2007-07-16 Fedora FEDORA-2007-1044 2007-07-12 rPath rPSA-2007-0138-1 2007-07-11 Ubuntu USN-480-1 2007-07-04 Fedora FEDORA-2007-618 2007-06-27 Fedora FEDORA-2007-619 2007-06-27 Fedora FEDORA-2007-0725 2007-06-27

Comments (none posted)

openssh: inappropriate use of trusted cookies

Package(s):	gnome-ssh-askpass openssh	CVE #(s):	CVE-2007-4752
Created:	September 11, 2007	Updated:	August 25, 2008
Description:	OpenSSH in versions prior 4.7 could use a trusted X11 cookie if the creation of an untrusted cookie failed.
Alerts:	CentOS CESA-2008:0855 2008-08-22 Red Hat RHSA-2008:0855-01 2008-08-22 Debian DSA-1576-1 2008-05-14 Ubuntu USN-566-1 2008-01-09 Mandriva MDKSA-2007:236 2007-12-04 Gentoo 200711-02 2007-11-01 Fedora FEDORA-2007-715 2007-10-15 Foresight FLEA-2007-0055-1 2007-09-17 Slackware SSA:2007-255-01 2007-09-13 rPath rPSA-2007-0181-1 2007-09-10

Comments (none posted)

grip: buffer overflow

Package(s):	grip	CVE #(s):	CAN-2005-0706
Created:	March 10, 2005	Updated:	November 19, 2008
Description:	Grip, a CD ripper, has a buffer overflow vulnerability that can occur when the CDDB server returns more than 16 matches.
Alerts:	Fedora FEDORA-2008-9604 2008-11-19 Fedora FEDORA-2008-9521 2008-11-19 Fedora-Legacy FLSA:152919 2005-09-15 Mandriva MDKSA-2005:074 2005-04-20 Mandriva MDKSA-2005:075 2005-04-20 Gentoo 200504-07 2005-04-08 Mandrake MDKSA-2005:066 2005-04-01 Red Hat RHSA-2005:304-01 2005-03-28 Gentoo 200503-21 2005-03-17 Fedora FEDORA-2005-203 2005-03-09 Fedora FEDORA-2005-202 2005-03-09

Comments (none posted)

gzip: multiple vulnerabilities

Package(s):	gzip	CVE #(s):	CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338
Created:	September 19, 2006	Updated:	January 20, 2010
Description:	Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code.
Alerts:	Debian DSA-1974-1 2010-01-20 Fedora FEDORA-2007-557 2007-05-31 Gentoo 200611-24 2006-11-28 Fedora-Legacy FLSA:211760 2006-11-13 Fedora FEDORA-2006-989 2006-10-10 SuSE SUSE-SA:2006:056 2006-09-26 Gentoo 200609-13 2006-09-23 Trustix TSLSA-2006-0052 2006-09-22 Mandriva MDKSA-2006:167 2006-09-20 Slackware SSA:2006-262-01 2006-09-20 OpenPKG OpenPKG-SA-2006.020 2006-09-20 Debian DSA-1181-1 2006-09-19 rPath rPSA-2006-0170-1 2006-09-19 Ubuntu USN-349-1 2006-09-19 Red Hat RHSA-2006:0667-01 2006-09-19

Comments (1 posted)

horde-kronolith: local file inclusion

Package(s):	horde-kronolith	CVE #(s):	CVE-2006-6175
Created:	January 17, 2007	Updated:	March 7, 2008
Description:	Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered string is used instead of a sanitized string to view local files. An authenticated attacker could craft an HTTP GET request that uses directory traversal techniques to execute any file on the web server as PHP code, which could allow information disclosure or arbitrary code execution with the rights of the user running the PHP application (usually the webserver user).
Alerts:	Gentoo 200701-11 2007-01-16

Comments (none posted)

ImageMagick: integer overflows

Package(s):	imagemagick	CVE #(s):	CVE-2007-1797
Created:	April 4, 2007	Updated:	August 11, 2009
Description:	Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote attackers to execute arbitrary code via (1) a crafted DCM image, which results in a heap-based overflow in the ReadDCMImage function, or (2) the (a) colors or (b) comments field in a crafted XWD image, which results in a heap-based overflow in the ReadXWDImage function, different issues than CVE-2007-1667.
Alerts:	Debian DSA-1858-1 2009-08-10 Red Hat RHSA-2008:0165-01 2008-04-16 Red Hat RHSA-2008:0145-01 2008-04-16 Fedora FEDORA-2007-1340 2007-07-30 Mandriva MDKSA-2007:147 2007-07-20 Ubuntu USN-481-1 2007-07-10 Gentoo 200705-13 2007-05-10 Fedora FEDORA-2007-414 2007-04-17 Fedora FEDORA-2007-413 2007-04-05 rPath rPSA-2007-0064-1 2007-04-04

Comments (none posted)

jasper: denial of service

Package(s):	jasper	CVE #(s):	CVE-2007-2721
Created:	June 1, 2007	Updated:	April 19, 2010
Description:	The jpc_qcx_getcompparms function in jpc/jpc_cs.c could allow remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files.
Alerts:	Debian DSA-2036-1 2010-04-17 Mandriva MDVSA-2009:142-1 2009-12-03 Mandriva MDVSA-2009:164 2009-07-28 Mandriva MDVSA-2009:142 2009-06-26 CentOS CESA-2009:0012 2009-02-11 Red Hat RHSA-2009:0012-01 2009-02-11 Mandriva MDKSA-2007:209 2007-11-05 Mandriva MDKSA-2007:208 2007-11-05 Ubuntu USN-501-2 2007-10-22 Ubuntu USN-501-1 2007-08-20 Mandriva MDKSA-2007:129 2007-06-19 Fedora FEDORA-2007-0001 2007-06-01

Comments (none posted)

java: multiple vulnerabilities

Package(s):	java	CVE #(s):	CVE-2006-4339 CVE-2006-4790 CVE-2006-6731 CVE-2006-6736 CVE-2006-6737 CVE-2006-6745
Created:	January 18, 2007	Updated:	June 4, 2010
Description:	java has multiple vulnerabilities, these include: an RSA exponent padding attack vulnerability, two vulnerabilities which allow untrusted applets to access data in other applets, vulnerabilities that involve applets gaining privileges due to serialization bugs in the JRE and buffer overflows in the java image handling routines that can give attackers read/write/execute capabilities for local files.
Alerts:	Pardus 2010-67 2010-06-04 Gentoo 200705-20 2007-05-26 Red Hat RHSA-2007:0073-01 2007-02-09 Red Hat RHSA-2007:0072-01 2007-02-08 Red Hat RHSA-2007:0062-02 2007-02-07 Gentoo 200701-15 2007-01-22 SuSE SUSE-SA:2007:010 2007-01-18

Comments (1 posted)

java-1.5.0-sun: multiple vulnerabilities

Package(s):	java-1.5.0-sun	CVE #(s):	CVE-2007-3503 CVE-2007-3655 CVE-2007-3698 CVE-2007-3922
Created:	August 6, 2007	Updated:	June 24, 2008
Description:	The Javadoc tool was able to generate HTML documentation pages that contained cross-site scripting (XSS) vulnerabilities. A remote attacker could use this to inject arbitrary web script or HTML. (CVE-2007-3503) The Java Web Start URL parsing component contained a buffer overflow vulnerability within the parsing code for JNLP files. A remote attacker could create a malicious JNLP file that could trigger this flaw and execute arbitrary code when opened. (CVE-2007-3655) The JSSE component did not correctly process SSL/TLS handshake requests. A remote attacker who is able to connect to a JSSE-based service could trigger this flaw leading to a denial-of-service. (CVE-2007-3698) A flaw was found in the applet class loader. An untrusted applet could use this flaw to circumvent network access restrictions, possibly connecting to services hosted on the machine that executed the applet. (CVE-2007-3922)
Alerts:	Red Hat RHSA-2008:0133-01 2008-06-24 SuSE SUSE-SA:2008:025 2008-04-25 Gentoo 200804-20 2008-04-17 Red Hat RHSA-2008:0132-01 2008-02-14 Red Hat RHSA-2007:1086-01 2007-12-12 SuSE SUSE-SA:2007:056 2007-10-18 Red Hat RHSA-2007:0956-01 2007-10-16 Slackware SSA:2007-243-01 2007-08-31 Red Hat RHSA-2007:0829-01 2007-08-07 Red Hat RHSA-2007:0818-01 2007-08-06

Comments (none posted)

JRockit: multiple vulnerabilities

Package(s):	jrockit-jdk-bin	CVE #(s):	CVE-2007-2788 CVE-2007-4381 CVE-2007-3716 CVE-2007-2789 CVE-2007-3004 CVE-2007-3005 CVE-2007-3503 CVE-2007-3698 CVE-2007-3922
Created:	September 24, 2007	Updated:	June 24, 2008
Description:	An integer overflow vulnerability exists in the embedded ICC profile image parser (CVE-2007-2788), an unspecified vulnerability exists in the font parsing implementation (CVE-2007-4381), and an error exists when processing XSLT stylesheets contained in XSLT Transforms in XML signatures (CVE-2007-3716), among other vulnerabilities.
Alerts:	Red Hat RHSA-2008:0133-01 2008-06-24 SuSE SUSE-SA:2008:025 2008-04-25 Gentoo 200804-20 2008-04-17 Red Hat RHSA-2008:0100-01 2008-03-11 Red Hat RHSA-2008:0132-01 2008-02-14 Red Hat RHSA-2007:1086-01 2007-12-12 Gentoo 200709-15 2007-09-23

Comments (none posted)

kdebase: several vulnerabilities

Package(s):	kdebase	CVE #(s):	CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
Created:	August 20, 2007	Updated:	October 8, 2007
Description:	konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. (CVE-2007-3820) KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. (CVE-2007-4224) Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amount of whitespace in the user/password portion. (CVE-2007-4225)
Alerts:	Red Hat RHSA-2007:0909-01 2007-10-08 Red Hat RHSA-2007:0905-01 2007-10-08 Fedora FEDORA-2007-716 2007-10-08 Mandriva MDKSA-2007:176 2007-09-06 rPath rPSA-2007-0177-1 2007-09-05 Ubuntu USN-502-1 2007-08-23 Fedora FEDORA-2007-1699 2007-08-20 Fedora FEDORA-2007-1700 2007-08-20

Comments (none posted)

kdebase: kdm passwordless login vulnerability

Package(s):	kdebase kdm	CVE #(s):	CVE-2007-4569
Created:	September 21, 2007	Updated:	November 13, 2007
Description:	According to this KDE advisory KDM can be tricked into performing a password-less login even for accounts with a password set under certain circumstances, namely autologin to be configured and "shutdown with password" enabled. KDE versions 3.3.0 up to including 3.5.7 are vulnerable.
Alerts:	Gentoo 200710-15 2007-10-14 Fedora FEDORA-2007-716 2007-10-08 Fedora FEDORA-2007-2361 2007-10-03 Mandriva MDKSA-2007:190 2007-09-27 Ubuntu USN-517-1 2007-09-24 Slackware SSA:2007-264-01 2007-09-24 rPath rPSA-2007-0194-1 2007-09-20 Debian DSA-1376 2007-09-21

Comments (none posted)

kdelibs: kate backup file permission leak

Package(s):	kdelibs kate kwrite	CVE #(s):	CAN-2005-1920
Created:	July 19, 2005	Updated:	September 21, 2010
Description:	Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information.
Alerts:	Gentoo 200611-21 2006-11-27 Debian DSA-804-2 2005-11-10 Debian DSA-804-1 2005-09-08 Red Hat RHSA-2005:612-01 2005-07-27 Ubuntu USN-150-1 2005-07-21 Mandriva MDKSA-2005:122 2005-07-20 Fedora FEDORA-2005-594 2005-07-19

Comments (1 posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2007-1357
Created:	April 16, 2007	Updated:	November 14, 2007
Description:	The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum.
Alerts:	SuSE SUSE-SA:2007:035 2007-06-14 Ubuntu USN-464-1 2007-05-23 SuSE SUSE-SA:2007:030 2007-05-10 SuSE SUSE-SA:2007:029 2007-05-03 rPath rPSA-2007-0071-1 2007-04-16 Fedora FEDORA-2007-432 2007-04-13 Fedora FEDORA-2007-433 2007-04-13

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-4623
Created:	October 18, 2006	Updated:	November 14, 2007
Description:	The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data.
Alerts:	Ubuntu USN-489-1 2007-07-19 rPath rPSA-2006-0194-1 2006-10-17

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2007-3642
Created:	July 23, 2007	Updated:	November 14, 2007
Description:	The decode_choice function in net/netfilter/bf_conntrack_h323_asn1.c in the Linux kernel before 2.6.22 allows remote attackers to cause a denial of service (crash) via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer dereference.
Alerts:	Ubuntu USN-510-1 2007-08-31 Debian DSA-1356-1 2007-08-15 Fedora FEDORA-2007-655 2007-08-09 Fedora FEDORA-2007-1130 2007-07-20

Comments (none posted)

kernel: out-of-bounds access

Package(s):	kernel	CVE #(s):	CVE-2007-4573
Created:	September 25, 2007	Updated:	December 6, 2010
Description:	The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.
Alerts:	Mandriva MDVSA-2010:247 2010-12-03 Mandriva MDVSA-2010:188 2010-09-23 Mandriva MDVSA-2010:198 2010-10-07 Mandriva MDVSA-2008:105 2007-05-21 Debian DSA-1504 2008-02-22 Mandriva MDVSA-2008:008 2008-01-11 SuSE SUSE-SA:2007:064 2007-12-04 SuSE SUSE-SA:2007:053 2007-10-12 Mandriva MDKSA-2007:195 2007-10-15 Mandriva MDKSA-2007:196 2007-10-15 Debian DSA-1381-2 2007-10-12 Debian DSA-1381-1 2007-10-02 Debian DSA-1378-2 2007-09-28 Debian DSA-1378-1 2007-09-27 Red Hat RHSA-2007:0938-01 2007-09-27 Red Hat RHSA-2007:0937-01 2007-09-27 Red Hat RHSA-2007:0936-01 2007-09-27 Ubuntu USN-518-1 2007-09-25 rPath rPSA-2007-0198-1 2007-09-24 Fedora FEDORA-2007-712 2007-09-24 Fedora FEDORA-2007-2298 2007-09-25

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2007-0005 CVE-2007-1000
Created:	March 15, 2007	Updated:	November 14, 2007
Description:	The Linux kernel has a boundary error problem with the Omnikey CardMan 4040 driver read and write functions. This can be used to cause a buffer overflow and possible execution or arbitrary code with kernel privileges. The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c is vulnerable to a NULL pointer dereference. Local users can use this to crash the kernel or to disclose kernel memory.
Alerts:	Fedora FEDORA-2007-599 2007-06-21 Ubuntu USN-489-1 2007-07-19 Ubuntu USN-486-1 2007-07-17 Debian DSA-1286-1 2007-05-02 Red Hat RHSA-2007:0169-01 2007-04-30 Mandriva MDKSA-2007:078 2007-04-04 Fedora FEDORA-2007-336 2007-03-14 Fedora FEDORA-2007-335 2007-03-14

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-0558 CVE-2007-1217
Created:	September 4, 2007	Updated:	November 14, 2007
Description:	A flaw in the ISDN CAPI subsystem could allow a remote user to cause a denial of service or potential remote access. Exploitation would require the attacker to be able to send arbitrary frames over the ISDN network to the victim's machine. A flaw in the perfmon subsystem on ia64 platforms could allow a local user to cause a denial of service.
Alerts:	Red Hat RHSA-2007:0671-01 2007-08-16 Red Hat RHSA-2007:0673-01 2007-08-08 Red Hat RHSA-2007:0672-01 2007-08-08 Red Hat RHSA-2007:0705-01 2007-09-13 Red Hat RHSA-2007:0774-01 2007-09-04

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-0007 CVE-2007-0006
Created:	February 15, 2007	Updated:	November 14, 2007
Description:	Linux kernel versions from 2.6.9 to 2.6.20 have a denial of service vulnerability. A remote attacker can cause the key_alloc_serial function's key serial number collision avoidance code to have a null dereference, resulting in a crash.
Alerts:	Fedora FEDORA-2007-599 2007-06-21 Red Hat RHSA-2007:0099-02 2007-03-14 rPath rPSA-2007-0050-1 2007-03-06 Red Hat RHSA-2007:0085-01 2007-02-27 Mandriva MDKSA-2007:047 2007-02-21 Fedora FEDORA-2007-226 2007-02-13 Fedora FEDORA-2007-225 2007-02-13

Comments (1 posted)

kernel: ALSA returns incorrect write size

Package(s):	kernel	CVE #(s):	CVE-2007-4571
Created:	September 28, 2007	Updated:	June 20, 2008
Description:	The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count argument, as demonstrated by multiple reads of /proc/driver/snd-page-alloc.
Alerts:	Ubuntu USN-618-1 2008-06-19 Debian DSA-1505 2008-02-22 Debian DSA-1479 2008-01-29 Red Hat RHSA-2007:0993-01 2007-11-29 Red Hat RHSA-2007:0939-01 2007-11-01 SuSE SUSE-SA:2007:053 2007-10-12 Fedora FEDORA-2007-714 2007-10-08 Fedora FEDORA-2007-2349 2007-09-28 rPath rPSA-2007-0202-1 2007-09-27

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-4535 CVE-2006-4538
Created:	September 18, 2006	Updated:	January 5, 2009
Description:	Sridhar Samudrala discovered a local denial of service vulnerability in the handling of SCTP sockets. By opening such a socket with a special SO_LINGER value, a local attacker could exploit this to crash the kernel. (CVE-2006-4535) Kirill Korotaev discovered that the ELF loader on the ia64 and sparc platforms did not sufficiently verify the memory layout. By attempting to execute a specially crafted executable, a local user could exploit this to crash the kernel. (CVE-2006-4538)
Alerts:	Red Hat RHSA-2008:0787-01 2009-01-05 Red Hat RHSA-2007:1049-01 2007-12-03 Mandriva MDKSA-2006:182 2006-10-11 Red Hat RHSA-2006:0689-01 2006-10-05 Debian DSA-1184-2 2006-09-26 Debian DSA-1184-1 2006-09-25 Debian DSA-1183-1 2006-09-25 Ubuntu USN-347-1 2006-09-18

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2007-1861 CVE-2007-2242
Created:	May 1, 2007	Updated:	February 8, 2008
Description:	The netlink protocol has an infinite recursion bug that allows users to cause a kernel crash. Also the IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers.
Alerts:	SuSE SUSE-SA:2008:006 2008-02-07 Ubuntu USN-508-1 2007-08-31 Mandriva MDKSA-2007:171 2007-08-28 Ubuntu USN-489-1 2007-07-19 Ubuntu USN-486-1 2007-07-17 SuSE SUSE-SA:2007:051 2007-09-06 Mandriva MDKSA-2007:216 2007-11-13 Red Hat RHSA-2007:0347-01 2007-05-16 Debian DSA-1289-1 2007-05-13 Foresight FLEA-2007-0016-1 2007-05-08 rPath rPSA-2007-0084-1 2007-05-01 Fedora FEDORA-2007-483 2007-05-01 Fedora FEDORA-2007-482 2007-05-01

Comments (none posted)

kernel: denial of service by memory consumption

Package(s):	kernel	CVE #(s):	CVE-2006-2936
Created:	July 17, 2006	Updated:	November 14, 2007
Description:	The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the driver can handle, which causes the data to be queued.
Alerts:	SuSE SUSE-SA:2007:035 2007-06-14 Mandriva MDKSA-2006:151 2006-08-25 Mandriva MDKSA-2006:150 2006-08-25 Ubuntu USN-331-1 2006-08-03 rPath rPSA-2006-0130-1 2006-07-17

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2007-0772
Created:	February 23, 2007	Updated:	November 14, 2007
Description:	The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.
Alerts:	Fedora FEDORA-2007-599 2007-06-21 Ubuntu USN-451-1 2007-04-10 SuSE SUSE-SA:2007:021 2007-03-16 Mandriva MDKSA-2007:060 2006-03-09 Fedora FEDORA-2007-291 2007-03-02 Fedora FEDORA-2007-277 2007-03-02 SuSE SUSE-SA:2007:018 2007-02-27 rPath rPSA-2007-0036-1 2007-02-23

Comments (none posted)

kernel: several vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2007-1353 CVE-2007-2451 CVE-2007-2453
Created:	June 11, 2007	Updated:	March 6, 2008
Description:	Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information. (CVE-2007-1353) The GEODE-AES driver did not correctly initialize its encryption key. Any data encrypted using this type of device would be easily compromised. (CVE-2007-2451) The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers. (CVE-2007-2453)
Alerts:	Debian DSA-1504 2008-02-22 Debian DSA-1503-2 2008-03-06 Debian DSA-1503 2008-02-22 Red Hat RHSA-2007:0488-01 2007-06-25 Debian DSA-1356-1 2007-08-15 SuSE SUSE-SA:2007:051 2007-09-06 Mandriva MDKSA-2007:216 2007-11-13 Mandriva MDKSA-2007:171 2007-08-28 Red Hat RHSA-2007:0671-01 2007-08-16 Red Hat RHSA-2007:0673-01 2007-08-08 Red Hat RHSA-2007:0672-01 2007-08-08 Ubuntu USN-489-1 2007-07-19 Ubuntu USN-486-1 2007-07-17 Fedora FEDORA-2007-600 2007-06-25 Fedora FEDORA-2007-599 2007-06-21 SuSE SUSE-SA:2007:035 2007-06-14 Red Hat RHSA-2007:0376-01 2007-06-14 Fedora FEDORA-2007-0409 2007-06-13 Ubuntu USN-470-1 2007-06-08

Comments (none posted)

kernel: signal handling flaw on PPC

Package(s):	kernel	CVE #(s):	CVE-2007-3107
Created:	July 10, 2007	Updated:	February 4, 2008
Description:	A flaw in the signal handling on PowerPC-based systems that allowed a local user to cause a denial of service (floating point corruption).
Alerts:	Ubuntu USN-574-1 2008-02-04 SuSE SUSE-SA:2007:053 2007-10-12 SuSE SUSE-SA:2007:051 2007-09-06 Red Hat RHSA-2007:0595-01 2007-07-10

Comments (none posted)

kernel: several vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2006-5823 CVE-2006-6054 CVE-2007-1592
Created:	June 12, 2007	Updated:	March 21, 2011
Description:	A flaw in the cramfs file system allows invalid compressed data to cause memory corruption (CVE-2006-5823) A flaw in the ext2 file system allows an invalid inode size to cause a denial of service (system hang) (CVE-2006-6054) A flaw in IPV6 flow label handling allows a local user to cause a denial of service (crash) (CVE-2007-1592)
Alerts:	Mandriva MDVSA-2011:051 2011-03-18 Debian DSA-1503-2 2008-03-06 Debian DSA-1504 2008-02-22 Debian DSA-1503 2008-02-22 Red Hat RHSA-2007:0673-01 2007-08-08 Red Hat RHSA-2007:0672-01 2007-08-08 SuSE SUSE-SA:2007:035 2007-06-14 Red Hat RHSA-2007:0347-01 2007-05-16 SuSE SUSE-SA:2007:043 2007-07-09 Debian DSA-1304-1 2007-06-16 rPath rPSA-2007-0124-1 2007-06-14 Red Hat RHSA-2007:0436-01 2007-06-11

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-5757
Created:	November 13, 2006	Updated:	November 14, 2007
Description:	From the MOKB-05-11-2006 advisory: "The ISO9660 filesystem handling code of the Linux 2.6.x kernel fails to properly handle corrupted data structures, leading to an exploitable denial of service condition. This particular vulnerability seems to be caused by a race condition and a signedness issue. When performing a read operation on a corrupted ISO9660 fs stream, the isofs_get_blocks() function will enter an infinite loop when __find_get_block_slow() callback from sb_getblk() fails ("due to various races between file io on the block device and getblk")."
Alerts:	Fedora FEDORA-2007-599 2007-06-21 Fedora FEDORA-2006-1223 2006-11-12 Fedora FEDORA-2006-1221 2006-11-10

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-2935 CVE-2006-4145 CVE-2006-3745
Created:	September 1, 2006	Updated:	July 30, 2008
Description:	Previous versions of the kernel package are subject to several vulnerabilities. Certain malformed UDF filesystems can cause the system to crash (denial of service). Malformed CDROM firmware or USB storage devices (such as USB keys) could cause system crash (denial of service), and if they were intentionally malformed, can cause arbitrary code to run with elevated privileges. In addition, the SCTP protocol is subject to a remote system crash (denial of service) attack.
Alerts:	Red Hat RHSA-2008:0665-01 2008-07-24 SuSE SUSE-SA:2007:053 2007-10-12 SuSE SUSE-SA:2006:064 2006-11-10 Red Hat RHSA-2006:0710-01 2006-10-19 SuSE SUSE-SA:2006:057 2006-09-28 Trustix TSLSA-2006-0051 2006-09-15 Ubuntu USN-346-2 2006-09-14 Ubuntu USN-346-1 2006-09-14 rPath rPSA-2006-0162-1 2006-08-31

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2006-5749 CVE-2006-4814 CVE-2006-6106
Created:	January 5, 2007	Updated:	January 8, 2009
Description:	A security issue has been reported in Linux kernel due to an error in drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()" function never initializes an event timer before scheduling it with the "add_timer()" function. The mincore function in the kernel does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock. Another vulnerability has been reported in Linux kernel caused by a boundary error within the handling of incoming CAPI messages in net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain Kernel data structures.
Alerts:	Red Hat RHSA-2008:0787-01 2009-01-05 Red Hat RHSA-2009:0001-01 2009-01-08 CentOS CESA-2008:0211 2008-05-07 Red Hat RHSA-2008:0211-01 2008-05-07 Debian DSA-1503 2008-02-22 Debian DSA-1503-2 2008-03-06 SuSE SUSE-SA:2007:035 2007-06-14 SuSE SUSE-SA:2007:053 2007-10-12 Ubuntu USN-416-2 2007-03-01 Ubuntu USN-416-1 2007-02-01 rPath rPSA-2007-0031-1 2007-02-09 Mandriva MDKSA-2007:040 2007-02-07 Red Hat RHSA-2007:0014-01 2007-01-30 Mandriva MDKSA-2007:025 2007-01-23 Fedora FEDORA-2007-058 2007-01-18 Mandriva MDKSA-2007:012 2006-01-12 Trustix TSLSA-2007-0002 2007-01-05

Comments (none posted)

kernel: several vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2007-3851 CVE-2007-3848 CVE-2007-3105
Created:	August 17, 2007	Updated:	January 8, 2009
Description:	The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer. (CVE-2007-3851) Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal (PR_SET_PDEATHSIG). (CVE-2007-3848) Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root. (CVE-2007-3105)
Alerts:	Red Hat RHSA-2008:0787-01 2009-01-05 Red Hat RHSA-2009:0001-01 2009-01-08 Mandriva MDVSA-2008:105 2007-05-21 SuSE SUSE-SA:2008:017 2008-03-28 Debian DSA-1504 2008-02-22 Debian DSA-1503-2 2008-03-06 Debian DSA-1503 2008-02-22 SuSE SUSE-SA:2008:006 2008-02-07 Red Hat RHSA-2007:1049-01 2007-12-03 SuSE SUSE-SA:2007:053 2007-10-12 Debian DSA-1356-1 2007-08-15 Mandriva MDKSA-2007:216 2007-11-13 Red Hat RHSA-2007:0939-01 2007-11-01 Red Hat RHSA-2007:0940-01 2007-10-22 Red Hat RHSA-2007:0705-01 2007-09-13 SuSE SUSE-SA:2007:051 2007-09-06 Fedora FEDORA-2007-679 2007-09-04 Ubuntu USN-510-1 2007-08-31 Debian DSA-1363-1 2007-08-31 Ubuntu USN-508-1 2007-08-31 Ubuntu USN-509-1 2007-08-31 Fedora FEDORA-2007-1785 2007-08-23 rPath rPSA-2007-0164-1 2007-08-16

Comments (1 posted)

krb5: multiple vulnerabilities

Package(s):	krb5	CVE #(s):	CVE-2007-2442 CVE-2007-2443 CVE-2007-2798
Created:	June 27, 2007	Updated:	March 24, 2008
Description:	David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who could access kadmind could trigger the flaw causing kadmind to crash or possibly execute arbitrary code (CVE-2007-2442). David Coffey also discovered an overflow flaw in the same RPC library. A remote unauthenticated attacker who could access kadmind could trigger the flaw causing kadmind to crash or possibly execute arbitrary code (CVE-2007-2443). Finally, a stack buffer overflow vulnerability was found in kadmind that allowed an unauthenticated user able to access kadmind the ability to trigger the vulnerability and possibly execute arbitrary code (CVE-2007-2798).
Alerts:	Gentoo 200707-11 2007-07-25 SuSE SUSE-SA:2007:038 2007-07-03 Trustix TSLSA-2007-0021 2007-06-29 Fedora FEDORA-2007-0740 2007-06-27 Debian DSA-1323-1 2007-06-28 rPath rPSA-2007-0135-1 2007-06-27 Foresight FLEA-2007-0029-1 2007-06-27 Fedora FEDORA-2007-621 2007-06-28 Fedora FEDORA-2007-620 2007-06-28 Ubuntu USN-477-1 2007-06-26 Red Hat RHSA-2007:0562-01 2007-06-26 Red Hat RHSA-2007:0384-01 2007-06-26 Mandriva MDKSA-2007:137 2007-06-26

Comments (none posted)

krb5: uninitialized pointers

Package(s):	krb5	CVE #(s):	CVE-2006-6143 CVE-2006-3084
Created:	January 10, 2007	Updated:	July 7, 2010
Description:	The kdamind daemon can, in some situations, perform operations on uninitialized pointers. This bug could conceivably open up the system to a code execution attack by an unauthenticated remote attacker, but it appears to be difficult to exploit. See this advisory for details.
Alerts:	Mandriva MDVSA-2010:129 2010-07-07 Gentoo 200701-21 2007-01-24 Ubuntu USN-408-1 2007-01-15 rPath rPSA-2007-0006-1 2007-01-11 Mandriva MDKSA-2007:008 2006-01-10 SuSE SUSE-SA:2007:004 2007-01-10 OpenPKG OpenPKG-SA-2007.006 2007-01-10 Fedora FEDORA-2007-033 2007-01-09 Fedora FEDORA-2007-034 2007-01-09

Comments (1 posted)

krb5: local privilege escalation

Package(s):	krb5	CVE #(s):	CVE-2006-3083
Created:	August 9, 2006	Updated:	July 7, 2010
Description:	Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges.
Alerts:	Mandriva MDVSA-2010:129 2010-07-07 SuSE SUSE-SR:2006:022 2006-09-08 Gentoo 200608-21 2006-08-23 Ubuntu USN-334-1 2006-08-16 Fedora FEDORA-2006-905 2006-08-09 Mandriva MDKSA-2006:139 2006-09-09 Gentoo 200608-15 2006-08-10 rPath rPSA-2006-0150-1 2006-08-09 Red Hat RHSA-2006:0612-01 2006-08-08 Debian DSA-1146-1 2006-08-09

Comments (none posted)

krb5: buffer overflow, uninitialized pointer

Package(s):	krb5	CVE #(s):	CVE-2007-3999 CVE-2007-4000
Created:	September 4, 2007	Updated:	March 24, 2008
Description:	Tenable Network Security discovered a stack buffer overflow flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. Garrett Wollman discovered an uninitialized pointer flaw in kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash.
Alerts:	Fedora FEDORA-2008-1017 2008-03-06 SuSE SUSE-SR:2007:024 2007-11-22 Debian DSA-1387 2007-10-15 Gentoo 200710-01 2007-10-04 Red Hat RHSA-2007:0951-01 2007-10-02 Red Hat RHSA-2007:0913-01 2007-09-19 Trustix TSLSA-2007-0026 2007-09-17 Mandriva MDKSA-2007:181 2007-09-12 Gentoo 200709-01 2007-09-11 Ubuntu USN-511-2 2007-09-07 Mandriva MDKSA-2007:174-1 2007-09-07 Fedora FEDORA-2007-694 2007-09-07 Fedora FEDORA-2007-2066 2007-09-07 Debian DSA-1367-2 2007-09-06 Foresight FLEA-2007-0050-1 2007-09-06 Mandriva MDKSA-2007:174 2007-09-06 Red Hat RHSA-2007:0892-01 2007-09-07 rPath rPSA-2007-0179-1 2007-09-06 Ubuntu USN-511-1 2007-09-04 Fedora FEDORA-2007-2017 2007-09-04 Fedora FEDORA-2007-690 2007-09-04 Debian DSA-1368-1 2007-09-04 Debian DSA-1367-1 2007-09-04 Red Hat RHSA-2007:0858-01 2007-09-04

Comments (none posted)

krb5: multiple vulnerabilities

Package(s):	krb5	CVE #(s):	CVE-2007-0956 CVE-2007-0957 CVE-2007-1216
Created:	April 3, 2007	Updated:	March 24, 2008
Description:	A flaw was found in the username handling of the MIT krb5 telnet daemon (telnetd). A remote attacker who can access the telnet port of a target machine could log in as root without requiring a password. MIT krb5 Security Advisory 2007-001 Buffer overflows were found which affect the Kerberos KDC and the kadmin server daemon. A remote attacker who can access the KDC could exploit this bug to run arbitrary code with the privileges of the KDC or kadmin server processes. MIT krb5 Security Advisory 2007-002 A double-free flaw was found in the GSSAPI library used by the kadmin server daemon. MIT krb5 Security Advisory 2007-003
Alerts:	Mandriva MDKSA-2007:077-1 2007-04-10 Foresight FLEA-2007-0008-1 2007-04-05 SuSE SUSE-SA:2007:025 2007-04-05 Mandriva MDKSA-2007:077 2006-04-04 rPath rPSA-2007-0063-1 2007-04-04 Ubuntu USN-449-1 2007-04-04 Gentoo 200704-02 2007-04-03 Fedora FEDORA-2007-409 2007-04-03 Fedora FEDORA-2007-408 2007-04-03 Debian DSA-1276-1 2007-04-03 Red Hat RHSA-2007:0095-01 2007-04-03

Comments (none posted)

ktorrent: incorrect validation

Package(s):	ktorrent	CVE #(s):	CVE-2007-1384 CVE-2007-1385 CVE-2007-1799
Created:	March 13, 2007	Updated:	October 24, 2007
Description:	Bryan Burns of Juniper Networks discovered that KTorrent did not correctly validate the destination file paths nor the HAVE statements sent by torrent peers. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.
Alerts:	Debian DSA-1373-2 2007-10-23 Debian DSA-1373-1 2007-09-11 Ubuntu USN-436-2 2007-05-18 Mandriva MDKSA-2007:095 2007-05-01 Gentoo 200705-01 2007-05-01 Slackware SSA:2007-093-02 2007-04-04 Ubuntu USN-436-1 2007-03-12

Comments (1 posted)

kvirc: remote arbitrary code execution

Package(s):	kvirc	CVE #(s):	CVE-2007-2951
Created:	September 14, 2007	Updated:	February 27, 2008
Description:	Stefan Cornelius from Secunia Research discovered that the "parseIrcUrl()" function in file src/kvirc/kernel/kvi_ircurl.cpp does not properly sanitize parts of the URI when building the command for KVIrc's internal script system.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Gentoo 200709-02 2007-09-13

Comments (none posted)

lftp: shell command execution

Package(s):	lftp	CVE #(s):	CVE-2007-2348
Created:	May 4, 2007	Updated:	September 16, 2009
Description:	mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
Alerts:	CentOS CESA-2009:1278 2009-09-15 Red Hat RHSA-2009:1278-02 2009-09-02 rPath rPSA-2007-0085-1 2007-05-03

Comments (none posted)

libarchive: pax extension header vulnerabilities

Package(s):	libarchive	CVE #(s):	CVE-2007-3641 CVE-2007-3644 CVE-2007-3645
Created:	August 9, 2007	Updated:	February 27, 2008
Description:	libarchive, a library for manipulating different streaming archive formats, has a number of pax extension header vulnerabilities. These may be used to cause a denial of service or for the execution of arbitrary code.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Debian DSA-1455-1 2008-01-08 Gentoo 200708-03 2007-08-08

Comments (none posted)

libexif: integer overflow

Package(s):	libexif	CVE #(s):	CVE-2007-2645
Created:	June 1, 2007	Updated:	February 11, 2008
Description:	Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data, involving the (1) doff or (2) s variable.
Alerts:	Debian DSA-1487-1 2008-02-08 Slackware SSA:2007-164-01 2007-06-14 Fedora FEDORA-2007-0414 2007-06-13 Fedora FEDORA-2007-548 2007-06-11 Ubuntu USN-471-1 2007-06-11 Mandriva MDKSA-2007:118 2007-06-08 Gentoo 200706-01 2007-06-05 rPath rPSA-2007-0115-1 2007-06-04 Foresight FLEA-2007-0024-1 2007-06-04 Fedora FEDORA-2007-0001 2007-06-01

Comments (none posted)

libmodplug: boundary errors

Package(s):	libmodplug	CVE #(s):	CVE-2006-4192
Created:	December 11, 2006	Updated:	May 4, 2011
Description:	Luigi Auriemma has reported various boundary errors in load_it.cpp and a boundary error in the "CSoundFile::ReadSample()" function in sndfile.cpp. A remote attacker can entice a user to read crafted modules or ITP files, which may trigger a buffer overflow resulting in the execution of arbitrary code with the privileges of the user running the application.
Alerts:	CentOS CESA-2011:0477 2011-05-04 Red Hat RHSA-2011:0477-01 2011-05-02 Ubuntu USN-521-1 2007-09-27 Mandriva MDKSA-2007:001 2007-01-02 Gentoo 200612-04 2006-12-10

Comments (none posted)

libphp-phpmailer: command execution

Package(s):	libphp-phpmailer	CVE #(s):	CVE-2007-3215
Created:	June 20, 2007	Updated:	June 25, 2009
Description:	libphp-phpmailer does not do sufficient input validation, enabling shell command injection attacks.
Alerts:	Ubuntu USN-791-1 2009-06-24 Debian DSA-1315-1 2007-06-19

Comments (none posted)

libpng: denial of service

Package(s):	libpng	CVE #(s):	CVE-2007-2445
Created:	May 17, 2007	Updated:	March 23, 2009
Description:	Libpng can be crashed when processing malformed PNG files. It may also be possible to exploit this vulnerability to execute arbitrary code.
Alerts:	Debian DSA-1750-1 2009-03-22 Debian DSA-1613-1 2008-07-22 Fedora FEDORA-2008-3979 2008-05-28 Ubuntu USN-472-1 2007-06-11 Mandriva MDKSA-2007:116 2007-06-05 Gentoo 200705-24 2007-05-31 Fedora FEDORA-2007-0001 2007-06-01 Fedora FEDORA-2007-529 2007-05-24 Fedora FEDORA-2007-528 2007-05-24 Red Hat RHSA-2007:0356-01 2007-05-17 OpenPKG OpenPKG-SA-2007.013 2007-05-18 Foresight FLEA-2007-0018-1 2007-05-17 Slackware SSA:2007-136-01 2007-05-17 rPath rPSA-2007-0102-1 2007-05-16 Oracle ELSA-2012-0317 2012-02-21

Comments (none posted)

libpng: buffer overflow

Package(s):	libpng	CVE #(s):	CVE-2006-3334
Created:	July 19, 2006	Updated:	December 15, 2008
Description:	In pngrutil.c, the function png_decompress_chunk() allocates insufficient space for an error message, potentially overwriting stack data, leading to a buffer overflow.
Alerts:	Gentoo 200812-15 2008-12-14 Mandriva MDKSA-2006:213 2006-11-16 rPath rPSA-2006-0133-1 2006-07-19 Gentoo 200607-06 2006-07-19

Comments (none posted)

libpng: heap based buffer overflow

Package(s):	libpng	CVE #(s):	CVE-2006-0481
Created:	February 13, 2006	Updated:	December 15, 2008
Description:	A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim.
Alerts:	Gentoo 200812-15 2008-12-14 Red Hat RHSA-2006:0205-01 2006-02-13

Comments (1 posted)

libsndfile: heap-based buffer overflow

Package(s):	libsndfile	CVE #(s):	CVE-2007-4974
Created:	September 25, 2007	Updated:	January 9, 2008
Description:	Heap-based buffer overflow in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.
Alerts:	SuSE SUSE-SR:2008:001 2008-01-09 Debian DSA-1442-1 2007-12-29 Gentoo 200710-04 2007-10-07 Ubuntu USN-525-1 2007-10-04 Mandriva MDKSA-2007:191 2007-10-01 Fedora FEDORA-2007-2236 2007-09-24

Comments (none posted)

libtiff: buffer overflow

Package(s):	libtiff	CVE #(s):	CVE-2006-2193
Created:	June 15, 2006	Updated:	September 1, 2008
Description:	The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters in the DocumentName tag to overflow a buffer, causing a denial of service, and possibly the execution of arbitrary code.
Alerts:	CentOS CESA-2008:0848 2008-08-30 Red Hat RHSA-2008:0848-01 2008-08-28 Fedora FEDORA-2006-952 2006-09-05 SuSE SUSE-SA:2006:044 2006-08-01 Gentoo 200607-03 2006-07-09 SuSE SUSE-SR:2006:014 2006-06-20 Trustix TSLSA-2006-0036 2006-06-16 Mandriva MDKSA-2006:102 2006-06-14

Comments (none posted)

libvorbis: multiple memory corruption flaws

Package(s):	libvorbis	CVE #(s):	CVE-2007-3106 CVE-2007-4029
Created:	July 27, 2007	Updated:	January 22, 2008
Description:	This iSEC Partners security advisory has details on multiple memory corruption flaws in libvorbis.
Alerts:	Debian DSA-1471-1 2008-01-21 Gentoo 200710-03 2007-10-07 Red Hat RHSA-2007:0845-02 2007-09-19 Fedora FEDORA-2007-677 2007-08-30 Fedora FEDORA-2007-1765 2007-08-23 Mandriva MDKSA-2007:167-1 2007-08-20 Mandriva MDKSA-2007:167 2007-08-18 Ubuntu USN-498-1 2007-08-16 Foresight FLEA-2007-0035-1 2007-07-27 rPath rPSA-2007-0150-1 2007-07-27

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):	libxml2	CVE #(s):	CAN-2004-0989
Created:	October 28, 2004	Updated:	August 19, 2009
Description:	libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Ubuntu USN-89-1 2005-02-28 Red Hat RHSA-2004:650-01 2004-12-16 Conectiva CLA-2004:890 2004-11-18 Red Hat RHSA-2004:615-01 2004-11-12 Mandrake MDKSA-2004:127 2004-11-04 Debian DSA-582-1 2004-11-02 Gentoo 200411-05 2004-11-02 Trustix TSLSA-2004-0055 2004-10-29 OpenPKG OpenPKG-SA-2004.050 2004-10-31 Ubuntu USN-10-1 2004-10-28 Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

lighttpd: buffer overflow

Package(s):	lighttpd	CVE #(s):	CVE-2007-4727
Created:	September 12, 2007	Updated:	October 8, 2007
Description:	From the Fedora advisory: Lighttpd (1.4.17 and earlier) is prone to a header overflow when using the mod_fastcgi extension, this can lead to arbitrary code execution in the fastcgi application.
Alerts:	Debian DSA 1362-2 2007-10-07 Gentoo 200709-16 2007-09-27 Foresight FLEA-2007-0054-1 2007-09-17 rPath rPSA-2007-0183-1 2007-09-14 Fedora FEDORA-2007-2132 2007-09-12

Comments (none posted)

lighttpd: denial of service

Package(s):	lighttpd	CVE #(s):	CVE-2007-3946 CVE-2007-3947 CVE-2007-3948 CVE-2007-3949 CVE-2007-3950
Created:	July 19, 2007	Updated:	July 15, 2008
Description:	The lighttpd web server has multiple vulnerabilities involving a remote access-control setting circumvention that is performed by the sending of malformed requests. This can be used to crash the server and cause a denial of service.
Alerts:	Debian DSA-1609-1 2008-07-15 SuSE SUSE-SR:2007:015 2007-08-03 Debian DSA-1362 2007-08-29 Gentoo 200708-11 2007-08-16 Fedora FEDORA-2007-1299 2007-07-26 Foresight FLEA-2007-0034-1 2007-07-26 rPath rPSA-2007-0145-1 2007-07-19

Comments (none posted)

lookup-el: insecure temporary file

Package(s):	lookup-el	CVE #(s):	CVE-2007-0237
Created:	March 19, 2007	Updated:	December 10, 2007
Description:	Tatsuya Kinoshita discovered that Lookup, a search interface to electronic dictionaries on emacsen, creates a temporary file in an insecure fashion when the ndeb-binary feature is used, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.
Alerts:	Gentoo 200712-07 2007-12-09 Debian DSA-1269-1 2007-03-18

Comments (none posted)

lynx: arbitrary command execution

Package(s):	lynx	CVE #(s):	CVE-2005-2929
Created:	November 14, 2005	Updated:	September 14, 2009
Description:	An arbitrary command execute bug was found in the lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx.
Alerts:	Gentoo 200909-15 2009-09-12 Fedora-Legacy FLSA:152832 2005-12-17 OpenPKG OpenPKG-SA-2005.026 2005-12-03 Fedora FEDORA-2005-1079 2005-11-14 Fedora FEDORA-2005-1078 2005-11-14 Gentoo 200511-09 2005-11-13 Mandriva MDKSA-2005:211 2005-11-12 Red Hat RHSA-2005:839-01 2005-11-11

Comments (none posted)

mapserver: multiple cross-site scripting vulnerabilities

Package(s):	mapserver	CVE #(s):	CVE-2007-4542 CVE-2007-4629
Created:	September 5, 2007	Updated:	April 7, 2008
Description:	CVE-2007-4542: Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the (1) processLine function in maptemplate.c and the (2) writeError function in mapserv.c in the mapserv CGI program. CVE-2007-4629: Buffer overflow in the processLine function in maptemplate.c in MapServer before 4.10.3 allows attackers to cause a denial of service and possibly execute arbitrary code via a mapfile with a long layer name, group name, or metadata entry name.
Alerts:	Debian DSA-1539-1 2008-04-04 Fedora FEDORA-2007-2018 2007-09-04

Comments (none posted)

mod_jk: proxy bypass

Package(s):	mod_jk	CVE #(s):	CVE-2007-1860
Created:	May 30, 2007	Updated:	March 7, 2008
Description:	From the Red Hat advisory: "Versions of mod_jk before 1.2.23 decoded request URLs by default inside Apache httpd and forwarded the encoded URL to Tomcat, which itself did a second decoding. If Tomcat was used behind mod_jk and configured to only proxy some contexts, an attacker could construct a carefully crafted HTTP request to work around the context restriction and potentially access non-proxied content."
Alerts:	SuSE SUSE-SR:2008:005 2008-03-06 Gentoo 200708-15 2007-08-19 Debian DSA-1312-1 2007-06-18 Red Hat RHSA-2007:0380-01 2007-05-30 Red Hat RHSA-2007:0379-01 2007-05-30

Comments (none posted)

moin: arbitrary JavaScript execution

Package(s):	moin	CVE #(s):	CVE-2007-2423
Created:	May 8, 2007	Updated:	March 10, 2008
Description:	A flaw was discovered in MoinMoin's error reporting when using the AttachFile action. By tricking a user into viewing a crafted MoinMoin URL, an attacker could execute arbitrary JavaScript as the current MoinMoin user, possibly exposing the user's authentication information for the domain where MoinMoin was hosted.
Alerts:	Debian DSA-1514-1 2008-03-09 Ubuntu USN-458-1 2007-05-07

Comments (none posted)

moodle: cross-site scripting

Package(s):	moodle	CVE #(s):	CVE-2007-3555
Created:	August 7, 2007	Updated:	December 22, 2008
Description:	A cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter.
Alerts:	Debian DSA-1691-1 2008-12-22 Fedora FEDORA-2008-0610 2008-01-15 Fedora FEDORA-2007-1445 2007-08-06

Comments (none posted)

mplayer: buffer overflow

Package(s):	mplayer	CVE #(s):	CVE-2007-1246
Created:	March 8, 2007	Updated:	April 1, 2008
Description:	MPlayer versions up to 1.0rc1 have a buffer overflow in the loader/dmo/DMO_VideoDecoder.c DMO_VideoDecoder_Open function. user-assisted remote attackers can use this to create a buffer overflow and possibly execute arbitrary code.
Alerts:	Debian DSA-1536-1 2008-03-31 Gentoo 200705-21 2007-05-30 Foresight FLEA-2007-0013-1 2007-04-23 Slackware SSA:2007-109-02 2007-04-20 Gentoo 200704-09 2007-04-14 Ubuntu USN-433-1 2007-03-09 Mandriva MDKSA-2007:057 2007-03-08 Mandriva MDKSA-2007:055 2007-03-08

Comments (none posted)

mplayer: heap-based buffer overflow

Package(s):	mplayer	CVE #(s):	CVE-2007-4938
Created:	October 2, 2007	Updated:	October 3, 2007
Description:	A heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry value.
Alerts:	Mandriva MDKSA-2007:192 2007-10-01

Comments (none posted)

mydns: buffer overflows

Package(s):	mydns	CVE #(s):	CVE-2007-2362
Created:	May 23, 2007	Updated:	December 17, 2007
Description:	Multiple buffer overflows in MyDNS allow remote attackers to cause a denial of service (daemon crash) and possibly execution of arbitrary code.
Alerts:	Debian DSA-1434-1 2007-12-16 Debian-Testing DTSA-36-1 2007-05-22

Comments (none posted)

mysql: denial of service

Package(s):	mysql	CVE #(s):	CVE-2007-1420
Created:	March 22, 2007	Updated:	May 21, 2008
Description:	MySQL subselect queries using "ORDER BY" can be used by an attacker with access to a MySQL instance in order to create an intermittent denial of service.
Alerts:	Red Hat RHSA-2008:0364-01 2008-05-21 Mandriva MDKSA-2007:139 2007-07-04 rPath rPSA-2007-0107-1 2007-05-23 Gentoo 200705-11 2007-05-08 Ubuntu USN-440-1 2007-03-21

Comments (none posted)

mysql: format string bug

Package(s):	mysql	CVE #(s):	CVE-2006-3469
Created:	July 21, 2006	Updated:	July 30, 2008
Description:	Jean-David Maillefer discovered a format string bug in the date_format() function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server.
Alerts:	Red Hat RHSA-2008:0768-01 2008-07-24 Slackware SSA:2006-211-01 2006-07-31 Ubuntu USN-321-1 2006-07-21

Comments (none posted)

MySQL: privilege violations

Package(s):	mysql	CVE #(s):	CVE-2006-4031 CVE-2006-4226
Created:	August 25, 2006	Updated:	July 30, 2008
Description:	MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy (CVE-2006-4031). MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions (CVE-2006-4226).
Alerts:	Red Hat RHSA-2008:0768-01 2008-07-24 Red Hat RHSA-2008:0364-01 2008-05-21 Red Hat RHSA-2007:0152-01 2007-04-03 Red Hat RHSA-2007:0083-01 2007-02-19 Fedora FEDORA-2006-1298 2006-11-27 Fedora FEDORA-2006-1297 2006-11-27 Ubuntu USN-338-1 2006-09-05 Mandriva MDKSA-2006:149 2006-08-24

Comments (none posted)

mysql: multiple vulnerabilities

Package(s):	mysql	CVE #(s):	CVE-2007-3780
Created:	July 17, 2007	Updated:	November 27, 2007
Description:	MySQL Community Server before v5.0.45 has multiple vulnerabilities. See the MySQL Community Server 5.0.45 release announcement for details.
Alerts:	Debian DSA-1413-1 2007-11-26 Ubuntu USN-528-1 2007-10-11 Red Hat RHSA-2007:0894-01 2007-09-10 Mandriva MDKSA-2007:177 2007-09-06 Red Hat RHSA-2007:0875-01 2007-08-30 Gentoo 200708-10 2007-08-16 rPath rPSA-2007-0143-1 2007-07-17

Comments (none posted)

MySQL: logging bypass

Package(s):	mysql	CVE #(s):	CVE-2006-0903
Created:	April 4, 2006	Updated:	May 21, 2008
Description:	MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
Alerts:	Red Hat RHSA-2008:0364-01 2008-05-21 Ubuntu USN-274-2 2006-05-15 Ubuntu USN-274-1 2006-04-27 Mandriva MDKSA-2006:064 2006-04-03

Comments (2 posted)

nbd: arbitrary code execution

Package(s):	nbd	CVE #(s):	CVE-2005-3534
Created:	January 6, 2006	Updated:	March 7, 2011
Description:	Kurt Fitzner discovered that the NBD (network block device) server did not correctly verify the maximum size of request packets. By sending specially crafted large request packets, a remote attacker who is allowed to access the server could exploit this to execute arbitrary code with root privileges.
Alerts:	SuSE SUSE-SR:2006:001 2006-01-13 Ubuntu USN-237-1 2006-01-06

Comments (none posted)

ncompress: buffer underflow

Package(s):	ncompress	CVE #(s):	CVE-2006-1168
Created:	August 10, 2006	Updated:	February 21, 2012
Description:	The ncompress compression utility has a missing boundary check. A local user can use a maliciously created file to cause a a .bss buffer underflow.
Alerts:	Gentoo 200610-03 2006-10-06 Red Hat RHSA-2006:0663-01 2006-09-12 Mandriva MDKSA-2006:140 2006-08-09 Debian DSA-1149-1 2006-08-10 Red Hat RHSA-2012:0308-03 2012-02-21 Scientific Linux SL-busy-20120321 2012-03-21 Red Hat RHSA-2012:0810-04 2012-06-20 Scientific Linux SL-busy-20120709 2012-07-09 Mageia MGASA-2012-0171 2012-07-19 Mandriva MDVSA-2012:129 2012-08-10 Mandriva MDVSA-2012:129-1 2012-08-10

Comments (none posted)

nginx: cross site scripting

Package(s):	nginx	CVE #(s):
Created:	July 20, 2007	Updated:	September 14, 2009
Description:	Nginx [engine x] is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server written by Igor Sysoev. The "msie_refresh" directive could allow cross site scripting.
Alerts:	Fedora FEDORA-2007-1158 2007-07-19

Comments (none posted)

OpenOffice.org: arbitrary code execution

Package(s):	openoffice.org	CVE #(s):	CVE-2007-0245
Created:	June 13, 2007	Updated:	June 12, 2008
Description:	A specially crafted RTF file could cause the filter to overwrite data on the heap, which may lead to the execution of arbitrary code.
Alerts:	Fedora FEDORA-2008-5239 2008-06-11 Fedora FEDORA-2008-4104 2008-05-17 rPath rPSA-2007-0160-1 2007-08-14 Ubuntu USN-482-1 2007-07-10 Mandriva MDKSA-2007:144 2007-07-10 Gentoo 200707-02 2007-07-02 SuSE SUSE-SA:2007:037 2007-06-28 Fedora FEDORA-2007-606 2007-06-25 Fedora FEDORA-2007-0410 2007-06-13 Fedora FEDORA-2007-572 2007-06-12 Red Hat RHSA-2007:0406-01 2007-06-13 Debian DSA-1307-1 2007-06-12

Comments (none posted)

openoffice.org: arbitrary code execution via TIFF images

Package(s):	openoffice.org	CVE #(s):	CVE-2007-2834
Created:	September 17, 2007	Updated:	June 12, 2008
Description:	A heap overflow vulnerability has been discovered in the TIFF parsing code of the OpenOffice.org suite. The parser uses untrusted values from the TIFF file to calculate the number of bytes of memory to allocate. A specially crafted TIFF image could trigger an integer overflow and subsequently a buffer overflow that could cause the execution of arbitrary code.
Alerts:	Fedora FEDORA-2008-5239 2008-06-11 Fedora FEDORA-2008-4104 2008-05-17 Gentoo 200710-24 2007-10-23 Ubuntu USN-524-1 2007-10-04 Fedora FEDORA-2007-2372 2007-10-03 SuSE SUSE-SA:2007:052 2007-09-21 Mandriva MDKSA-2007:186 2007-09-17 rPath rPSA-2007-0189-1 2007-09-18 Foresight FLEA-2007-0056-1 2007-09-18 Fedora FEDORA-2007-700 2007-09-18 Red Hat RHSA-2007:0848-01 2007-09-18 Debian DSA-1375-1 2007-09-17

Comments (none posted)

OpenSSH: denial of service

Package(s):	openssh	CVE #(s):	CVE-2006-4925 CVE-2006-5052
Created:	October 6, 2006	Updated:	November 15, 2007
Description:	packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL. An unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
Alerts:	Red Hat RHSA-2007:0703-02 2007-11-15 Red Hat RHSA-2007:0540-04 2007-11-07 Fedora FEDORA-2007-394 2007-04-03 Gentoo 200611-06 2006-11-13 SuSE SUSE-SA:2006:062 2006-10-20 rPath rPSA-2006-0185-1 2006-10-05

Comments (none posted)

openssh: remote denial of service

Package(s):	openssh	CVE #(s):	CVE-2006-4924 CVE-2006-5051
Created:	September 27, 2006	Updated:	September 17, 2008
Description:	Openssh 4.4 fixes some security issues, including a pre-authentication denial of service, an unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort could be used to determine the validity of usernames on some platforms.
Alerts:	Debian DSA-1638-1 2008-09-16 Debian DSA-1212-1 2006-11-15 Fedora FEDORA-2006-1011 2006-10-03 Debian DSA-1189-1 2006-10-04 Mandriva MDKSA-2006:179 2006-10-03 Ubuntu USN-355-1 2006-10-02 OpenPKG OpenPKG-SA-2006.022 2006-10-01 Slackware SSA:2006-272-02 2006-09-29 Red Hat RHSA-2006:0698-01 2006-09-28 Red Hat RHSA-2006:0697-01 2006-09-28 Gentoo 200609-17:02 2006-09-27 rPath rPSA-2006-0174-1 2006-09-27 Gentoo 200609-17 2006-09-27

Comments (none posted)

openssl: off-by-one error

Package(s):	openssl	CVE #(s):	CVE-2007-5135
Created:	October 3, 2007	Updated:	July 31, 2008
Description:	From the Debian advisory: An off-by-one error has been identified in the SSL_get_shared_ciphers() routine in the libssl library from OpenSSL, an implementation of Secure Socket Layer cryptographic libraries and utilities. This error could allow an attacker to crash an application making use of OpenSSL's libssl library, or potentially execute arbitrary code in the security context of the user running such an application.
Alerts:	rPath rPSA-2008-0241-1 2008-07-30 SuSE SUSE-SR:2008:005 2008-03-06 Red Hat RHSA-2007:1003-02 2007-11-15 Red Hat RHSA-2007:0813-01 2007-10-22 Fedora FEDORA-2007-2530 2007-10-18 Fedora FEDORA-2007-725 2007-10-15 SuSE SUSE-SR:2007:020 2007-10-12 Red Hat RHSA-2007:0964-01 2007-10-12 Debian DSA-1379-2 2007-10-10 Gentoo 200710-06 2007-10-07 Mandriva MDKSA-2007:193 2007-10-04 rPath rPSA-2007-0206-1 2007-10-03 Foresight FLEA-2007-0058-1 2007-10-03 Debian DSA-1379 2007-10-02

Comments (none posted)

openssl: private key attack

Package(s):	openssl	CVE #(s):	CVE-2007-3108
Created:	August 7, 2007	Updated:	May 13, 2008
Description:	OpenSSL could allow a local user in certain circumstances to divulge information about private keys being used.
Alerts:	Debian DSA-1571-1 2008-05-13 Red Hat RHSA-2007:1003-02 2007-11-15 Ubuntu USN-522-1 2007-09-29 rPath rPSA-2007-0199-1 2007-09-25 Fedora FEDORA-2007-661 2007-08-13 Foresight FLEA-2007-0043-1 2007-08-13 rPath rPSA-2007-0155-1 2007-08-10 Fedora FEDORA-2007-1444 2007-08-06

Comments (none posted)

opera: multiple vulnerabilities

Package(s):	opera	CVE #(s):	CVE-2007-4367 CVE-2007-3929 CVE-2007-3142 CVE-2007-3819
Created:	August 23, 2007	Updated:	February 27, 2008
Description:	The Opera browser has multiple vulnerabilities. The JavaScript engine is vulnerable to a virtual function call on an invalid pointer that can be triggered by specially crafted JavaScript. A freed pointer in the BitTorrent support may be accessed, this can be used for malicious code execution. The browser is vulnerable to several memory read protection errors. There are URI display errors that can be used to trick users into visiting arbitrary web sites.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 SuSE SUSE-SA:2007:050 2007-08-30 Gentoo 200708-17 2007-08-22

Comments (none posted)

pam: privilege escalation

Package(s):	pam	CVE #(s):	CVE-2007-1716
Created:	June 12, 2007	Updated:	November 15, 2007
Description:	A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to an unauthorized user.
Alerts:	Red Hat RHSA-2007:0737-02 2007-11-15 Red Hat RHSA-2007:0555-04 2007-11-07 Fedora FEDORA-2007-546 2007-06-11 Red Hat RHSA-2007:0465-01 2007-06-11

Comments (none posted)

perl-Net-DNS: predictable id sequence

Package(s):	perl-Net-DNS	CVE #(s):	CVE-2007-3377
Created:	June 26, 2007	Updated:	March 12, 2008
Description:	Net::DNS before 0.60 uses an id sequence that is predictable and the same in all child processes.
Alerts:	Debian DSA-1515-1 2008-03-11 SuSE SUSE-SR:2007:017 2007-08-17 Gentoo 200708-06 2007-08-11 rPath rPSA-2007-0142-1 2007-07-17 Ubuntu USN-483-1 2007-07-11 Mandriva MDKSA-2007:146 2007-07-12 Red Hat RHSA-2007:0675-01 2007-07-12 Red Hat RHSA-2007:0674-01 2007-07-12 Fedora FEDORA-2007-609 2007-07-02 Fedora FEDORA-2007-612 2007-07-02 Fedora FEDORA-2007-0668 2007-06-25

Comments (none posted)

php: multiple vulnerabilities

Package(s):	php	CVE #(s):	CVE-2007-1001 CVE-2007-1285 CVE-2007-1718 CVE-2007-1583
Created:	April 16, 2007	Updated:	December 4, 2007
Description:	A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array. (CVE-2007-1285) A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection. (CVE-2007-1583) A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718) A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution. (CVE-2007-1001)
Alerts:	Ubuntu USN-549-2 2007-12-03 Ubuntu USN-549-1 2007-11-29 OpenPKG OpenPKG-SA-2007.019 2007-05-28 Fedora FEDORA-2007-526 2007-05-24 SuSE SUSE-SA:2007:032 2007-05-23 Slackware SSA:2007-127-01 2007-05-08 Debian DSA-1283-1 2007-04-29 Ubuntu USN-455-1 2007-04-27 Debian DSA-1282-1 2007-04-26 Red Hat RHSA-2007:0153-01 2007-04-20 Mandriva MDKSA-2007:090 2007-04-18 Mandriva MDKSA-2007:089 2007-04-18 Mandriva MDKSA-2007:088 2007-04-18 Mandriva MDKSA-2007:087 2007-04-18 Fedora FEDORA-2007-455 2007-04-18 rPath rPSA-2007-0073-1 2007-04-18 Fedora FEDORA-2007-415 2007-04-17 Red Hat RHSA-2007:0155-01 2007-04-16 Red Hat RHSA-2007:0154-01 2007-04-16 Red Hat RHSA-2007:0162-01 2007-04-16

Comments (none posted)

php: several vulnerabilities

Package(s):	php	CVE #(s):	CVE-2006-4481 CVE-2006-4484 CVE-2006-4485
Created:	September 8, 2006	Updated:	June 13, 2008
Description:	The file_exists and imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481). A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484). The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).
Alerts:	SuSE SUSE-SR:2008:013 2008-06-13 Mandriva MDVSA-2008:077 2007-03-26 SuSE SUSE-SR:2008:005 2008-03-06 Red Hat RHSA-2008:0146-01 2008-02-28 Fedora FEDORA-2008-1643 2008-02-13 Foresight FLEA-2008-0007-1 2008-02-11 Fedora FEDORA-2008-1122 2008-02-05 Fedora FEDORA-2008-1131 2008-02-05 SuSE SUSE-SR:2008:003 2008-02-07 Mandriva MDVSA-2008:038 2007-02-07 rPath rPSA-2008-0046-1 2008-02-06 Gentoo 200802-01 2008-02-06 rPath rPSA-2006-0182-1 2006-10-05 SuSE SUSE-SA:2006:052 2006-09-21 Red Hat RHSA-2006:0669-01 2006-09-21 Mandriva MDKSA-2006:162 2006-09-07

Comments (1 posted)

php: multiple vulnerabilities

Package(s):	php	CVE #(s):	CVE-2007-2872 CVE-2007-2756
Created:	June 1, 2007	Updated:	January 29, 2008
Description:	According to a vendor release announcement multiple security enhancements and fixes were fixed in version 5.2.3 of the programming language PHP.
Alerts:	SuSE SUSE-SA:2008:004 2008-01-29 Ubuntu USN-549-2 2007-12-03 Red Hat RHSA-2007:0891-01 2007-10-25 Ubuntu USN-549-1 2007-11-29 Red Hat RHSA-2007:0888-01 2007-10-23 Gentoo 200710-02 2007-10-07 Red Hat RHSA-2007:0889-01 2007-09-26 Fedora FEDORA-2007-709 2007-09-24 Mandriva MDKSA-2007:187 2007-09-21 Red Hat RHSA-2007:0890-02 2007-09-20 Fedora FEDORA-2007-2215 2007-09-18 rPath rPSA-2007-0188-1 2007-09-17 Slackware SSA:2007-255-03 2007-09-13 rPath rPSA-2007-0117-1 2007-06-07 Slackware SSA:2007-152-01 2007-06-04 OpenPKG OpenPKG-SA-2007.020 2007-06-01

Comments (none posted)

php: buffer overflows

Package(s):	php	CVE #(s):	CVE-2006-5465
Created:	November 3, 2006	Updated:	January 18, 2010
Description:	The Hardened-PHP Project discovered buffer overflows in htmlentities/htmlspecialchars internal routines to the PHP Project. Of course the whole purpose of these functions is to be filled with user input. (The overflow can only be when UTF-8 is used)
Alerts:	Mandriva MDVSA-2010:007 2010-01-15 SuSE SUSE-SA:2006:067 2006-11-15 rPath rPSA-2006-0205-1 2006-11-09 Red Hat RHSA-2006:0731-01 2006-11-10 Red Hat RHSA-2006:0730-01 2006-11-06 Debian DSA-1206-1 2006-11-06 Fedora FEDORA-2006-1169 2006-11-06 Fedora FEDORA-2006-1168 2006-11-06 Slackware SSA:2006-307-01 2006-11-06 OpenPKG OpenPKG-SA-2006.028 2006-11-06 Ubuntu USN-375-1 2006-11-02 Mandriva MDKSA-2006:196 2006-11-02

Comments (none posted)

phpbb2: missing input sanitizing

Package(s):	phpbb2	CVE #(s):	CVE-2006-1896
Created:	May 22, 2006	Updated:	February 11, 2008
Description:	It was discovered that phpbb2, a web based bulletin board, insufficiently sanitizes values passed to the "Font Color 3" setting, which might lead to the execution of injected code by admin users.
Alerts:	Debian DSA-1066-1 2006-05-20

Comments (none posted)

phpbb2: multiple vulnerabilities

Package(s):	phpbb2	CVE #(s):	CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537
Created:	December 22, 2005	Updated:	February 11, 2008
Description:	The phpbb2 web forum has a number of vulnerabilities including: a web script injection problem, a protection mechanism bypass, a security check bypass, a remote global variable bypass, cross site scripting vulnerabilities, an SQL injection vulnerability, a remote regular expression modification problem, missing input sanitizing, and a missing request validation problem.
Alerts:	Debian DSA-925-1 2005-12-22

Comments (none posted)

phpmyadmin: multiple vulnerabilities

Package(s):	phpmyadmin	CVE #(s):	CVE-2006-6942 CVE-2006-6944 CVE-2007-1325 CVE-2007-1395 CVE-2007-2245
Created:	September 10, 2007	Updated:	March 19, 2009
Description:	Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-1325: The PMA_ArrayWalkRecursive function in libraries/common.lib.php does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. CVE-2007-1395: Incomplete blacklist vulnerability in index.php allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>. CVE-2007-2245: Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function. CVE-2006-6942: Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php. CVE-2006-6944: phpMyAdmin allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers.
Alerts:	Gentoo 200903-32 2009-03-18 Mandriva MDKSA-2007:199 2007-10-17 Debian DSA-1370-2 2007-09-10 Debian DSA-1370-1 2007-09-09

Comments (none posted)

phpPgAdmin: cross-site scripting

Package(s):	phppgadmin	CVE #(s):	CVE-2007-2865 CVE-2007-5728
Created:	June 18, 2007	Updated:	January 21, 2009
Description:	A cross-site scripting (XSS) vulnerability in sqledit.php in phpPgAdmin 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the server parameter.
Alerts:	Debian DSA-1693-1 2008-12-27 Debian DSA-1693-2 2009-01-21 SuSE SUSE-SR:2007:024 2007-11-22 Fedora FEDORA-2007-1013 2007-07-11 Fedora FEDORA-2007-0469 2007-06-16

Comments (none posted)

pidgin: denial of service

Package(s):	pidgin	CVE #(s):	CVE-2007-4996
Created:	October 3, 2007	Updated:	November 2, 2007
Description:	Pidgin can be forced to crash by an MSN user sending "nudge" messages.
Alerts:	Fedora FEDORA-2007-2368 2007-10-03 Slackware SSA:2007-275-01 2007-10-03 Foresight FLEA-2007-0057-1 2007-10-02

Comments (1 posted)

postgresql: several vulnerabilities

Package(s):	postgresql	CVE #(s):	CVE-2007-3278 CVE-2007-3279 CVE-2007-3280
Created:	September 25, 2007	Updated:	February 1, 2008
Description:	PostgreSQL 8.1 and probably later and earlier versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1. (CVE-2007-3278) PostgreSQL 8.1 and probably later and earlier versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection. (CVE-2007-3279) The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access. (CVE-2007-3280)
Alerts:	Red Hat RHSA-2008:0040-01 2008-02-01 Gentoo 200801-15 2008-01-29 Ubuntu USN-568-1 2008-01-14 Debian DSA-1463-1 2008-01-14 Debian DSA-1460-1 2008-01-13 Red Hat RHSA-2008:0039-01 2008-01-11 Red Hat RHSA-2008:0038-01 2008-01-11 Mandriva MDKSA-2007:188 2007-09-25

Comments (1 posted)

proftpd: authentication bypass

Package(s):	proftpd	CVE #(s):	CVE-2007-2165
Created:	June 21, 2007	Updated:	November 5, 2007
Description:	The ProFTPD Auth API has an authentication bypass vulnerability. When multiple simultaneous authentication modules are configured, the ProFTPD module that checks authentication is not necessarily the same module that retrieves authentication data. This can be used by remote attackers to bypass the authentication system.
Alerts:	Fedora FEDORA-2007-2613 2007-11-05 Mandriva MDKSA-2007:130 2007-06-20

Comments (none posted)

pulseaudio: denial of service

Package(s):	pulseaudio	CVE #(s):	CVE-2007-1804
Created:	May 30, 2007	Updated:	March 10, 2008
Description:	The pulseaudio network code suffers from a denial of service vulnerability exploitable by an unauthenticated attacker.
Alerts:	Mandriva MDVSA-2008:065 2007-03-09 Ubuntu USN-465-1 2007-05-25

Comments (none posted)

python: information disclosure

Package(s):	python	CVE #(s):	CVE-2007-2052
Created:	May 9, 2007	Updated:	July 30, 2009
Description:	Python 2.4 and 2.5 contain a bug in PyLocale_strxfrm() which could enable an attacker to read portions of unrelated memory.
Alerts:	CentOS CESA-2009:1176 2009-07-29 Red Hat RHSA-2009:1176-01 2009-07-27 Debian DSA-1620-1 2008-07-27 Debian DSA-1551-1 2008-04-19 Ubuntu USN-585-1 2008-03-11 Red Hat RHSA-2007:1076-02 2007-12-10 Red Hat RHSA-2007:1077-01 2007-12-10 Foresight FLEA-2007-0019-1 2007-05-21 rPath rPSA-2007-0104-1 2007-05-17 Mandriva MDKSA-2007:099 2007-05-08

Comments (none posted)

qemu: multiple vulnerabilities

Package(s):	qemu	CVE #(s):	CVE-2007-1320 CVE-2007-1321 CVE-2007-1322 CVE-2007-1323 CVE-2007-1366
Created:	May 1, 2007	Updated:	January 19, 2009
Description:	Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service.
Alerts:	Fedora FEDORA-2008-11705 2008-12-24 Fedora FEDORA-2008-10000 2008-11-22 Fedora FEDORA-2008-9556 2008-11-12 SuSE SUSE-SR:2009:002 2009-01-19 Mandriva MDVSA-2008:162 2008-08-07 Fedora FEDORA-2008-4386 2008-05-28 Fedora FEDORA-2008-4604 2008-05-28 Fedora FEDORA-2007-713 2007-10-08 Debian DSA-1384-1 2007-10-05 Fedora FEDORA-2007-2270 2007-10-03 Red Hat RHSA-2007:0323-01 2007-10-02 Debian-Testing DTSA-38-1 2007-05-26 Debian DSA-1284-1 2007-05-01

Comments (none posted)

qgit: arbitrary code execution

Package(s):	qgit	CVE #(s):	CVE-2007-4631
Created:	September 10, 2007	Updated:	October 8, 2007
Description:	Not only does QGit construct a predictable file name here, and doesn't check if the files already exist, which can be leveraged into information leak or arbitrary file overwrite in case they're symlinks, but later on executes one of them. This is not just problem when /tmp is mounted with noexec option, but might be exploited into arbitrary code execution under time-dependent race condition.
Alerts:	Gentoo 200710-05 2007-10-07 Fedora FEDORA-2007-2108 2007-09-10

Comments (none posted)

qt: arbitrary code execution

Package(s):	qt	CVE #(s):	CVE-2007-3388
Created:	August 1, 2007	Updated:	December 10, 2007
Description:	Format string bugs were found in several Qt warning messages. Applications using Qt for processing certain data types could trigger them if the data caused Qt to print warnings. The bugs potentially allow to execute arbitrary code via specially crafted files (CVE-2007-3388).
Alerts:	Debian DSA-1426-1 2007-12-08 Gentoo 200708-16 2007-08-22 Slackware SSA:2007-222-03 2007-08-13 Foresight FLEA-2007-0042-1 2007-08-03 Ubuntu USN-495-1 2007-08-03 rPath rPSA-2007-0153-1 2007-08-01 Mandriva MDKSA-2007:151 2007-08-01 SuSE SUSE-SA:2007:048 2007-08-01 Red Hat RHSA-2007:0721-01 2007-07-31

Comments (none posted)

qt: buffer overflow

Package(s):	qt	CVE #(s):	CVE-2007-4137
Created:	September 14, 2007	Updated:	December 10, 2007
Description:	A buffer overflow was found in how Qt expanded malformed Unicode strings. If an application linked against Qt parsed a malicious Unicode string, it could lead to a denial of service or potentially allow for the execution of arbitrary code.
Alerts:	Debian DSA-1426-1 2007-12-08 Gentoo 200710-28 2007-10-25 rPath rPSA-2007-0204-1 2007-10-03 Foresight FLEA-2007-0059-1 2007-10-04 SuSE SUSE-SR:2007:019 2007-09-28 Ubuntu USN-513-1 2007-09-18 Fedora FEDORA-2007-703 2007-09-18 Fedora FEDORA-2007-2216 2007-09-18 Mandriva MDKSA-2007:183 2007-09-13

Comments (none posted)

quagga: denial of service

Package(s):	quagga	CVE #(s):	CVE-2007-4826
Created:	September 14, 2007	Updated:	October 25, 2010
Description:	The bgpd daemon in Quagga prior to 0.99.9 allowed remote BGP peers to cause a denial of service crash via a malformed OPEN message or COMMUNITY attribute.
Alerts:	CentOS CESA-2010:0785 2010-10-25 CentOS CESA-2010:0785 2010-10-20 Red Hat RHSA-2010:0785-01 2010-10-20 Debian DSA-1379-1 2007-10-01 Trustix TSLSA-2007-0028 2007-09-21 Fedora FEDORA-2007-2196 2007-09-18 Ubuntu USN-512-1 2007-09-15 Mandriva MDKSA-2007:182 2007-09-13 Oracle ELSA-2012-1258 2012-09-13

Comments (none posted)

quake: buffer overflow

Package(s):	quake3-bin	CVE #(s):	CVE-2006-2236
Created:	May 10, 2006	Updated:	January 12, 2009
Description:	Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server.
Alerts:	Gentoo 200901-06 2009-01-11 Gentoo 200605-12 2006-05-10

Comments (none posted)

redhat-cluster-suite: denial of service

Package(s):	redhat-cluster-suite	CVE #(s):	CVE-2007-3380
Created:	July 19, 2007	Updated:	November 14, 2007
Description:	The redhat cluster suite's cluster manager is vulnerable to a remote attack. Attackers can connect to the DLM port and block subsequent DLM operations, resulting in a denial of service.
Alerts:	Ubuntu USN-489-1 2007-07-19 Red Hat RHSA-2007:0940-01 2007-10-22 Ubuntu USN-489-2 2007-07-19

Comments (1 posted)

rsync: off-by-one errors

Package(s):	rsync	CVE #(s):	CVE-2007-4091
Created:	August 20, 2007	Updated:	December 3, 2007
Description:	Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.
Alerts:	Slackware SSA:2007-335-01 2007-12-03 Gentoo 200709-13 2007-09-20 Debian DSA-1360 2007-08-28 Foresight FLEA-2007-0047-1 2007-08-23 rPath rPSA-2007-0168-1 2007-08-22 Ubuntu USN-500-1 2007-08-20 Mandriva MDKSA-2007:166 2007-08-18

Comments (1 posted)

samba: incorrect group assignment

Package(s):	samba	CVE #(s):	CVE-2007-4138
Created:	September 12, 2007	Updated:	November 15, 2007
Description:	From the Samba advisory: When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.
Alerts:	Red Hat RHSA-2007:1017-01 2007-11-15 Red Hat RHSA-2007:1016-01 2007-11-15 rPath rPSA-2007-0184-1 2007-09-14 Slackware SSA:2007-255-02 2007-09-13 Fedora FEDORA-2007-2145 2007-09-12

Comments (1 posted)

slocate: information disclosure

Package(s):	slocate	CVE #(s):	CVE-2007-0227
Created:	February 22, 2007	Updated:	September 4, 2012
Description:	The slocate permission checking code has a local information disclosure vulnerability. During the reporting of matching files, slocate does not respect the parent directory's read permissions, resulting in hidden filenames being viewable by other local users.
Alerts:	Foresight FLEA-2007-0005-1 2007-03-29 Ubuntu USN-425-1 2007-02-22 Slackware SSA:2012-244-05 2012-08-31

Comments (none posted)

star: directory traversal vulnerability

Package(s):	star	CVE #(s):	CVE-2007-4134
Created:	August 28, 2007	Updated:	October 23, 2007
Description:	Star saves many files together into a single tape or disk archive, and can restore individual files from the archive. Star supports ACL. Version 1.5a84 fixes a directory traversal vulnerability.
Alerts:	Gentoo 200710-23 2007-10-22 Foresight FLEA-2007-0051-1 2007-09-06 Red Hat RHSA-2007:0873-01 2007-09-04 Fedora FEDORA-2007-1852 2007-08-27

Comments (none posted)

streamripper: buffer overflow

Package(s):	streamripper	CVE #(s):	CVE-2007-4337
Created:	September 14, 2007	Updated:	December 9, 2008
Description:	Chris Rohlf discovered several boundary errors in the httplib_parse_sc_header() function when processing HTTP headers.
Alerts:	Debian DSA-1683-1 2008-12-08 Gentoo 200709-03 2007-09-13

Comments (none posted)

Sun JDK/JRE: multiple vulnerabilities

Package(s):	Sun JDK/JRE	CVE #(s):	CVE-2007-2435 CVE-2007-2788 CVE-2007-2789
Created:	June 1, 2007	Updated:	April 18, 2008
Description:	An unspecified vulnerability involving an "incorrect use of system classes" was reported by the Fujitsu security team. Additionally, Chris Evans from the Google Security Team reported an integer overflow resulting in a buffer overflow in the ICC parser used with JPG or BMP files, and an incorrect open() call to /dev/tty when processing certain BMP files.
Alerts:	Gentoo 200804-20 2008-04-17 Red Hat RHSA-2007:1086-01 2007-12-12 Red Hat RHSA-2007:0817-01 2007-08-06 SuSE SUSE-SA:2007:045 2007-07-18 Gentoo 200706-08 2007-06-26 Gentoo 200705-23 2007-05-31

Comments (none posted)

sylpheed: format string vulnerability

Package(s):	sylpheed	CVE #(s):	CVE-2007-2958
Created:	August 28, 2007	Updated:	October 26, 2007
Description:	Ulf Harnhammar (Secunia Research) has discovered a format string vulnerability in sylpheed and claws-mail in inc_put_error() function in src/inc.c when displaying POP3 error reply. The problem can be exploited by malicious POP3 server via specially crafted POP3 server replies containing format specifiers. See this Secunia advisory for more information.
Alerts:	Gentoo 200710-29 2007-10-25 Fedora FEDORA-2007-2009 2007-09-04 Fedora FEDORA-2007-1841 2007-08-27

Comments (none posted)

sysstat: insecure temporary files

Package(s):	sysstat	CVE #(s):	CVE-2007-3852
Created:	August 20, 2007	Updated:	September 23, 2011
Description:	The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.
Alerts:	CentOS CESA-2011:1005 2011-09-22 Scientific Linux SL-syss-20110721 2011-07-21 Red Hat RHSA-2011:1005-01 2011-07-21 Fedora FEDORA-2007-675 2007-08-27 Fedora FEDORA-2007-1697 2007-08-20

Comments (1 posted)

t1lib: buffer overflow

Package(s):	t1lib	CVE #(s):	CVE-2007-4033
Created:	September 20, 2007	Updated:	February 12, 2008
Description:	T1lib, an enhanced rasterizer for X11 Type 1 fonts, does not properly perform bounds checking. An attacker can send specially crafted input to applications linked against the library in order to create a buffer overflow, resulting in a denial of service or the execution of arbitrary code.
Alerts:	Foresight FLEA-2008-0006-1 2008-02-11 rPath rPSA-2008-0007-1 2008-01-04 Mandriva MDKSA-2007:230 2007-11-20 Fedora FEDORA-2007-3308 2007-11-20 Fedora FEDORA-2007-750 2007-11-21 Fedora FEDORA-2007-3390 2007-11-20 Red Hat RHSA-2007:1027-02 2007-11-08 Debian DSA-1390-1 2007-10-18 Gentoo 200710-12 2007-10-12 Fedora FEDORA-2007-2343 2007-09-28 Mandriva MDKSA-2007:189 2007-09-27 Ubuntu USN-515-1 2007-09-19

Comments (none posted)

tar: symlink path traversal vulnerability

Package(s):	tar	CVE #(s):	CVE-2007-4131
Created:	August 23, 2007	Updated:	December 28, 2007
Description:	The tar utility has a symlink path traversal vulnerability involving extracted archives. Maliciously created tar archives can be used to write arbitrary data to files that the tar user has write access to.
Alerts:	Debian DSA-1438-1 2007-12-28 Gentoo 200709-09 2007-09-15 Mandriva MDKSA-2007:173 2007-09-04 Fedora FEDORA-2007-683 2007-08-30 SuSE SUSE-SR:2007:018 2007-08-31 Fedora FEDORA-2007-1890 2007-08-29 Ubuntu USN-506-1 2007-08-28 rPath rPSA-2007-0172-1 2007-08-25 Foresight FLEA-2007-0049-1 2007-08-27 Red Hat RHSA-2007:0860-01 2007-08-23

Comments (none posted)

tcpdump: integer overflow

Package(s):	tcpdump	CVE #(s):	CVE-2007-3798
Created:	July 20, 2007	Updated:	November 15, 2007
Description:	An integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
Alerts:	Red Hat RHSA-2007:0387-02 2007-11-15 Red Hat RHSA-2007:0368-03 2007-11-07 Slackware SSA:2007-230-01 2007-08-20 Debian DSA-1353-1 2007-08-11 Fedora FEDORA-2007-654 2007-08-01 Fedora FEDORA-2007-1361 2007-07-31 Ubuntu USN-492-1 2007-07-30 Gentoo 200707-14 2007-07-28 Mandriva MDKSA-2007:148 2007-07-25 rPath rPSA-2007-0147-1 2007-07-20

Comments (none posted)

tcpdump: denial of service

Package(s):	tcpdump	CVE #(s):	CVE-2007-1218
Created:	March 5, 2007	Updated:	November 15, 2007
Description:	Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.
Alerts:	Red Hat RHSA-2007:0387-02 2007-11-15 Mandriva MDKSA-2007:155 2007-08-09 Debian DSA-1272-1 2007-03-22 Fedora FEDORA-2007-348 2007-03-15 Fedora FEDORA-2007-347 2007-03-15 Mandriva MDKSA-2007:056 2006-03-08 Ubuntu USN-429-1 2007-03-06 rPath rPSA-2007-0048-1 2007-03-03

Comments (none posted)

tcp-wrappers: unauthorized access

Package(s):	tcp-wrappers	CVE #(s):	CVE-2007-5137
Created:	August 30, 2007	Updated:	October 13, 2007
Description:	The TCP wrapper library can improperly allow connections to services that do not have server-side connection details specified. Remote attackers can connect to blocked services.
Alerts:	Ubuntu USN-507-1 2007-08-30

Comments (none posted)

terminal: arbitrary code execution

Package(s):	terminal	CVE #(s):	CVE-2007-3770
Created:	August 13, 2007	Updated:	December 19, 2007
Description:	A vulnerability was found in the Xfce terminal program: Lasse Karkkainen discovered that the function terminal_helper_execute() in file terminal-helper.c does not properly escape the URIs before processing.
Alerts:	Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Debian DSA-1393-1 2007-10-23 Fedora FEDORA-2007-1620 2007-08-15 Ubuntu USN-497-1 2007-08-14 Gentoo 200708-07 2007-08-11

Comments (none posted)

tetex: buffer overflow

Package(s):	tetex	CVE #(s):	CVE-2007-0650
Created:	May 8, 2007	Updated:	May 13, 2008
Description:	A buffer overflow in the open_sty function in mkind.c for makeindex 2.14 in teTeX might allow user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. NOTE: other overflows exist but might not be exploitable, such as a heap-based overflow in the check_idx function.
Alerts:	Gentoo 200805-13 2008-05-12 Gentoo 200709-17 2007-09-27 Mandriva MDKSA-2007:109 2007-05-23 rPath rPSA-2007-0092-1 2007-05-07

Comments (1 posted)

tomcat: directory traversal

Package(s):	tomcat	CVE #(s):	CVE-2007-0450
Created:	May 2, 2007	Updated:	February 27, 2008
Description:	Versions of tomcat prior to 5.5.22 do not properly filter filename separator characters, enabling information disclosure attacks.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Mandriva MDKSA-2007:241 2007-12-10 Red Hat RHSA-2007:0360-01 2007-05-24 Red Hat RHSA-2007:0328-01 2007-05-24 Fedora FEDORA-2007-514 2007-05-21 Red Hat RHSA-2007:0326-01 2007-05-21 Red Hat RHSA-2007:0327-01 2007-05-14 Gentoo 200705-03 2007-05-01

Comments (none posted)

tomcat: cross-site scripting

Package(s):	tomcat	CVE #(s):	CVE-2007-2449 CVE-2007-2450
Created:	July 17, 2007	Updated:	February 17, 2009
Description:	Some JSPs within the 'examples' web application did not escape user provided data. If the JSP examples were accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks (CVE-2007-2449). Note: it is recommended the 'examples' web application not be installed on a production system. The Manager and Host Manager web applications did not escape user provided data. If a user is logged in to the Manager or Host Manager web application, an attacker could perform a cross-site scripting attack (CVE-2007-2450).
Alerts:	SuSE SUSE-SR:2009:004 2009-02-17 Fedora FEDORA-2008-8130 2008-09-16 SuSE SUSE-SR:2008:007 2008-03-28 Fedora FEDORA-2008-1603 2008-02-13 Fedora FEDORA-2008-1467 2008-02-13 Debian DSA-1468-1 2008-01-20 Mandriva MDKSA-2007:241 2007-12-10 Fedora FEDORA-2007-3474 2007-11-17 Fedora FEDORA-2007-3456 2007-11-17 Red Hat RHSA-2007:0569-01 2007-07-17

Comments (1 posted)

tomcat: multiple vulnerabilities

Package(s):	tomcat	CVE #(s):	CVE-2007-3382 CVE-2007-3385 CVE-2007-3386
Created:	September 26, 2007	Updated:	September 13, 2010
Description:	Tomcat was found treating single quote characters -- ' -- as delimiters in cookies. This could allow remote attackers to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3382). It was reported Tomcat did not properly handle the following character sequence in a cookie: \" (a backslash followed by a double-quote). It was possible remote attackers could use this failure to obtain sensitive information, such as session IDs, for session hijacking attacks (CVE-2007-3385). A cross-site scripting (XSS) vulnerability existed in the Host Manager Servlet. This allowed remote attackers to inject arbitrary HTML and web script via crafted requests (CVE-2007-3386).
Alerts:	Mandriva MDVSA-2010:176 2010-09-12 SuSE SUSE-SR:2009:004 2009-02-17 Fedora FEDORA-2008-8130 2008-09-16 Red Hat RHSA-2008:0195-01 2008-04-28 SuSE SUSE-SR:2008:005 2008-03-06 Fedora FEDORA-2008-1603 2008-02-13 Fedora FEDORA-2008-1467 2008-02-13 Debian DSA-1447-1 2008-01-03 Mandriva MDKSA-2007:241 2007-12-10 Fedora FEDORA-2007-3456 2007-11-17 Fedora FEDORA-2007-3474 2007-11-17 Red Hat RHSA-2007:0950-01 2007-11-05 Red Hat RHSA-2007:0876-01 2007-10-11 Red Hat RHSA-2007:0871-01 2007-09-26

Comments (none posted)

vim: arbitrary code execution

Package(s):	vim	CVE #(s):	CVE-2007-2953
Created:	July 30, 2007	Updated:	November 27, 2008
Description:	vim is vulnerable to a user-assisted attack in which vim may execute arbitrary code when helptags is run on data that has been maliciously crafted.
Alerts:	CentOS CESA-2008:0580 2008-11-26 CentOS CESA-2008:0617 2008-11-25 Red Hat RHSA-2008:0617-01 2008-11-25 Red Hat RHSA-2008:0580-01 2008-11-25 Debian DSA-1364-2 2007-09-19 Debian DSA-1364-1 2007-09-01 Ubuntu USN-505-1 2007-08-28 Mandriva MDKSA-2007:168 2007-08-21 rPath rPSA-2007-0151-1 2007-07-31 Foresight FLEA-2007-0036-1 2007-07-30

Comments (none posted)

vixie-cron: weak permissions may cause errors

Package(s):	vixie-cron	CVE #(s):	CVE-2007-1856
Created:	April 17, 2007	Updated:	December 4, 2007
Description:	During an internal audit, Raphael Marichez of the Gentoo Linux Security Team found that Vixie Cron has weak permissions set on Gentoo, allowing for a local user to create hard links to system and users cron files, while a st_nlink check in database.c will generate a superfluous error.
Alerts:	Mandriva MDKSA-2007:234 2007-12-03 Red Hat RHSA-2007:0345-01 2007-05-17 Gentoo 200704-11 2007-04-16

Comments (1 posted)

vlc: several vulnerabilities

Package(s):	vlc	CVE #(s):	CVE-2007-3316 CVE-2007-3467 CVE-2007-3468
Created:	July 10, 2007	Updated:	March 10, 2008
Description:	Several remote vulnerabilities have been discovered in the VideoLan multimedia player and streamer, which may lead to the execution of arbitrary code.
Alerts:	Gentoo 200803-13 2008-03-07 Gentoo 200707-12 2007-07-28 Debian DSA-1332-1 2007-07-09

Comments (none posted)

wireshark: multiple vulnerabilities

Package(s):	wireshark	CVE #(s):	CVE-2007-3390 CVE-2007-3392 CVE-2007-3393
Created:	June 28, 2007	Updated:	February 27, 2008
Description:	The wireshark network traffic analyzer has three vulnerabilities that can be used to create a denial of service. These include off-by-one overflows in the iSeries dissector, vulnerabilities in the MMS and SSL dissectors that can cause an infinite loop and an off-by-one overflow in the DHCP/BOOTP dissector.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Red Hat RHSA-2008:0059-01 2008-01-21 Red Hat RHSA-2007:0709-02 2007-11-15 Red Hat RHSA-2007:0710-04 2007-11-07 Gentoo 200708-12 2007-08-16 Fedora FEDORA-2007-628 2007-07-09 rPath rPSA-2007-0137-1 2007-07-11 Mandriva MDKSA-2007:145 2007-07-10 Fedora FEDORA-2007-0982 2007-07-09 Debian DSA-1322-1 2007-06-27

Comments (none posted)

XFree86 X.org: integer overflows

Package(s):	xfree86 x.org	CVE #(s):	CVE-2007-1003 CVE-2007-1667 CVE-2007-1351 CVE-2007-1352
Created:	April 3, 2007	Updated:	August 11, 2009
Description:	iDefense reported an integer overflow flaw in the XFree86 XC-MISC extension. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server. (CVE-2007-1003) iDefense reported two integer overflows in the way X.org handled various font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.org server. (CVE-2007-1351, CVE-2007-1352) An integer overflow flaw was found in the XFree86 XGetPixel() function. Improper use of this function could cause an application calling it to function improperly, possibly leading to a crash or arbitrary code execution. (CVE-2007-1667)
Alerts:	Debian DSA-1858-1 2009-08-10 SuSE SUSE-SR:2008:008 2008-04-04 Debian DSA-1454-1 2008-01-07 Debian DSA-1294-1 2007-05-17 Gentoo 200705-10 2007-05-08 Gentoo 200705-06 2007-05-05 Gentoo 200705-02 2007-05-01 Ubuntu USN-453-2 2007-04-26 SuSE SUSE-SA:2007:027 2007-04-20 Slackware SSA:2007-109-01 2007-04-20 Ubuntu USN-453-1 2007-04-18 Red Hat RHSA-2007:0157-01 2007-04-16 Red Hat RHSA-2007:0150-01 2007-04-16 Mandriva MDKSA-2007:079-1 2007-04-11 Mandriva MDKSA-2007:080-1 2007-04-10 Mandriva MDKSA-2007:081-1 2007-04-10 Fedora FEDORA-2007-427 2007-04-10 Fedora FEDORA-2007-426 2007-04-10 Fedora FEDORA-2007-425 2007-04-10 Fedora FEDORA-2007-424 2007-04-10 Fedora FEDORA-2007-423 2007-04-09 Fedora FEDORA-2007-422 2007-04-09 Foresight FLEA-2007-0009-1 2007-04-05 Mandriva MDKSA-2007:080 2007-04-04 Mandriva MDKSA-2007:081 2007-04-04 Mandriva MDKSA-2007:079 2007-04-04 rPath rPSA-2007-0065-1 2007-04-04 Ubuntu USN-448-1 2007-04-03 Red Hat RHSA-2007:0132-01 2007-04-03 Red Hat RHSA-2007:0127-01 2007-04-03 Red Hat RHSA-2007:0126-01 2007-04-03 Red Hat RHSA-2007:0125-01 2007-04-03

Comments (none posted)

xine-lib: arbitrary code execution

Package(s):	xine-lib	CVE #(s):	CVE-2007-1387
Created:	March 13, 2007	Updated:	April 1, 2008
Description:	Moritz Jodeit discovered that the DirectShow loader of Xine did not correctly validate the size of an allocated buffer. By tricking a user into opening a specially crafted media file, an attacker could execute arbitrary code with the user's privileges.
Alerts:	Debian DSA-1536-1 2008-03-31 Mandriva MDKSA-2007:062 2007-03-13 Mandriva MDKSA-2007:061 2007-03-13 Ubuntu USN-435-1 2007-03-12

Comments (none posted)

xine-lib: buffer overflow

Package(s):	xine-lib	CVE #(s):	CVE-2006-1664
Created:	April 27, 2006	Updated:	February 27, 2008
Description:	xine-lib does an improper input data boundary check on MPEG streams. A specially crafted MPEG file can be created that can cause arbitrary code execution when the file is accessed.
Alerts:	Gentoo 200802-12 2008-02-26 Gentoo 200604-16 2006-04-26

Comments (none posted)

xmms: BMP handling vulnerability

Package(s):	xmms	CVE #(s):	CVE-2007-0653 CVE-2007-0654
Created:	March 28, 2007	Updated:	July 26, 2011
Description:	xmms suffers from vulnerabilities in its handling of BMP images. Should a hostile image be included in an xmms skin, it could lead to code execution on the user's system.
Alerts:	Fedora FEDORA-2011-9421 2011-07-16 Fedora FEDORA-2011-9413 2011-07-16 Debian DSA-1277-1 2007-04-04 Mandriva MDKSA-2007:071 2007-03-29 Ubuntu USN-445-1 2007-03-27

Comments (none posted)

X.org: temp file vulnerability

Package(s):	X.org	CVE #(s):	CVE-2007-3103
Created:	July 12, 2007	Updated:	July 2, 2009
Description:	The X.Org X11 xfs font server has a temp file vulnerability in the startup script. A local user can modify the permissions of the script in order to elevate their local privileges.
Alerts:	Fedora FEDORA-2009-3651 2009-04-14 Fedora FEDORA-2009-3666 2009-04-14 Debian DSA-1342-1 2007-07-30 rPath rPSA-2007-0141-1 2007-07-17 Foresight FLEA-2007-0031-1 2007-07-12 Red Hat RHSA-2007:0520-01 2007-07-12 Red Hat RHSA-2007:0519-01 2007-07-12

Comments (none posted)

xorg-server: local privilege escalation

Package(s):	xorg-server	CVE #(s):	CVE-2007-4730
Created:	September 10, 2007	Updated:	January 24, 2008
Description:	Aaron Plattner discovered a buffer overflow in the Composite extension of the X.org X server, which can lead to local privilege escalation.
Alerts:	Mandriva MDVSA-2008:022 2008-01-23 Gentoo 200710-16 2007-10-14 Ubuntu USN-514-1 2007-09-18 Red Hat RHSA-2007:0898-01 2007-09-19 rPath rPSA-2007-0187-1 2007-09-14 Mandriva MDKSA-2007:178 2007-09-11 Debian DSA-1372-1 2007-09-09

Comments (none posted)

xterm: local user unauthorized access

Package(s):	xterm	CVE #(s):	CVE-2007-2797
Created:	August 27, 2007	Updated:	November 15, 2007
Description:	Previous versions of the xterm package assigned incorrect ownership and write permissions to pseudo-terminal devices, permitting local users to direct output to other users' xterm sessions.
Alerts:	Red Hat RHSA-2007:0701-02 2007-11-15 rPath rPSA-2007-0169-1 2007-08-23 Foresight FLEA-2007-0048-1 2007-08-23

Comments (1 posted)

Page editor: Jake Edge

Kernel development

Brief items

Kernel release status

The current stable 2.6 release is 2.6.23, released, finally, on October 9. For those just tuning in, 2.6.23 includes the CFS CPU scheduler, the fallocate() system call, a new generic SCSI driver, some memory fragmentation avoidance work, SMP guest support in KVM, the UIO user-space driver framework, Lguest, and much more. See the KernelNewbies 2.6.23 page for vast amounts of information or the long-format changelog for the full list of changesets in 2.6.23.

The 2.6.22.10 stable update was released on October 10 with about one dozen fixes.

For older kernels: 2.6.16.54 was released on October 7 with a handful of changes, mostly in the MD subsystem. 2.6.16.55-rc1, released on the same day, has fixes for several security issues.

Comments (none posted)

Kernel development news

Quotes of the week

-- Casey Schaufler

-- Dave Jones

Comments (1 posted)

PF_CAN

The Controller Area Network (CAN) specification describes a networking stack aimed at a specific environment: embedded, realtime controller networks. At the physical layer, it uses a differential serial technology which is intended to be highly resistant to electrical noise. The higher-level protocols use short datagrams (eight bytes maximum payload) and extensive checksumming to minimize the effect of errors. The protocols are simple in the extreme, placing the smallest possible demand on embedded controllers. CAN will be found in relatively small and hostile environments - inside automobiles, for example. So it makes sense that an automobile manufacturer - not the sort of company known for leading-edge Linux kernel development - is working to get a CAN implementation into the mainline kernel.

There have been CAN implementations on Linux before, though none have made their way into the mainline. Most of them, however, have taken the easy way out: make a CAN controller look more-or-less like a serial port and implement the protocols at the application level. This approach works, but it loses the advantages of having a networking stack around. Any CAN application which wants to take advantage of queueing, quality-of-service controls, the familiar socket API, etc. must implement that functionality itself. All of this may soon change, though, as the PF_CAN protocol family patches posted by Urs Thuermann, Oliver Hartkopp, and several others, matures.

As would be expected, these patches add a new PF_CAN protocol family which can be passed to the socket() system call. From there, sockets can be bound, read from, and written to in all the usual ways. Basic raw sockets can be used to send and receive datagrams on the (broadcast) bus. There is a mechanism for adding filters so that only datagrams of interest are received on a given interface. The PF_CAN implementation also comes with network drivers for a number of CAN interfaces. All told, it looks about as one would expect for a new network protocol family within the kernel. With this code in place, applications using CAN look almost like any other network-based Linux application.

What caught your editor's eye with this patch set was the fact that it is being posted by some developers at Volkswagen. It is not uncommon to see Linux used in any number of embedded applications, and it is not surprising to see companies extending Linux in ways which make it more useful for their purposes - the ability to do so is one of the reasons for using Linux in the first place. But it is rather less common to see companies whose core competence is far from kernel hacking try to contribute changes back to the mainline. So your editor dropped Mr. Thuermann a note asking a few questions about this work. It turns out that creating network-based CAN support for Linux has been a long task:

The resulting patch set is just now getting close to its culmination; Urs would like to encourage anybody who is interested in how the CAN implementation has been designed to look at the documentation and the mailing list archives before jumping in.

The next question that tends to come to mind is something along the lines of "how do I get root access on my VW?" It turns out that the combination of Linux and CAN is not - yet - being shipped in any of VW's cars. It is heavily used in a number of research projects, though; Urs mentioned potential applications in user interfaces, "infotainment," navigation systems, car-to-car communications, and more. CAN is also used to communicate with onboard systems from external diagnostic and monitoring systems. Whether Linux/CAN-based systems will ever find their way into production vehicles from VW remains to be seen. As Urs put it:

Regardless of what one manufacturer decides to use, though, it seems clear that there should be plenty of potential users for a CAN implementation which is properly built into Linux. Handheld gadgets are only a subset of the embedded application space; many complex embedded systems will need this sort of simple, resilient communications infrastructure.

First, though, this code needs to find its way into the mainline. The CAN developers had a bit of a disconnect with the networking maintainers back in August which will not have helped that cause. The issues would appear to have been resolved, and the CAN developers are posting patches and fixing the issues which are brought up by reviewers. Inclusion in 2.6.24 seems highly unlikely, but one more development cycle might be enough to get this code into shape for merging.

All things considered, a bump or two during the review process for a patch like this is not particularly surprising. Companies like Volkswagen are not in the habit of contributing kernel patches. Instead, VW has done some work which was useful for its own purposes and is now making the (considerable) extra effort to share that code with the rest of the world. VW's developers do not work with the development process every day; it is not surprising that some friction resulted here. To their credit, those developers managed to overcome the issues and appear to be sticking with the process through to the end.

This story could be repeated many times, for better or for worse. There will be no end of companies adapting Linux to their specific needs - that is why some of them will use free software in the first place. If we are lucky, some of those companies will try to contribute their work back so that others can make use of it and improve on it. These companies will not be familiar with our processes and may lack the time and the will to persevere in the face of a hostile reaction. Finding ways of helping these companies get their work into the mainline would appear to be in everybody's interest; otherwise we may well lose contributions we would have rather merged.

(See also: Wikipedia for more information on Controller Area Network).

Comments (3 posted)

Playing with printk()

The venerable printk() function is one of the primary communication channels from the kernel to user space. printk() looks much like the standard C printf(), but with a few differences, including support for log levels. This function has not seen much change in recent times, but there are now a couple of people looking at enhancing it in various ways.

The most ambitious changes are being pushed by Vegard Nossum. This work came initially from the discussion of the revived Linux-tiny patch set. One of the quickest ways to reduce the size of a binary kernel image is to remove all of the printk() calls and their associated format strings. The downside of doing that, of course, is that it results in a kernel which can no longer communicate. If something starts to go wrong on a printk()-less system, there is often no way to determine what the problem is. Usually only one experience like that is required before one decides that, perhaps, storing a few thousand format strings is not the worst possible use for a bit of memory.

Vegard's original patch addressed this problem by reworking the definition of printk() such that calls below a given log level could be dropped at compile time. With this change in place, debugging messages could be removed from the kernel while the more important messaged would be retained. This change is made at the cost of creating a whole new kprint() infrastructure and breaking occasional printk() callers, though.

This patch also made a number of other changes aimed at different objectives. In particular, Vegard is trying to help developers who are looking to translate kernel messages into other languages on the fly. Supporting translation directly inside the kernel has never been a popular option, so that part of the task must be done in user space. But people working on translation still think it would be nice if the messages coming out of the kernel were formatted in a way which made translation easier.

One of the things which complicates translation, it seems, is the encoding of arguments into kernel messages. What the translation developers would like to see is a format where arguments are kept separate from the format string itself, making it easy to write expressions which match the strings and, perhaps, do something intelligent with the arguments separately. So Vegard's patch changed the output format (as seen in the kernel log buffer) entirely. Arguments were encoded, but kept separate with the idea that the user-space log daemon would put things together. So, while a current kernel might print something like:

    usb-storage: cheesy flash drive detected at 12

the new format would be more like:

    "usb-storage: cheesy flash drive detected at %d", "12"

In fact, there was more to it than that - the new format also included fields for the log level, current time, file name, line number, and current function.

This patch raised a few eyebrows. A patch which was intended to help shrink the kernel, but which, in the end, added a new log buffer format and about 1600 lines to the kernel tree seemed a bit inconsistent. Nobody really wants to have to put together a more complicated user-space log daemon just to make sense of kernel messages. Overall, it seemed like the addition of a fair amount of complexity for not much gain. So this patch did not get very far.

Acting on a suggestion from Alan Cox, Vegard came back with a much simpler solution aimed at the translation problem. Rather than create an entirely new log format, the new patch simply puts marker characters (0x1f) around each encoded argument. This character does not display on serial consoles (though it does result in "funny symbols" on VGA consoles, currently), but it can be picked out by translation code. This more focused solution has not yet gotten a lot of feedback, but it might point the way toward the creation of more translation-friendly messages without forcing big changes to the kernel - or to the habits of kernel developers.

Meanwhile, Jan Engelhardt decided to stir things up and improve the "cuteness" of Linux by adding a color output option for kernel messages. The initial version of the patch set a single color for all messages; later updates added per-loglevel coloring as well. Some developers like this feature, while others see it as useless bloat. One remarked that "Coloring isn't useful. If it was, it would be implemented ~16 years ago." In the end, the patch is small and the default output does not change, so there probably is no real reason for it not to go in. One can only hope the distributors can resist the temptation to set up message colors which are as garishly unreadable as those they seem to prefer for tools like ls.

Comments (8 posted)

The design of preemptible read-copy-update

This document walks through the design of preemptible RCU.

Introduction

Read-copy update (RCU) is a synchronization API that is sometimes used in place of reader-writer locks. RCU's read-side primitives offer extremely low overhead and deterministic execution time. The downside of this deterministic read-side execution time is that RCU updaters cannot block RCU readers. This means that RCU updaters can be expensive, as they must leave old versions of the data structure in place to accommodate pre-existing readers. Furthermore, these old versions must be reclaimed after all pre-existing readers complete. A time period during which all such pre-existing readers complete is called a "grace period".

The Linux kernel offers a number of RCU implementations, the first such implementation being called "Classic RCU". More material introducing RCU may be found in the Documentation/RCU directory in any recent Linux source tree, or at Paul McKenney's RCU page.

The RCU implementation for the -rt patchset is unusual in that it permits read-side critical sections to be preempted and to be blocked waiting for locks. However, it does not handle general blocking (for example, via the wait_event() primitive): if you need that, you should instead use SRCU. In contrast to SRCU, preemptible RCU only permits blocking within primitives that are both subject to priority inheritance and non-blocking in a non-CONFIG_PREEMPT kernel. This ability to acquire blocking locks and to be preempted within RCU read-side critical sections is required for the aggressive real-time capabilities provided by Ingo Molnar's -rt patchset. However, the initial preemptible RCU implementation that was added to -rt in August 2005 has some limitations, including:

1. Its read-side primitives cannot be called from within non-maskable interrupt (NMI) or systems-management interrupt handlers.

2. Its read-side primitives use both atomic instructions and memory barriers, both of which have excessive overhead.

3. It does no priority boosting of RCU read-side critical sections (however, this has been described previously, and so will not be discussed further here).

The new preemptible RCU implementation that was submitted to LKML (most recently with this patch as of this writing) removes these limitations, and this document describes its design.

Quick Quiz 1: Why is it important that blocking primitives called from within a preemptible-RCU read-side critical section be subject to priority inheritance?

Quick Quiz 2: Could the prohibition against using primitives that would block in a non-CONFIG_PREEMPT kernel be lifted, and if so, under what conditions?

Conceptual RCU

Understanding and validating an RCU implementation is much easier given a view of RCU at the lowest possible level. In contrast with other RCU documentation, the goal of this section is not to help you understand how to use RCU, but rather to understand the most basic concurrency requirements that an RCU implementation must support.

RCU implementations must obey the following rule: if any statement in a given RCU read-side critical section precedes a grace period, then all statements in that RCU read-side critical section must complete before that grace period ends.

This is illustrated by the following picture, where time advances from left to right:

The red "Removal" box represents the update-side critical section that modifies the RCU-protected data structure, for example, via list_del_rcu(); the large yellow "Grace Period" box represents a grace period (surprise!) which might be invoked via synchronize_rcu(), and the green "Reclamation" box represents freeing the affected data element, perhaps via kfree(). The blue "Reader" boxes each represent an RCU read-side critical section, for example, beginning with rcu_read_lock() and ending with rcu_read_unlock(). The red-rimmed "Reader" box is an example of an illegal situation: any so-called RCU implementation that permits a read-side critical section to completely overlap a grace period is buggy, since the updater might free up memory that this reader is still using.

So, what is the poor RCU implementation to do in this situation?

It must extend the grace period, perhaps as shown below:

In short, the RCU implementation must ensure that any RCU read-side critical sections in progress at the start of a given grace period have completely finished, memory operations and all, before that grace period is permitted to complete. This fact allows RCU validation to be extremely focused: simply demonstrate that any RCU read-side critical section in progress at the beginning of a grace period must terminate before that grace period ends, along with sufficient barriers to prevent either the compiler or the CPU from undoing the RCU implementation's work.

Overview of Preemptible RCU Algorithm

This section focuses on a specific implementation of preemptible RCU. Many other implementations are possible, and for additional discussion of these other possibilities, please see the 2006 OLS paper or the 2005 linux.conf.au paper.

Instead, this article focuses on the general approach, the data structures, the grace-period state machine, and a walk through the read-side primitives.

General Approach

Because this implementation of preemptible RCU does not require memory barriers in rcu_read_lock() and rcu_read_unlock(), a multi-stage grace-period detection algorithm is required. Instead of using a single wait queue of callbacks (which has sufficed for earlier RCU implementations), this implementation uses an array of wait queues, so that RCU callbacks are enqueued on each element of this array in turn. This difference in callback flow is shown in the following figure for a preemptible RCU implementation with two waitlist stages per grace period (in contrast, the September 10 patch uses four waitlist stages):

Given two stages per grace period, any pair of stages forms a full grace period. Similarly, in an implementation with four stages per grace period, any sequence of four stages would form a full grace period.

To determine when a grace-period stage can end, preemptible RCU uses a per-CPU two-element rcu_flipctr array that tracks in-progress RCU read-side critical sections. One element of a given CPU's rcu_flipctr array tracks old RCU read-side critical sections, in other words, critical sections that started before the current grace-period stage. The other element tracks new RCU read-side critical sections, namely those starting during the current grace-period stage. The array elements switch roles at the beginning of each new grace-period stage, as follows:

During the first stage on the left-hand side of the above figure, rcu_flipctr[0] tracks the new RCU read-side critical sections, and is therefore incremented by rcu_read_lock() and decremented by rcu_read_unlock(). Similarly, rcu_flipctr[1] tracks the old RCU read-side critical sections (those that started during earlier stages), and is therefore decremented by rcu_read_unlock() and never incremented at all.

Because each CPU's old rcu_flipctr[1] elements are never incremented, their sum across all CPUs must eventually go to zero, although preemption in the midst of an RCU read-side critical section might cause any individual counter to remain non-zero or even to go negative. For example, suppose that a task calls rcu_read_lock() on one CPU, is preempted, resumes on another CPU, and then calls rcu_read_unlock(). The first CPU's counter will then be +1 and the second CPU's counter will be -1, however, they will still sum to zero. Regardless of possible preemption, when the sum of the old counter elements does go to zero, it is safe to move to the next grace-period stage, as shown on the right-hand side of the above figure.

In this second stage, the elements of each CPU's rcu_flipctr counter array switch roles. The rcu_flipctr[0] counter now tracks the old RCU read-side critical sections, in other words, the ones that started during grace period stage 0. Similarly, the rcu_flipctr[1] counter now tracks the new RCU read-side critical sections that start in grace period stage 1. Therefore, rcu_read_lock() now increments rcu_flipctr[1], while rcu_read_unlock() still might decrement either counter. Specifically, if the matching rcu_read_lock() executed during grace-period stage 0 (the old stage at this point), then rcu_read_unlock() must decrement rcu_flipctr[0], but if the matching rcu_read_lock() executed during grace-period stage 1 (the new stage), then rcu_read_unlock() must instead decrement rcu_flipctr[1].

The critical point is that all rcu_flipctr elements tracking the old RCU read-side critical sections must strictly decrease. Therefore, once the sum of these old counters reaches zero, it cannot change.

The rcu_read_lock() primitive uses the bottom bit of the current grace-period counter (rcu_ctrlblk.completed & 0x1) to index the rcu_flipctr array, and records this index in the task structure. The matching rcu_read_unlock() uses this recorded value to ensure that it decrements a counter corresponding to the one that the matching rcu_read_lock() incremented. Of course, if the RCU read-side critical section has been preempted, rcu_read_lock() might be decrementing the counter belonging to a different CPU than the one whose counter was incremented by the matching rcu_read_lock().

Each CPU also maintains rcu_flip_flag and and rcu_mb_flag per-CPU variables. The rcu_flip_flag variable is used to synchronize the start of each grace-period stage: once a given CPU has responded to its rcu_flip_flag, it must refrain from incrementing the rcu_flip array element that now corresponds to the old grace-period stage. The CPU that advances the counter (rcu_ctrlblk.completed) changes the value of each CPU's rcu_mb_flag to rcu_flipped, but a given rcu_mb_flag may be changed back to rcu_flip_seen only by the corresponding CPU. The rcu_mb_flag variable is used to force each CPU to execute a memory barrier at the end of each grace-period stage. These memory barriers are required to ensure that memory accesses from RCU read-side critical sections ending in a given grace-period stage are ordered before the end of that stage. This approach gains the benefits of memory barriers at the beginning and end of each RCU read-side critical section without having to actually execute all those costly barriers. The rcu_mb_flag is set to rcu_mb_needed by the CPU that detects that the sum of the old counters is zero, but a given rcu_mb_flag is changed back to rcu_mb_done only by the corresponding CPU, and even then only after executing a memory barrier.

Data Structures

This section describes preemptible RCU's major data structures, including rcu_ctrlblk, rcu_data, rcu_flipctr, rcu_try_flip_state, rcu_try_flip_flag, and rcu_mb_flag.

rcu_ctrlblk

The rcu_ctrlblk structure is global, and holds the lock that protects grace-period processing (fliplock) as well as holding the global grace-period counter (completed). The least-significant bit of completed is used by rcu_read_lock() to select which set of counters to increment.

rcu_data

The rcu_data structure is a per-CPU structure, and contains the following fields:

• lock guards the remaining fields in this structure.
• completed is used to synchronize CPU-local activity with the global counter in rcu_ctrlblk.
• waitlistcount is used to maintain a count of the number of non-empty wait-lists. This field is used by rcu_pending() to help determine if this CPU has any RCU-related work left to be done.
• nextlist, nextail, waitlist, waittail, donelist, and donetail form lists containing RCU callbacks that are waiting for invocation at the end of a grace period. Each list has a tail pointer, allowing O(1) appends. The RCU callbacks flow through these lists as shown below.
• rcupreempt_trace accumulates statistics.

The figure on the right shows how RCU callbacks flow through a given rcu_data structure's lists, from creation by call_rcu() through invocation by rcu_process_callbacks(). Each blue arrow represents one pass by the grace-period state machine, which is described in a later section.

rcu_flipctr

As noted earlier, the rcu_flipctr per-CPU array of counters contains the counter pairs that track outstanding RCU read-side critical sections. Any given counter in this array can go negative, for example, when a task is migrated to a different CPU in the middle of an RCU read-side critical section. However, the sum of the counters will still remain positive throughout the corresponding grace period, and will furthermore go to zero at the end of that grace period.

rcu_try_flip_state

The rcu_try_flip_state variable tracks the current state of the grace-period state machine, as described in the next section.

rcu_try_flip_flag

The rcu_try_flip_flag per-CPU variable alerts the corresponding CPU that the grace-period counter has recently been incremented, and also records that CPU's acknowledgment. Once a given CPU has acknowledged the counter flip, all subsequent actions taken by rcu_read_lock() on that CPU must account for the new value of the grace-period counter, in particular, when incrementing rcu_flipctr in rcu_read_lock().

rcu_mb_flag

The rcu_mb_flag per-CPU variable alerts the corresponding CPU that it must execute a memory barrier in order for the grace-period state machine to proceed, and also records that CPU's acknowledgment. Once a given CPU has executed its memory barrier, the memory operations of all prior RCU read-side critical sections will be visible to any code sequenced after the corresponding grace period.

Grace-Period State Machine

This section gives an overview of the states executed by the grace-period state machine, and then walks through the relevant code.

Grace-Period State Machine Overview

The state (recorded in rcu_try_flip_state) can take on the following values:

• rcu_try_flip_idle_state: the grace-period state machine is idle due to there being no RCU grace-period activity. The rcu_ctrlblk.completed grace-period counter is incremented upon exit from this state, and all of the per-CPU rcu_flip_flag variables are set to rcu_flipped.

• rcu_try_flip_waitack_state: waiting for all CPUs to acknowledge that they have seen the previous state's increment, which they do by setting their rcu_flip_flag variables to rcu_flip_seen. Once all CPUs have so acknowledged, we know that the old set of counters can no longer be incremented.

• rcu_try_flip_waitzero_state: waiting for the old counters to sum to zero. Once the counters sum to zero, all of the per-CPU rcu_mb_flag variables are set to rcu_mb_needed.

• rcu_try_flip_waitmb_state: waiting for all CPUs to execute a memory-barrier instruction, which they signify by setting their rcu_mb_flag variables to rcu_mb_done. Once all CPUs have done so, all CPUs are guaranteed to see the changes made by any RCU read-side critical section that started before the beginning of the corresponding grace period, even on weakly ordered machines.

The grace period state machine cycles through these states sequentially, as shown in the following figure.

The next figure shows how the state machine operates over time. The states are shown along the figure's left-hand side and the relevant events are shown along the timeline, with time proceeding in the downward direction. We will elaborate on this figure when we validate the algorithm in a later section.

In the meantime, here are some important things to note:

1. The increment of the rcu_ctrlblk.completed counter might be observed at different times by different CPUs, as indicated by the blue oval. However, after a given CPU has acknowledged the increment, it is required to use the new counter. Therefore, once all CPUs have acknowledged, the old counter can only be decremented.

2. A given CPU advances its callback lists just before acknowledging the counter increment.

3. The blue oval represents the fact that memory reordering might cause different CPUs to see the increment at different times. This means that a given CPU might believe that some other CPU has jumped the gun, using the new value of the counter before the counter was actually incremented. In fact, in theory, a given CPU might see the next increment of the rcu_ctrlblk.completed counter as early as the last preceding memory barrier. (Note well that this sentence is very imprecise. If you intend to do correctness proofs involving memory barriers, please see the section on formal validation.)

4. Because rcu_read_lock() does not contain any memory barriers, the corresponding RCU read-side critical sections might be reordered by the CPU to follow the rcu_read_unlock(). Therefore, the memory barriers are required to ensure that the actions of the RCU read-side critical sections have in fact completed.

5. As we will see, the fact that different CPUs can see the counter flip happening at different times means that a single trip through the state machine is not sufficient for a grace period: multiple trips are required.

Grace-Period State Machine Walkthrough

This section walks through the C code that implements the RCU grace-period state machine, which is invoked from the scheduling-clock interrupt, which invokes rcu_check_callbacks() with irqs (and thus also preemption) disabled. This function is implemented as follows:

  1 void rcu_check_callbacks(int cpu, int user)
  2 {
  3   unsigned long flags;
  4   struct rcu_data *rdp = RCU_DATA_CPU(cpu);
  5 
  6   rcu_check_mb(cpu);
  7   if (rcu_ctrlblk.completed == rdp->completed)
  8     rcu_try_flip();
  9   spin_lock_irqsave(&rdp->lock, flags);
 10   RCU_TRACE_RDP(rcupreempt_trace_check_callbacks, rdp);
 11   __rcu_advance_callbacks(rdp);
 12   spin_unlock_irqrestore(&rdp->lock, flags);
 13 }

Line 4 selects the rcu_data structure corresponding to the current CPU, and line 6 checks to see if this CPU needs to execute a memory barrier to advance the state machine out of the rcu_try_flip_waitmb_state state. Line 7 checks to see if this CPU is already aware of the current grace-period stage number, and line 8 attempts to advance the state machine if so. Lines 9 and 12 hold the rcu_data's lock, and line 11 advances callbacks if appropriate. Line 10 updates RCU tracing statistics, if enabled via CONFIG_RCU_TRACE.

The rcu_check_mb() function executes a memory barrier as needed:

  1 static void rcu_check_mb(int cpu)
  2 {
  3   if (per_cpu(rcu_mb_flag, cpu) == rcu_mb_needed) {
  4     smp_mb();
  5     per_cpu(rcu_mb_flag, cpu) = rcu_mb_done;
  6   }
  7 }

Line 3 checks to see if this CPU needs to execute a memory barrier, and, if so, line 4 executes one and line 5 informs the state machine. Note that this memory barrier ensures that any CPU that sees the new value of rcu_mb_flag will also see the memory operations executed by this CPU in any prior RCU read-side critical section.

The rcu_try_flip() function implements the top level of the RCU grace-period state machine:

  1 static void rcu_try_flip(void)
  2 {
  3   unsigned long flags;
  4 
  5   RCU_TRACE_ME(rcupreempt_trace_try_flip_1);
  6   if (unlikely(!spin_trylock_irqsave(&rcu_ctrlblk.fliplock, flags))) {
  7     RCU_TRACE_ME(rcupreempt_trace_try_flip_e1);
  8     return;
  9   }
 10   switch (rcu_try_flip_state) {
 11   case rcu_try_flip_idle_state:
 12     if (rcu_try_flip_idle())
 13       rcu_try_flip_state = rcu_try_flip_waitack_state;
 14     break;
 15   case rcu_try_flip_waitack_state:
 16     if (rcu_try_flip_waitack())
 17       rcu_try_flip_state = rcu_try_flip_waitzero_state;
 18     break;
 19   case rcu_try_flip_waitzero_state:
 20     if (rcu_try_flip_waitzero())
 21       rcu_try_flip_state = rcu_try_flip_waitmb_state;
 22     break;
 23   case rcu_try_flip_waitmb_state:
 24     if (rcu_try_flip_waitmb())
 25       rcu_try_flip_state = rcu_try_flip_idle_state;
 26   }
 27   spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
 28 }

Line 6 attempts to acquire the global RCU state-machine lock, and returns if unsuccessful. Lines; 5 and 7 accumulate RCU-tracing statistics (again, if CONFIG_RCU_TRACE is enabled). Lines 10 through 26 execute the state machine, each invoking a function specific to that state. Each such function returns 1 if the state needs to be advanced and 0 otherwise. In principle, the next state could be executed immediately, but in practice we choose not to do so in order to reduce latency. Finally, line 27 releases the global RCU state-machine lock that was acquired by line 6.

The rcu_try_flip_idle() function is called when the RCU grace-period state machine is idle, and is thus responsible for getting it started when needed. Its code is as follows:

  1 static int rcu_try_flip_idle(void)
  2 {
  3   int cpu;
  4 
  5   RCU_TRACE_ME(rcupreempt_trace_try_flip_i1);
  6   if (!rcu_pending(smp_processor_id())) {
  7     RCU_TRACE_ME(rcupreempt_trace_try_flip_ie1);
  8     return 0;
  9   }
 10   RCU_TRACE_ME(rcupreempt_trace_try_flip_g1);
 11   rcu_ctrlblk.completed++;
 12   smp_mb();
 13   for_each_cpu_mask(cpu, rcu_cpu_online_map)
 14     per_cpu(rcu_flip_flag, cpu) = rcu_flipped;
 15   return 1;
 16 }

Line 6 checks to see if there is any RCU grace-period work pending for this CPU, and if not, line 8 leaves, telling the top-level state machine to remain in the idle state. If instead there is work to do, line 11 increments the grace-period stage counter, line 12 does a memory barrier to ensure that CPUs see the new counter before they see the request to acknowledge it, and lines 13 and 14 set all of the online CPUs' rcu_flip_flag. Finally, line 15 tells the top-level state machine to advance to the next state.

The rcu_try_flip_waitack() function checks to see if all online CPUs have acknowledged the counter flip (AKA "increment", but called "flip" because the bottom bit, which rcu_read_lock() uses to index the rcu_flipctr array, does flip). If they have, it tells the top-level grace-period state machine to move to the next state.

  1 static int rcu_try_flip_waitack(void)
  2 {
  3   int cpu;
  4 
  5   RCU_TRACE_ME(rcupreempt_trace_try_flip_a1);
  6   for_each_cpu_mask(cpu, rcu_cpu_online_map)
  7     if (per_cpu(rcu_flip_flag, cpu) != rcu_flip_seen) {
  8       RCU_TRACE_ME(rcupreempt_trace_try_flip_ae1);
  9       return 0;
 10     }
 11   smp_mb();
 12   RCU_TRACE_ME(rcupreempt_trace_try_flip_a2);
 13   return 1;
 14 }

Line 6 cycles through all of the online CPUs, and line 7 checks to see if the current such CPU has acknowledged the last counter flip. If not, line 9 tells the top-level grace-period state machine to remain in this state. Otherwise, if all online CPUs have acknowledged, then line 11 does a memory barrier to ensure that we don't check for zeroes before the last CPU acknowledges. This may seem dubious, but CPU designers have sometimes done strange things. Finally, line 13 tells the top-level grace-period state machine to advance to the next state.

The rcu_try_flip_waitzero() function checks to see if all pre-existing RCU read-side critical sections have completed, telling the state machine to advance if so.

  1 static int rcu_try_flip_waitzero(void)
  2 {
  3   int cpu;
  4   int lastidx = !(rcu_ctrlblk.completed & 0x1);
  5   int sum = 0;
  6 
  7   RCU_TRACE_ME(rcupreempt_trace_try_flip_z1);
  8   for_each_possible_cpu(cpu)
  9     sum += per_cpu(rcu_flipctr, cpu)[lastidx];
 10   if (sum != 0) {
 11     RCU_TRACE_ME(rcupreempt_trace_try_flip_ze1);
 12     return 0;
 13   }
 14   smp_mb();
 15   for_each_cpu_mask(cpu, rcu_cpu_online_map)
 16     per_cpu(rcu_mb_flag, cpu) = rcu_mb_needed;
 17   RCU_TRACE_ME(rcupreempt_trace_try_flip_z2);
 18   return 1;
 19 }

Lines 8 and 9 sum the counters, and line 10 checks to see if the result is zero, and, if not, line 12 tells the state machine to stay right where it is. Otherwise, line 14 executes a memory barrier to ensure that no CPU sees the subsequent call for a memory barrier before it has exited its last RCU read-side critical section. This possibility might seem remote, but again, CPU designers have done stranger things, and besides, this is anything but a fastpath. Lines 15 and 16 set all online CPUs' rcu_mb_flag variables, and line 18 tells the state machine to advance to the next state.

The rcu_try_flip_waitmb() function checks to see if all online CPUs have executed the requested memory barrier, telling the state machine to advance if so.

  1 static int rcu_try_flip_waitmb(void)
  2 {
  3   int cpu;
  4 
  5   RCU_TRACE_ME(rcupreempt_trace_try_flip_m1);
  6   for_each_cpu_mask(cpu, rcu_cpu_online_map)
  7     if (per_cpu(rcu_mb_flag, cpu) != rcu_mb_done) {
  8       RCU_TRACE_ME(rcupreempt_trace_try_flip_me1);
  9       return 0;
 10     }
 11   smp_mb();
 12   RCU_TRACE_ME(rcupreempt_trace_try_flip_m2);
 13   return 1;
 14 }

Lines 6 and 7 check each online CPU to see if it has done the needed memory barrier, and if not, line 9 tells the state machine not to advance. Otherwise, if all CPUs have executed a memory barrier, line 11 executes a memory barrier to ensure that any RCU callback invocation follows all of the memory barriers, and line 13 tells the state machine to advance.

The __rcu_advance_callbacks() function advances callbacks and acknowledges the counter flip.

  1 static void __rcu_advance_callbacks(struct rcu_data *rdp)
  2 {
  3   int cpu;
  4   int i;
  5   int wlc = 0;
  6 
  7   if (rdp->completed != rcu_ctrlblk.completed) {
  8     if (rdp->waitlist[GP_STAGES - 1] != NULL) {
  9       *rdp->donetail = rdp->waitlist[GP_STAGES - 1];
 10       rdp->donetail = rdp->waittail[GP_STAGES - 1];
 11       RCU_TRACE_RDP(rcupreempt_trace_move2done, rdp);
 12     }
 13     for (i = GP_STAGES - 2; i >= 0; i--) {
 14       if (rdp->waitlist[i] != NULL) {
 15         rdp->waitlist[i + 1] = rdp->waitlist[i];
 16         rdp->waittail[i + 1] = rdp->waittail[i];
 17         wlc++;
 18       } else {
 19         rdp->waitlist[i + 1] = NULL;
 20         rdp->waittail[i + 1] =
 21           &rdp->waitlist[i + 1];
 22       }
 23     }
 24     if (rdp->nextlist != NULL) {
 25       rdp->waitlist[0] = rdp->nextlist;
 26       rdp->waittail[0] = rdp->nexttail;
 27       wlc++;
 28       rdp->nextlist = NULL;
 29       rdp->nexttail = &rdp->nextlist;
 30       RCU_TRACE_RDP(rcupreempt_trace_move2wait, rdp);
 31     } else {
 32       rdp->waitlist[0] = NULL;
 33       rdp->waittail[0] = &rdp->waitlist[0];
 34     }
 35     rdp->waitlistcount = wlc;
 36     rdp->completed = rcu_ctrlblk.completed;
 37   }
 38   cpu = raw_smp_processor_id();
 39   if (per_cpu(rcu_flip_flag, cpu) == rcu_flipped) {
 40     smp_mb();
 41     per_cpu(rcu_flip_flag, cpu) = rcu_flip_seen;
 42     smp_mb();
 43   }
 44 }

Line 7 checks to see if the global rcu_ctrlblk.completed counter has advanced since the last call by the current CPU to this function. If not, callbacks need not be advanced (lines 8-37). Otherwise, lines 8 through 37 advance callbacks through the lists (while maintaining a count of the number of non-empty lists in the wlc variable). In either case, lines 38 through 43 acknowledge the counter flip if needed.

Quick Quiz 3: How is it possible for lines 38-43 of __rcu_advance_callbacks() to be executed when lines 7-37 have not? Won't they both be executed just after a counter flip, and never at any other time?

Read-Side Primitives

This section examines the rcu_read_lock() and rcu_read_unlock() primitives, followed by a discussion of how this implementation deals with the fact that these two primitives do not contain memory barriers.

rcu_read_lock()

The implementation of rcu_read_lock() is as follows:

  1 void __rcu_read_lock(void)
  2 {
  3   int idx;
  4   struct task_struct *me = current;
  5   int nesting;
  6 
  7   nesting = ACCESS_ONCE(me->rcu_read_lock_nesting);
  8   if (nesting != 0) {
  9     me->rcu_read_lock_nesting = nesting + 1;
 10   } else {
 11     unsigned long flags;
 12 
 13     local_irq_save(flags);
 14     idx = ACCESS_ONCE(rcu_ctrlblk.completed) & 0x1;
 15     smp_read_barrier_depends();  /* @@@@ might be unneeded */
 16     ACCESS_ONCE(__get_cpu_var(rcu_flipctr)[idx])++;
 17     ACCESS_ONCE(me->rcu_read_lock_nesting) = nesting + 1;
 18     ACCESS_ONCE(me->rcu_flipctr_idx) = idx;
 19     local_irq_restore(flags);
 20   }
 21 }

(Note: this code is under review and will likely change somewhat. This version matches that posted to LKML on September 10, 2007.)

Line 7 fetches this task's RCU read-side critical-section nesting counter. If line 8 finds that this counter is non-zero, then we are already protected by an outer rcu_read_lock(), in which case line 9 simply increments this counter.

However, if this is the outermost rcu_read_lock(), then more work is required. Lines 13 and 19 suppress and restore irqs to ensure that the intervening code is neither preempted nor interrupted by a scheduling-clock interrupt (which runs the grace period state machine). Line 14 fetches the grace-period counter, line 15 is likely to be unnecessary (but was intended to ensure that changes to the index and value remain ordered, and is a no-op on all CPUs other than Alpha), line 16 increments the current counter for this CPU, line 17 increments the nesting counter, and line 18 records the old/new counter index so that rcu_read_unlock() can decrement the corresponding counter (but on whatever CPU it ends up running on).

The ACCESS_ONCE() macros force the compiler to emit the accesses in order. Although this does not prevent the CPU from reordering the accesses from the viewpoint of other CPUs, it does ensure that NMI and SMI handlers running on this CPU will see these accesses in order. This is critically important:

1. In absence of the ACCESS_ONCE() in the assignment to idx, the compiler would be within its rights to: (a) eliminate the local variable idx and (b) compile the increment on line 16 as a fetch-increment-store sequence, doing separate accesses to rcu_ctrlblk.completed for the fetch and the store. If the value of rcu_ctrlblk.completed had changed in the meantime, this would corrupt the rcu_flipctr values.

2. If the assignment to rcu_read_lock_nesting (line 17) were to be reordered to precede the increment of rcu_flipctr (line 16), and if an NMI occurred between these two events, then an rcu_read_lock() in that NMI's handler would incorrectly conclude that it was already under the protection of rcu_read_lock().

3. If the assignment to rcu_read_lock_nesting (line 17) were to be reordered to follow the assignment to rcu_flipctr_idx (line 18), and if an NMI occurred between these two events, then an rcu_read_lock() in that NMI's handler would clobber rcu_flipctr_idx, possibly causing the matching rcu_read_unlock() to decrement the wrong counter. This in turn could result in premature ending of a grace period, indefinite extension of a grace period, or even both.

It is not clear that the ACCESS_ONCE on the assignment to nesting (line 7) is required. It is also unclear whether the smp_read_barrier_depends() (line 15) is needed: it was added to ensure that changes to index and value remain ordered.

The reasons that irqs must be disabled from line 13 through line 19 are as follows:

1. Suppose one CPU loaded rcu_ctrlblk.completed (line 14), then a second CPU incremented this counter, and then the first CPU took a scheduling-clock interrupt. The first CPU would then see that it needed to acknowledge the counter flip, which it would do. This acknowledgment is a promise to avoid incrementing the newly old counter, and this CPU would break this promise. Worse yet, this CPU might be preempted immediately upon return from the scheduling-clock interrupt, and thus end up incrementing the counter at some random point in the future. Either situation could disrupt grace-period detection.

2. Disabling irqs has the side effect of disabling preemption. If this code were to be preempted between fetching rcu_ctrlblk.completed (line 14) and incrementing rcu_flipctr (line 16), it might well be migrated to some other CPU. This would result in it non-atomically incrementing the counter from that other CPU. If this CPU happened to be executing in rcu_read_lock() or rcu_read_unlock() just at that time, one of the increments or decrements might be lost, again disrupting grace-period detection. The same result could happen on RISC machines if the preemption occurred in the middle of the increment (after the fetch of the old counter but before the store of the newly incremented counter).

3. Permitting preemption in the midst of line 16, between selecting the current CPU's copy of the rcu_flipctr array and the increment of the element indicated by rcu_flipctr_idx, can result in a similar failure. Execution might well resume on some other CPU. If this resumption happened concurrently with an rcu_read_lock() or rcu_read_unlock() running on the original CPU, an increment or decrement might be lost, resulting in either premature termination of a grace period, indefinite extension of a grace period, or even both.

4. Failing to disable preemption can also defeat RCU priority boosting, which relies on rcu_read_lock_nesting to determine when a given task is in an RCU read-side critical section. So, for example, if a given task is indefinitely preempted just after incrementing rcu_flipctr, but before updating rcu_read_lock_nesting, then it will stall RCU grace periods for as long as it is preempted. However, because rcu_read_lock_nesting has not yet been incremented, the RCU priority booster has no way to tell that boosting is needed. Therefore, in the presence of CPU-bound realtime threads, the preempted task might stall grace periods indefinitely, eventually causing an OOM event.

The last three reasons could of course be addressed by disabling preemption rather than disabling of irqs, but given that the first reason requires disabling irqs in any case, there is little reason to separately disable preemption. It is entirely possible that the first reason might be tolerated by requiring an additional grace-period stage, however, it is not clear that disabling preemption is much faster than disabling interrupts on modern CPUs.

rcu_read_unlock()

The implementation of rcu_read_unlock() is as follows:

  1 void __rcu_read_unlock(void)
  2 {
  3   int idx;
  4   struct task_struct *me = current;
  5   int nesting;
  6 
  7   nesting = ACCESS_ONCE(me->rcu_read_lock_nesting);
  8   if (nesting > 1) {
  9     me->rcu_read_lock_nesting = nesting - 1;
 10   } else {
 11     unsigned long flags;
 12 
 13     local_irq_save(flags);
 14     idx = ACCESS_ONCE(me->rcu_flipctr_idx);
 15     smp_read_barrier_depends();  /* @@@ Needed??? */
 16     ACCESS_ONCE(me->rcu_read_lock_nesting) = nesting - 1;
 17     ACCESS_ONCE(__get_cpu_var(rcu_flipctr)[idx])--;
 18     rcu_read_unlock_unboost();
 19     local_irq_restore(flags);
 20   }
 21 }

(Again, please note that this code is under review and will likely change somewhat. This version matches that posted to LKML on September 10, 2007.)

Line 7 fetches the rcu_read_lock_nesting counter, which line 8 checks to see if we are under the protection of an enclosing rcu_read_lock() primitive. If so, line 9 simply decrements the counter.

However, as with rcu_read_lock(), we otherwise must do more work. Lines 13 and 19 disable and restore irqs in order to prevent the scheduling-clock interrupt from invoking the grace-period state machine while in the midst of rcu_read_unlock() processing. Line 14 picks up the rcu_flipctr_idx that was saved by the matching rcu_read_lock(), line 15 is likely to be unnecessary (but was intended to ensure that changes to the index and value remain ordered, and is a no-op on all CPUs other than Alpha), line 16 decrements rcu_read_lock_nesting so that irq and NMI/SMI handlers will henceforth update rcu_flipctr, line 17 decrements the counter (with the same index as, but possibly on a different CPU than, that incremented by the matching rcu_read_lock(). Finally, line 18 checks to see if this task has been subject to RCU priority boosting, deboosting it if so (see the LWN RCU priority-boosting article for more details).

The ACCESS_ONCE() macros and irq disabling are required for similar reasons that they are in rcu_read_lock().

Quick Quiz 4: What problems could arise if the lines containing ACCESS_ONCE() in rcu_read_unlock() were reordered by the compiler?

Quick Quiz 5: What problems could arise if the lines containing ACCESS_ONCE() in rcu_read_unlock() were reordered by the CPU?

Quick Quiz 6: What problems could arise in rcu_read_unlock() if irqs were not disabled?

Memory-Barrier Considerations

Note that these two primitives contains no memory barriers, so there is nothing to stop the CPU from executing the critical section before executing the rcu_read_lock() or after executing the rcu_read_unlock(). The purpose of the rcu_try_flip_waitmb_state is to account for this possible reordering, but only at the beginning or end of a grace period. To see why this approach is helpful, consider the following figure, which shows the conventional approach of placing a memory barrier at the beginning and end of each RCU read-side critical section (diagram taken from the 2006 OLS paper):

The "MB"s represent memory barriers, and only the emboldened barriers are needed, namely the first and last on a given CPU for each grace period. This preemptible RCU implementation therefore associates the memory barriers with the grace period, as shown below (diagram taken from the 2006 OLS paper):

Given that the Linux kernel can execute literally millions of RCU read-side critical sections per grace period, this latter approach can result in substantial read-side savings, due to the fact that it amortizes the cost of the memory barrier over all the read-side critical sections in a grace period.

Validation of Preemptible RCU

Testing

The preemptible RCU algorithm was tested with a two-stage grace period on weakly ordered POWER4 and POWER5 CPUs using rcutorture running for more than 24 hours on each machine, with 15M and 20M grace periods, respectively, and with no errors. Of course, this in no way proves that this algorithm is correct. At most, it shows either that these two machines were extremely lucky or that any bugs remaining in preemptible RCU have an extremely low probability of occurring. We therefore required additional assurance that this algorithm works, or, alternatively, identification of remaining bugs.

This task requires a conceptual approach, which is taken in the next section.

Conceptual Validation

Because neither rcu_read_lock() nor rcu_read_unlock() contain memory barriers, the RCU read-side critical section can bleed out on weakly ordered machines. In addition, the relatively loose coupling of this RCU implementation permits CPUs to disagree on when a given grace period starts and ends. This leads to the question as to how long a given RCU read-side critical section can possibly extend relative to the grace-period state machine.

The worst-case scenario is as follows:

Here, CPU 0 is executing the shortest possible removal and reclamation sequence, while CPU 1 executes the longest possible RCU read-side critical section. Because the callback queues are advanced just before acknowledging a counter flip, the latest that CPU 0 can execute its list_del_rcu() and call_rcu() is just before its scheduling-clock interrupt that acknowledges the counter flip. The call_rcu() invocation places the callback on CPU 0's next list, and the interrupt will move the callback from the next list to the wait[0] list. This callback will move again (from the wait[0] list to the wait[1] list) at CPU 0's first scheduling-clock interrupt following the next counter flip. Similarly, the callback will move from the wait[1] list to the done list at CPU 0's first scheduling-clock interrupt following the counter flip resulting in the value 3. The callback might be invoked immediately afterward.

Meanwhile, CPU 1 is executing an RCU read-side critical section. Let us assume that the rcu_read_lock() follows the first counter flip (the one resulting in the value 1), so that the rcu_read_lock() increments CPU 1's rcu_flipctr[1] counter. Note that because rcu_read_lock() does not contain any memory barriers, the contents of the critical section might be executed early by the CPU. However, this early execution cannot precede the last memory barrier executed by CPU 1, as shown on the diagram. This is nevertheless sufficiently early that an rcu_dereference() could fetch a pointer to the item being deleted by CPU 0's list_del_rcu().

Because the rcu_read_lock() incremented an index-1 counter, the corresponding rcu_read_unlock() must precede the "old counters zero" event for index 1. However, because rcu_read_unlock() contains no memory barriers, the contents of the corresponding RCU read-side critical section (possibly including a reference to the item deleted by CPU 0) can be executed late by CPU 1. However, it cannot be executed after CPU 1's next memory barrier, as shown on the diagram. Because the latest possible reference by CPU 1 precedes the earliest possible callback invocation by CPU 0, two passes through the grace-period state machine suffice to constitute a full grace period, and hence it is safe to do:

    #define GP_STAGES 2

Quick Quiz 7: Suppose that the irq disabling in rcu_read_lock() was replaced by preemption disabling. What effect would that have on GP_STAGES?

Quick Quiz 8: Why can't the rcu_dereference() precede the memory barrier?

Formal Validation

Formal validation of this algorithm is quite important, but remains as future work. One tool for doing this validation is described in an earlier LWN article.

Quick Quiz 9: What is a more precise way to say "CPU 0 might see CPU 1's increment as early as CPU 1's last previous memory barrier"?

Answers to Quick Quizzes

Quick Quiz 1: Why is it important that blocking primitives called from within a preemptible-RCU read-side critical section be subject to priority inheritance?

Answer: Because blocked readers stall RCU grace periods, which can result in OOM. For example, if a reader did a wait_event() within an RCU read-side critical section, and that event never occurred, then RCU grace periods would stall indefinitely, guaranteeing that the system would OOM sooner or later. There must therefore be some way to cause these readers to progress through their read-side critical sections in order to avoid such OOMs. Priority boosting is one way to force such progress, but only if readers are restricted to blocking such that they can be awakened via priority boosting.

Of course, there are other methods besides priority inheritance that handle the priority inversion problem, including priority ceiling, preemption disabling, and so on. However, there are good reasons why priority inheritance is the approach used in the Linux kernel, so this is what is used for RCU.

Back to Quick Quiz 1.

Quick Quiz 2: Could the prohibition against using primitives that would block in a non-CONFIG_PREEMPT kernel be lifted, and if so, under what conditions?

Answer: If testing and benchmarking demonstrated that the preemptible RCU worked well enough that classic RCU could be dispensed with entirely, and if priority inheritance was implemented for blocking synchronization primitives such as semaphores, then those primitives could be used in RCU read-side critical sections.

Back to Quick Quiz 2.

Quick Quiz 3: How is it possible for lines 38-43 of __rcu_advance_callbacks() to be executed when lines 7-37 have not? Won't they both be executed just after a counter flip, and never at any other time?

Answer: Consider the following sequence of events:

1. CPU 0 executes lines 5-12 of rcu_try_flip_idle().

2. CPU 1 executes __rcu_advance_callbacks(). Because rcu_ctrlblk.completed has been incremented, lines 7-37 execute. However, none of the rcu_flip_flag variables have been set, so lines 38-43 do not execute.

3. CPU 0 executes lines 13-15 of rcu_try_flip_idle().

4. Later, CPU 1 again executes __rcu_advance_callbacks(). The counter has not been incremented since the earlier execution, but the rcu_flip_flag variables have all been set, so only lines 38-43 are executed.

Back to Quick Quiz 3.

Quick Quiz 4: What problems could arise if the lines containing ACCESS_ONCE() in rcu_read_unlock() were reordered by the compiler?

Answer:

1. If the ACCESS_ONCE() were omitted from the fetch of rcu_flipctr_idx (line 14), then the compiler would be within its rights to eliminate idx. It would also be free to compile the rcu_flipctr decrement as a fetch-increment-store sequence, separately fetching rcu_flipctr_idx for both the fetch and the store. If an NMI were to occur between the fetch and the store, and if the NMI handler contained an rcu_read_lock(), then the value of rcu_flipctr_idx would change in the meantime, resulting in corruption of the rcu_flipctr values, destroying the ability to correctly identify grace periods.

2. Another failure that could result from omitting the ACCESS_ONCE() from line 14 is due to the compiler reordering this statement to follow the decrement of rcu_read_lock_nesting (line 16). In this case, if an NMI were to occur between these two statements, then any rcu_read_lock() in the NMI handler could corrupt rcu_flipctr_idx, causing the wrong rcu_flipctr to be decremented. As with the analogous situation in rcu_read_lock(), this could result in premature grace-period termination, an indefinite grace period, or even both.

3. If ACCESS_ONCE() macros were omitted such that the update of rcu_read_lock_nesting could be interchanged by the compiler with the decrement of rcu_flipctr, and if an NMI occurred in between, any rcu_read_lock() in the NMI handler would incorrectly conclude that it was protected by an enclosing rcu_read_lock(), and fail to increment the rcu_flipctr variables.

It is not clear that the ACCESS_ONCE() on the fetch of rcu_read_lock_nesting (line 7) is required.

Back to Quick Quiz 4.

Quick Quiz 5: What problems could arise if the lines containing ACCESS_ONCE() in rcu_read_unlock() were reordered by the CPU?

Answer: Absolutely none!!! The code in rcu_read_unlock() interacts with the scheduling-clock interrupt handler running on the same CPU, and is thus insensitive to reorderings because CPUs always see their own accesses as if they occurred in program order. Other CPUs do access the rcu_flipctr, but because these other CPUs don't access any of the other variables, ordering is irrelevant.

Back to Quick Quiz 5.

Quick Quiz 6: What problems could arise in rcu_read_unlock() if irqs were not disabled?

Answer:

1. Disabling irqs has the side effect of disabling preemption. Suppose that this code were to be preempted in the midst of line 17 between selecting the current CPU's copy of the rcu_flipctr array and the decrement of the element indicated by rcu_flipctr_idx. Execution might well resume on some other CPU. If this resumption happened concurrently with an rcu_read_lock() or rcu_read_unlock() running on the original CPU, an increment or decrement might be lost, resulting in either premature termination of a grace period, indefinite extension of a grace period, or even both.

2. Failing to disable preemption can also defeat RCU priority boosting, which relies on rcu_read_lock_nesting to determine which tasks to boost. If preemption occurred between the update of rcu_read_lock_nesting (line 16) and of rcu_flipctr (line 17), then a grace period might be stalled until this task resumed. But because the RCU priority booster has no way of knowing that this particular task is stalling grace periods, needed boosting will never occur. Therefore, if there are CPU-bound realtime tasks running, the preempted task might never resume, stalling grace periods indefinitely, and eventually resulting in OOM.

Of course, both of these situations could be handled by disabling preemption rather than disabling irqs. (The CPUs I have access to do not show much difference between these two alternatives, but others might.)

Back to Quick Quiz 6.

Quick Quiz 7: Suppose that the irq disabling in rcu_read_lock() was replaced by preemption disabling. What effect would that have on GP_STAGES?

Answer: No finite value of GP_STAGES suffices. The following scenario, courtesy of Oleg Nesterov, demonstrates this:

Suppose that low-priority Task A has executed rcu_read_lock() on CPU 0, and thus has incremented per_cpu(rcu_flipctr, 0)[0], which thus has a value of one. Suppose further that Task A is now preempted indefinitely.

Given this situation, consider the following sequence of events:

1. Task B starts executing rcu_read_lock(), also on CPU 0, picking up the low-order bit of rcu_ctrlblk.completed, which is still equal to zero.

2. Task B is interrupted by a sufficient number of scheduling-clock interrupts to allow the current grace-period stage to complete, and also be sufficient long-running interrupts to allow the RCU grace-period state machine to advance the rcu_ctrlblk.complete counter so that its bottom bit is now equal to one and all CPUs have acknowledged this increment operation.

3. CPU 1 starts summing the index==0 counters, starting with per_cpu(rcu_flipctr, 0)[0], which is equal to one due to Task A's increment. CPU 1's local variable sum is therefore equal to one.

4. Task B returns from interrupt, resuming its execution of rcu_read_lock(), incrementing per_cpu(rcu_flipctr, 0)[0], which now has a value of two.

5. Task B is migrated to CPU 2.

6. Task B completes its RCU read-side critical section, and executes rcu_read_unlock(), which decrements per_cpu(rcu_flipctr, 2)[0], which is now -1.

7. CPU 1 now adds per_cpu(rcu_flipctr, 1)[0] and per_cpu(rcu_flipctr, 2)[0] to its local variable sum, obtaining the value zero.

8. CPU 1 then incorrectly concludes that all prior RCU read-side critical sections have completed, and advances to the next RCU grace-period stage. This means that some other task might well free up data structures that Task A is still using!

This sequence of events could repeat indefinitely, so that no finite value of GP_STAGES could prevent disrupting Task A. This sequence of events demonstrates the importance of the promise made by CPUs that acknowledge an increment of rcu_ctrlblk.completed, as the problem illustrated by the above sequence of events is caused by Task B's repeated failure to honor this promise.

Therefore, more-pervasive changes to the grace-period state will be required in order for rcu_read_lock() to be able to safely dispense with irq disabling.

Back to Quick Quiz 7.

Quick Quiz 8: Why can't the rcu_dereference() precede the memory barrier?

Answer: Because the memory barrier is being executed in an interrupt handler, and interrupts are exact in the sense that a single value of the PC is saved upon interrupt, so that the interrupt occurs at a definite place in the code. Therefore, if the rcu_dereference() were to precede the memory barrier, the interrupt would have had to have occurred after the rcu_dereference(), and therefore the interrupt would also have had to have occurred after the rcu_read_lock() that begins the RCU read-side critical section. This would have forced the rcu_read_lock() to use the earlier value of the grace-period counter, which would in turn have meant that the corresponding rcu_read_unlock() would have had to precede the first "Old counters zero [0]" rather than the second one. This in turn would have meant that the read-side critical section would have been much shorter -- which would have been counter-productive, given that the point of this exercise was to identify the longest possible RCU read-side critical section.

Back to Quick Quiz 8.

Quick Quiz 9: What is a more precise way to say "CPU 0 might see CPU 1's increment as early as CPU 1's last previous memory barrier"?

Answer: First, it is important to note that the problem with the less-precise statement is that it gives the impression that there might be a single global timeline, which there is not, at least not for popular microprocessors. Second, it is important to note that memory barriers are all about perceived ordering, not about time. Finally, a more precise way of stating above statement would be as follows: "If CPU 0 loads the value resulting from CPU 1's increment, then any subsequent load by CPU 0 will see the values from any relevant stores by CPU 1 if these stores preceded CPU 1's last prior memory barrier."

Even this more-precise version leaves some wiggle room. The word "subsequent" must be understood to mean "ordered after", either by an explicit memory barrier or by the CPU's underlying memory ordering. In addition, the memory barriers must be strong enough to order the relevant operations. For example, CPU 1's last prior memory barrier must order stores (for example, smp_wmb() or smp_mb()). Similarly, if CPU 0 needs an explicit memory barrier to ensure that its later load follows the one that saw the increment, then this memory barrier needs to be an smp_rmb() or smp_mb().

In general, much care is required when proving parallel algorithms.

Back to Quick Quiz 9.

Acknowledgments

I owe thanks to Steve Rostedt, Oleg Nesterov, Andy Whitcroft, Nivedita Singhvi, Robert Bauer, and Josh Triplett for their help in getting this document into a human-readable state.

Comments (2 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.23. (October 10, 2007)

• Greg Kroah-Hartman: Linux 2.6.22.10. (October 10, 2007)

• Adrian Bunk: Linux 2.6.16.55-rc1. (October 8, 2007)

• Adrian Bunk: Linux 2.6.16.54. (October 8, 2007)

Build system

• Sam Ravnborg: kbuild updates. (October 10, 2007)

Core kernel code

• Vegard Nossum: New message-logging API (kprint). (October 5, 2007)

• Vegard Nossum: [RFC][PATCH] Escaping the arguments of kernel messages for sane user-space localisation. (October 9, 2007)

Device drivers

• Mark Langsdorf: architectural pstate driver for powernow-k8. (October 10, 2007)

• Len Brown: ACPI paches for 2.6.24-rc0. (October 10, 2007)

• Pierre Ossman: MMC updates. (October 10, 2007)

Documentation

• Alan Stern: Documentation for USB power management. (October 8, 2007)

• Michael Kerrisk: man-pages-2.66 is released. (October 8, 2007)

• Darrick J. Wong: [PATCH v3] hwmon: Add power meter spec to Documentation/hwmon/sysfs-interface. (October 10, 2007)

Filesystems and block I/O

• Theodore Ts'o: 2.6.23-rc8-ext4-1 patchset released. (October 4, 2007)

• Jan Engelhardt: Unlimited partitions, a try. (October 5, 2007)

• David Howells: Remove iget() and read_inode() [try #2]. (October 8, 2007)

• Aneesh Kumar K.V: ext4: Introduce ext4_inoblk_t. (October 9, 2007)

• Trond Myklebust: NFS client updates for Linux 2.6.24.... (October 10, 2007)

Memory management

• Christoph Lameter: Virtual Compound Page Support V2. (October 8, 2007)

Networking

• Urs Thuermann: CAN: Add new PF_CAN protocol family, try #10. (October 5, 2007)

• Satoshi OSHIMA: UDP memory accounting (take 4). (October 5, 2007)

• Stephen Hemminger: skbuff: change skb_frag_struct to scatterlist. (October 8, 2007)

Security-related

• Casey Schaufler: [PATCH 2/2] Version 5 (2.6.23-rc8-mm2) Smack: Simplified Mandatory Access Control Kernel. (October 4, 2007)

• Herbert Xu: Crypto Update for 2.6.24. (October 10, 2007)

Miscellaneous

• Jan Engelhardt: Cute feature: colored printk output. (October 5, 2007)

• Douglas Gilbert: sdparm 1.02. (October 10, 2007)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Who made Gentoo Linux, and when? A commit analysis

Since LWN has published statistics on who wrote the Linux kernel, I thought readers might also be interested in who's writing other major open-source projects. I recently obtained the entire CVS repository history for Gentoo Linux, courtesy of Robin Johnson <robbat2 -AT- gentoo -dot- org>. Although some of the code has moved to Subversion or Git recently so these numbers may not be 100% accurate, the techniques used to analyze commits should be generally useful in understanding the progress and contributors to any project.

First, I wanted to understand the developer community. How much experience do our developers have with Gentoo, and how has that changed over time? To do this, I created a number called "lifetime" that's the length of time between the developer's first and last commits. Then I scanned across each month, checking the average developer lifetime. I used the scanning month for the last commit of active developers to get the developer's experience at that time, not the developer's experience today.

What you can see is that the lifetimes go up roughly as a function of time since CVS history begins. This shows that the "average Gentoo developer" joins and stays involved for more than a year. Over a span of 3 years, the average lifetime increases from 1 year to 2 years.

Another way to look at this is to ask how many active and retired developers there are today as a function of when they gained commit access. The majority of active developers joined in 2005 and 2006, while the most retired developers joined in 2003 and 2004. This again shows that the average lifetime is around 2 years.

Developer counts at any given time is also of interest. I found this by scanning across months again, checking for how many developers the month is during their commit lifetimes.

The most interesting part is a sharp decline starting in early 2006. I wanted to attribute this in part to the addition of Subversion, which was right around that time, but that would only account for it if the developers commiting to Subversion no longer commited to CVS. That certainly isn't the case for more than 100 people, since the main package tree remains in CVS.

Instead, I now attribute this drop to Gentoo's developer population returning toward an equilibrium after an explosive, uncontrolled growth. The Gentoo structure and governance could not scale quickly enough to deal with all the new developers, but it took some time to normalize and continues to do so.

Now that we've learned something about our developers, how about our code? The next three graphs show commits per month to each CVS module. The "gentoo-x86" module contains all of the ebuilds (the packages). There's nothing particularly unusual about this, except for a huge peak in early 2006, I suspect when someone accidentally branched the entire repository. Interestingly, there isn't as much of a decline in commits as you might expect, given the drop in developers by more than a third. Apparently, the actively commiting developers weren't the ones who quit. The "gentoo" module contains the website files as well as some projects such as the installer and the Catalyst LiveCD creator as well as patchsets for more complex packages. The website is fairly stable at this point, and many of the projects in this repository have reached maturity, so development has slowed down. The "gentoo-src" module contains a number of projects as well, but the huge drop near the beginning of 2006 indicates a move of active development to Subversion.

And finally, let's tie the developers and the code together with a histogram. This shows the number of commits each developer's made, with a bin size of 100. You can see the incredibly long tail of the most active commiters, with most developers under 20,000 (note the scale) but the top developer at 120,000 commits.

Now let's take a closer look at the long tail of the developers with the largest commit counts. The tables show any developer with at least 1% of the total commits.

All-time commits
Developer	Percentage
Mike Frysinger	6.08
Chris White	4.72
Aron Griffis	4.34
Diego Pettenò	3.08
Robin H. Johnson	1.98
Michael Cummings	1.95
Michael Sterrett	1.80
Gustavo Zacarias	1.71
Jeremy Huddleston	1.64
Dan Armak	1.63
Seemant Kulleen	1.58
Markus Rothe	1.58
Daniel Robbins	1.54
Bryan Østergaard	1.47
Chris Gianelloni	1.28
Donnie Berkholz	1.15
Martin Holzer	1.03
Mamoru Komachi	1.01
Total	39.57

About 40% of the all-time commits to Gentoo come from just 18 developers. Unfortunately, I didn't have access to the size of the commits, just the number of them, so I couldn't try to rank them by changes in lines of code. One thing to be wary of is the very small commits, such as those indicating that a package works on a given architecture. But this list is not dominated by architecture developers.

2007 commits
Developer	Percentage
Raúl Porcel	6.60
Diego Pettenò	4.50
Mike Frysinger	3.91
Michael Sterrett	3.57
Piotr Jaroszynski	3.04
Christian Faulhammer	3.04
Gustavo Zacarias	2.97
Michael Cummings	2.62
Markus Rothe	2.52
Jeroen Roovers	2.25
Samuli Suominen	2.18
Markus Ullmann	1.98
Tobias Scherbaum	1.75
Petteri Räty	1.66
Chris Gianelloni	1.62
Steve Dibb	1.48
Andrej Kacian	1.45
Christian Heim	1.40
Marius Mauch	1.36
Christoph Mende	1.33
Bryan Østergaard	1.21
Donnie Berkholz	1.10
Gysbert Wassenaar	1.06
Roy Marples	1.03
Stefan Schweizer	1.03
Joseph Jezak	1.02
Total	57.68

In 2007 so far, 26 developers accounted for nearly 60% of commits. Unlike the all-time list, a significant fraction of these developers are architecture developers, including the top commiter.

This analysis was mostly automated, using a combination of awk, bash shell, Python and gnuplot. The scripts are available upon request to the author <dberkholz -AT- gentoo -dot- org>.

Comments (7 posted)

New Releases

openSUSE 10.3 is now available

Novell, Inc. has announced the release of openSUSE version 10.3. "Enhancements to openSUSE 10.3 include the newest versions of the GNOME* and KDE desktop environments, including a KDE 4 preview. OpenOffice.org 2.3 makes sharing files with Microsoft Office users easy, and the newest version of AppArmor(TM) protects the Linux operating system and applications from attacks, viruses and malicious applications. OpenSUSE 10.3 also now includes MP3 support out of the box for Banshee(TM) and Amarok, which are the default media players in openSUSE. In addition, openSUSE 10.3 offers the latest open source applications for developing applications, setting up a home network and running a Web server, as well as the latest virtualization software such as Xen* 3.1 and VirtualBox 1.5." There are more links in this announcement from the openSUSE team.

Comments (6 posted)

Mandriva Linux 2008 released

Mandriva Linux 2008 has been released with Compiz Fusion 0.5.2 and drak 3D, 2.6.22.9 Kernel, KDE 3.5.7 and KDE 4 preview, GNOME 2.20, X.org 7.3, RandR1.2, OpenOffice.org 2.2.1, and Mozilla Firefox 2.0.0.6. Click below for the official announcement or check out the the release tour page for more information.

Full Story (comments: 1)

Linspire 6.0 Desktop Linux Operating System Released

Linspire has announced the immediate availability of Linspire 6.0, the latest commercial release of the desktop Linux operating system. "Building on the best of open source software using Ubuntu as its base line, Linspire 6.0 adds licensed proprietary drivers, codecs, and software in its core distribution to provide a better user experience."

Comments (none posted)

Fedora 8 Test 3 released

The third (and final) Fedora 8 test release is available. Changes since test 2 include an Online Desktop preview, the "Iced Tea" Java environment, CodecBuddy, improved power management, and more.

Full Story (comments: 3)

Fedora Electronic Lab - Livecd F8Test3

The Fedora Electronic Lab live CD has been updated to the latest Fedora test release. "The idea of Fedora Electronic Lab is not to include as many as packages for electronic simulations, but mainly to ensure that design flows can be achieved. Because it's useless for the user to have those packages if his/her data can't be process with other applications thus implying the user will waste his/her time."

Full Story (comments: none)

EnGarde Secure Linux releases v3.0.17

Guardian Digital has announced the newest release of EnGarde Secure Linux: Community 3.0.17 (Version 3.0, Release 17). "In distribution since 2001, Guardian Digital's EnGarde has been a staple for security enthusiasts, administrators and organizations looking to run servers easily and securely. Solely designed as an integrated server platform, EnGarde Secure Linux provides web, DNS and email functions simply and securely, while delivering on integrated intrusion detection, advanced kernel and network security features, manageable SELinux policies, robust engineering and graphical auditing and reporting."

Full Story (comments: none)

Distribution News

Debian GNU/Linux

Google Summer of Code 2007 wrap-up

Debian's Steve McIntyre has posted a wrap-up report on the Debian distribution's Google Summer of Code 2007 projects. "The summer has finished, and it's about time I summarised how we got on. We had 9 Summer of Code students working for us, and we had a 100% success rate this year. Woo! Last year we only managed 6 successful projects out of 10, so that's a major improvement. A couple of things helped a great deal this time: several of our students were already contributors to the Debian community at various levels, and for the first time this year the SoC programme also included an extra chunk of time to allow the students to get involved ("bonding time") before they had to start coding work. These meant that our students were much more involved in Debian than last year, and that was a very good outcome."

Full Story (comments: none)

Bits from the Alioth team

Stephen Gran reports on Debian's Alioth team. "[T]he Alioth team is proud to announce YARCS (Yet Another Revision Control System). Alioth can now host your Darcs repositories in pretty much the same way as it can host your CVS, Subversion, Arch/Bazaar, Bzr, Hg and Git repositories. Please refer to http://wiki.debian.org/Alioth/darcs for details."

Full Story (comments: 1)

Bits from the listmasters

Martin Zobel-Helas reports on some changes to the Debian mailing lists, including a new spam filter setup, a new greylisting daemon, and several other topics.

Full Story (comments: none)

Debian's Constitutional amendment vote on DPL elections

Debian developers have voted for an amendment to reduce the length of Debian Project Leader election process.

Full Story (comments: none)

Mandriva Linux

Mandriva makes a complete Linux System accessible to all

Mandriva has issued a press release on the Powerpack edition of Mandriva Linux 2008. "A new subscription mode in the commercial Powerpack product will provide users to install or upgrade their system and take advantage of all the new technologies integrated in the Powerpack product. Regarding this new pricing policy, the new subscription mode in the Powerpack is the replacement of the former downloading services of the Club. The 'community services' of Club platform will be now available to all. This new plan is designed for users who want to stay tuned with the latest Linux technologies. With the 2008 release, customers can subscribe to this plan to download 2 Powerpack releases. This plan is offered for only 59 euro per year ($69 USD)."

Full Story (comments: none)

Other distributions

Arch Leadership

Arch Linux is getting a change in leadership. Project founder Judd Vinet is stepping down and passing on the leadership role to Aaron Griffin. "Though I will still be around for discussions and anything else I can do for Arch (within my feeble time constraints), I feel this is the time to say Goodbye, at least as leader. I will still be around as Arch's Number One Cheerleader, but not as its visionary." Judd's blog has a bit more about what he's up to, besides Arch.

Comments (none posted)

New Distributions

Linux Apes Vista With New Distro Called Vixta (Information Week)

Information Week reports on a new distribution called Vixta. "Vixta's home page touts the imminent availability of version 095, and enumerates the goals of the project as follows: 1. Absolutely free, in every sense; 2. Spread Linux to the "masses"; 3. ABN -- Absolutely No Config.; 4. User-Friendly; 5. Eye-catching. Familiar look and feel."

Comments (1 posted)

Distribution Newsletters

Fedora Weekly News Issue 104

The Fedora Weekly News for October 1, 2007 looks at F8t3, joining Fedora, release notes freeze, summit happenings, and much more.

Full Story (comments: none)

Ubuntu Weekly Newsletter #60

The Ubuntu Weekly Newsletter for October 6, 2007 covers the freeze of the Gutsy archive, a Gutsy countdown script for websites, Philipp Kern joining the MOTU Team, the release of UbuntuBolivia by the Bolivian LoCo Team, Ubuntu Forums interviews, and much more.

Full Story (comments: none)

DistroWatch Weekly, Issue 223

The DistroWatch Weekly for October 8, 2007 is out. "The big openSUSE 10.3 release week is now behind us. All went without a hitch and many users are enjoying the newest software, improved package management, and extended support for the latest hardware in this new version. No major bugs have been reported so far, but let's wait for the first reviews before concluding that this is indeed openSUSE's best release ever. In other news, Mandriva Linux 2008 has been released to "early seeders", Ubuntu has begun accepting pre-orders for "Gutsy Gibbon", and Judd Vinet has resigned as the lead developer of Arch Linux. Finally, don't miss the featured story of this week - a Susan Linton's report on the major new release from Puppy Linux, version 3.00."

Comments (none posted)

Newsletters and articles of interest

Interview with Mairin Duffy on Fedora 8 Artwork

The Fedora wiki has an interview with Máirín Duffy, lead of the Fedora art team, on the process of creating the artwork for Fedora 8. "We don't have any hard restriction saying that you can only produce software using the free and open source tools available in Fedora, but all of the artwork as far as I know was produced exclusively in tools available in Fedora, including Inkscape and the GIMP. So Fedora 8's artwork serves as a pretty good example of what you can do with the tools readily available in Fedora itself."

Comments (8 posted)

The Perfect Desktop - OpenSUSE 10.3 (HowtoForge)

HowtoForge sets up a GNOME desktop on openSUSE 10.3. "This tutorial shows how you can set up an OpenSUSE 10.3 desktop that is a full-fledged replacement for a Windows desktop, i.e. that has all the software that people need to do the things they do on their Windows desktops. The advantages are clear: you get a secure system without DRM restrictions that works even on old hardware, and the best thing is: all software comes free of charge."

Comments (none posted)

Ubuntu - a Speedup guide

My10sen has some tips for speeding up Ubuntu, including filesystem, swapping, and other tweaks. "On default installation Ubuntu chooses 'journal data ordered' and In data=ordered mode, ext3 only officially journals metadata it logically groups metadata and data blocks into a single unit called a transaction. When it want to write the new metadata out to disk, the associated data blocks are written first. data=ordered mode effectively solves the corruption problem found in data=writeback mode and most other journaled filesystems, and it is done without requiring full data journaling. In general, data=ordered ext3 filesystems perform slightly slower than data=writeback filesystems, but slightly faster than the full data journaling counterparts. To speed it up we're going to change it to data=writeback system."

Comments (24 posted)

Distribution reviews

An in-depth look at Puppy Linux (DesktopLinux)

DesktopLinux takes a look at the latest version of Puppy Linux. "Puppy breathes new life into old hardware and runs well on diskless PCs and thin workstations. Needless to say, it's a total speed demon on state-of-the-art hardware. While I've emphasized Puppy's special role on constrained hardware, the product is fully competitive on current systems. My friends and I run it on our newest computers, too."

Comments (none posted)

The best Linux system repair distribution gets better (DesktopLinux.com)

DesktopLinux.com reviews the 0.4 version of SystemRescueCD, a Gentoo-based distribution for repairing broken systems. "Another major improvement is that you can now use PXE network booting. With PXE, you can boot a troubled PC remote over your LAN into SystemRescueCD. This is great, for example, for a help desk repairing systems scattered over an office or campus. To get this to work, the PCs will need to be set to use wake-on-LAN and network boot. That's been a standard PC feature since 2001, but it usually must be made active in the BIOS before you can use it."

Comments (8 posted)

The 7 Most Influential GNU/Linux Distributions (Datamation)

Datamation looks at the seven top Linux distributions. "GNU/Linux offers a bewildering variety of flavors -- or distributions, as they're called. To a newcomer's eye, many of these seem virtually identical to each other. Yet, the more you learn about a distribution and the community that surrounds it, the more different they become. Here, in alphabetical order, is a list of the seven distributions that have most affected GNU/Linux as a whole."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Recovering data from a laptop drive using Linux

A friend recently came to me with a data recovery problem. He had a ten year old Compaq Presario 1090ES laptop with numerous hardware problems. The laptop's hard drive contained some non-backed up text documents as well as a number of home-made audio recordings. The laptop's operating system was Windows 95. After a number of attempts to get the laptop to boot, I decided that a better approach to recovering the data would be to remove the hard drive and connect it to a Linux box. Even if the system could be revived, transferring the data to another machine would be difficult since the machine had no Ethernet connection.

The first problem involved connecting the laptop drive to a regular desktop system's IDE bus. The drive, an IBM DMCA-21440 with a capacity of 1.4GB, had a miniature 44 pin IDE/power connector and the desktop system had a regular 40 pin IDE (PATA) connector. The appropriate adapter was found on eBay for a mere $5 plus $5 more for shipping/handling (from Hong Kong). The adapter was purchased and it arrived in the mail a week later. Problem number one solved.

The laptop drive was connected to several machines before it was recognized by a system BIOS. Despite selecting the device as an IDE slave, it would only operate when there were no other devices on the bus. The secondary IDE bus (IDE1) was used and the machine's CDROM was removed for the duration of the data recovery session. From the root account, the command: fdisk /dev/hdc was used (carefully) to verify that the drive was visible to the system. The fdisk print command showed the drive's partition information, the main partition was /dev/hdc1.

The drive was initially mounted on the temporary mount point /mnt using the command: mount -t vfat /dev/hdc1 /mnt. This resulted in a filesystem with a lot of unreadable filenames. A little digging on the net revealed the sys_immutable argument to mount. The mount man page was somewhat discouraging: "sys_immutable, showexec, dots, nodots, dotsOK=[yes|no] Various misguided attempts to force Unix or DOS conventions onto a FAT file system." Misguided or not, the drive was mounted with the command: mount -t vfat -O sys_immutable /dev/hdc1 /mnt. The sys_immutable option seemed to work and the drive's contents became viewable with the standard Unix commands.

A number of Microsoft Word (.doc) files were copied over to the host system, these were for the most part readable by OpenOffice.org 2.2 with the exception that a small percentage of words showed up with misspelled characters. Fortunately, for the small number of documents, a bit of manual editing fixed the problem. The wav files were also copied over to the host system with no problems. Once on the Linux system, it became easy to improve the wav file recordings. Audacity is useful for chopping off noisy sections at the beginning and endings of the recordings and sox can be used for resampling the 22050 hz files into standard 44100 hz files. With a bit of effort, it will be possible to turn the collection of wav files into a reasonably professional sounding audio CD.

The operation was completely successful, all of the desired data was recovered from the damaged laptop and my friend's work has been saved.

Comments (10 posted)

System Applications

Database Software

PostgreSQL 8.3 beta 1 released

The first PostgreSQL 8.3 beta release is out. 8.3 looks like it will be one of the most interesting PostgreSQL releases in some time; it includes a full text search mechanism, a number of performance improvements, SQL:XML support, and much more. "How soon this beta turns into a release depends on testing by our community of users. As soon as possible, please help us with community testing."

Full Story (comments: 21)

Postgres Weekly News

The October 7, 2007 edition of the Postgres Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

SQLite 3.5.1 released

Version 3.5.1 of SQLite, a light weight DBMS, has been announced, it features the following changes: "Fix a long-standing bug that might cause database corruption if a disk-full error occurs in the middle of a transaction and that transaction is not rolled back. The new VFS layer is stable. However, we still reserve the right to make tweaks to the interface definition of the VFS if necessary."

Comments (none posted)

Networking Tools

SDTConnector 1.4.2 released (SourceForge)

Version 1.4.2 of SDTConnector has been announced. "SDTConnector provides a simplified way to tunnel various TCP and UDP based network services (such as RDP, VNC, HTTP and Telnet) through SSH. SDTConnector is a graphical tool to simplify the task of providing the privacy and security of SSH for common 'insecure' services, such as VNC, RDP (Windows Terminal Services), HTTP, Telnet and others. Uniquely, SDTConnector has the ability to SSH tunnel UDP based services (such as DNS or Serial over LAN), and facilitate out-of-band access to remote hosts when they can't be reached via the primary link. This release fixes several bugs, please see the change log for details."

Comments (none posted)

Web Site Development

Django Roundup

The October 7, 2007 edition of the Django Roundup is out with the latest news from the Django web development platform project. "We're getting the roundups going again: news about last month's sprint, a new screencast, Django Gigs launches, Django on Jython work continues to proceed, a Django-powered BitTorrent tracker, and more inside."

Comments (none posted)

Desktop Applications

Animation Software

synfig 0.61.07 released

Version 0.61.07 of synfig has been announced, it adds some new functionality and bug fixes. "Synfig is a powerful, industrial-strength vector-based 2D animation software package, designed from the ground-up for producing feature-film quality animation. It was initially a proprietary application produced by Voria Studios for internal use and when the company closed down, Synfig was released to the free software community for development under the GNU General Public Licence."

Full Story (comments: none)

Business Applications

JasperReports 2.0.2 released (SourceForge)

Version 2.0.2 of JasperReports, a business intelligence and reporting engine, has been announced. Changes include: "support for element origin information in generated documents; support for exporter element filtering based on element origin; minor bug fixes and improvements".

Comments (none posted)

Calendar Software

Lcal 2.1.0 released

Version 2.1.0 of Lcal, a lunar calendar application that generates PostScript is out. "Changes include enhanced colorization control options, which allow for some stunning color lunar calendars, both for previewing and for printing." (Thanks to Bill Marr).

Comments (none posted)

Data Visualization

PyX 0.10 released

Version 0.10 of PyX, a Python package for the creation of PostScript and PDF files, has been announced. "This release adds 3d plotting facilities to PyX using parallel or central projection. Two new graph styles grids and surfaces can be used in 3d graphs as well as some existing generic graph styles (symbols, lines, errorbars etc.). Several new examples, various other improvements requested by PyX users and some bugfixes complete this release."

Comments (none posted)

Desktop Environments

Fluxbox 1.0.0 released (SourceForge)

Version 1.0.0 of Fluxbox has been announced. "Fluxbox is a X11 windowmanager build for speed and flexibility. Finally a new stable release! After almost four and a half years with 0.9.x releases we finally got to 1.0.0! This release includes a lot of bugfixes, new styles, updated language support, better shaped corners and much more."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced this week:

• Camorama 0.19 (code cleanup and translation work)
• Devhelp 0.16.1 (translation work)
• gcalctool 5.21.0 (bug fixes)
• GENIUS 1.0.0 (new features, bug fixes documentation and translation work)
• Orca 2.20.0.1 (bug fixes and translation work)

You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

KDE Commit-Digest (KDE.News)

The October 7, 2007 edition of the KDE Commit-Digest has been announced. The content summary says: "Image support in Parley, and support for formulas in the note feature of the Step physics simulation package. blinKen changes capitalisation to Blinken for the KDE 4.0 release. Theme work across kdegames, with better collision detection in Kolf. More XMP integration work in Digikam. Work on KConfig merged back into trunk/. Colour conversion system becomes fully operational in Krita..."

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week:

• amaroK Web Collection 1.0.0 (unspecified)
• Data Klony 0.1-Alpha (unspecified)
• digiKam 0.9.3 (new features and bug fixes)
• gambas 2 1.9.90 (development version)
• KDE Priority handler 1.0 RC1 (bug fixes)
• Kirocker Music Display 3.4.1 (new features)
• KMediaPlayer 0.1 (unspecified)
• KSquirrel 0.7.2 (new features)
• ljKlient 0.2.0-pre1 (unspecified)
• nmapsi4 0.1beta1 (unspecified)
• PeaZip 1.9.2 (new features and documentation work)
• 'Q' DVD-Author RC 2 (new features and bug fixes)
• Qosmic 1.0 (unspecified)
• Qtractor 0.0.6.728 (new features and performance improvements)
• ReMoot 0.9 (new features)
• rkward 0.4.8 (new features and bug fixes)
• Transforme-me 0.4 (new feature and bug fixes)
• WineRar 0.5a (unspecified)
• Zhu3D 3.0.6 (new feature and bug fixes)

You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

Desktop Publishing

LyX 1.5.2 is released

Version 1.5.2 of LyX, a GUI interface to the TeX typesetter, is out. "This is a maintenance release that focuses on improving the stability. We have fixed numerous crashes, performance problems, and other bugs. Furthermore, the documentation has been revised. It covers all new features of the 1.5.x series now."

Full Story (comments: none)

Electronics

Initial release of gsch2pcb

The initial release of gsch2pcb has been announced. "When designing a printed circuit board (PCB) it's often desirable to create a 'schematic' which shows the components to be used and their connectivity in an abstract fashion. The connectivity information is then used to help when designing the actual circuit board. ``gsch2pcb`` is a command-line tool, part of the gEDA suite, which is used to generate and update a PCB layout. It works with schematics created by ``gschem``, part of the gEDA suite, and layouts created by ``pcb``, a PCB layout system commonly used with gEDA. ``xgsch2pcb`` provides an intuitive, user-friendly graphical interface to ``gsch2pcb``."

Comments (none posted)

Financial Applications

Security issues with SQL-Ledger

SQL-Ledger, a web-based financial accounting system, has some unresolved SQL injection security issues. "Unfortunately the maintainer of SQL-Ledger has declined to fix any of the SQL injection issues we have sent his way. Even correcting these, there are many SQL injection issues in that application. Our official recommendation for SQL-Ledger users is to restrict access to database relations to the least privelege necessary. While this does not entirely solve the issues, it does limit the damage considerably."

Full Story (comments: none)

Graphics

OpenSceneGraph 2.2 released

Version 2.2 of OpenSceneGraph has been announced. "OpenSceneGraph Professional Services announces the release of OpenSceneGraph 2.2, the industry's leading open-source scene graph technology, designed to accelerate application development and improve 3D graphics performance. OpenSceneGraph 2.2 written entirely in Standard C++ and built upon OpenGL, offers developers working in the visual simulation, game development, virtual reality, scientific visualization and modeling markets - a real-time visualization tool which eclipses commercial scene graph toolkits in functionality, stability and performance. OpenSceneGraph 2.2 runs on all Microsoft Windows platforms, Apple OS/X, GNU/Linux, IRIX, Solaris, HP-UX, AIX and !FreeBSD operating systems."

Full Story (comments: none)

Medical Applications

PatientOS v0.14 HL7 Interfaces released (LinuxMedNews)

LinuxMedNews covers the newest capabilities included with version 0.14 of PatientOS, the 1.0 release is scheduled for the end of October. "PatientOS is an open source healthcare information system for physicians, nursing, pharmacy, laboratory and ultimately all departments in a hospital, physician or practice, or any other healthcare facility. Version 0.14 of PatientOS integrates the Open Source Mirth HL7 Engine with PatientOS. Registering or updating patient information in the demo demonstrates the creation of an outbound HL7 ADT message."

Comments (none posted)

Web Browsers

Mozilla Links Newsletter

The October 4, 2007 edition of the Mozilla Links Newsletter is online, take a look for the latest news about the Mozilla browser and related projects.

Full Story (comments: none)

Miscellaneous

Task Coach 0.65.2 available (SourceForge)

Version 0.65.2 of Task Coach has been announced. "Task Coach is a simple open source todo manager to manage personal tasks and todo lists. Often, tasks and other things todo consist of several activities. Task Coach is designed to deal with composite tasks. This release is aimed at better performance."

Comments (none posted)

Languages and Tools

C

GCC 4.2.2 released

Version 4.2.2 of GCC, the Gnu Compiler Collection, has been announced. See the change notes for more information.

Comments (2 posted)

Caml

Caml Weekly News

The October 9, 2007 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

PHP

New PHP documentation build system is ready for testing

A new documentation build system for PHP has been announced. "The PHP documentation team is pleased to announce the initial release of the new build system that generates the PHP Manual. Written in PHP, PhD ([PH]P based [D]ocBook renderer) builds are now available for viewing at docs.php.net. Everyone is encouraged to test and use this system so that bugs will be found and squashed. Once the new build system is stable, expect additional changes to the PHP manual that will include an improved navigation system and styling for OOP documentation."

Comments (none posted)

Tcl/Tk

Tcl-URL! - weekly Tcl news and links

The October 4, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

Tcl-URL! - weekly Tcl news and links

The October 10, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

Version Control

GIT 1.5.3.4 announced

Version 1.5.3.4 of GIT, a distributed version control system, has been announced, it features bug fixes, performance improvements and documentation work.

Full Story (comments: none)

Miscellaneous

An overview of linking

Ian Lance Taylor has a series of 20 articles on linkers, providing a technical introduction and lots of details on ELF. Due to the weblog format, it is a bit hard to follow, read from the bottom and use the 'Next Entries' link to get to more. Here is a permalink to the first article in case things move around in his archives. "In the old days, when dinosaurs roamed the data centers, many programs were complete in themselves. In those days there was generally no compiler – people wrote directly in assembly code – and the assembler actually generated an executable file which the machine could execute directly. As languages liked Fortran and Cobol started to appear, people began to think in terms of libraries of subroutines, which meant that there had to be some way to run the assembler at two different times, and combine the output into a single executable file. This required the assembler to generate a different type of output, which became known as an object file (I have no idea where this name came from). And a new program was required to combine different object files together into a single executable. This new program became known as the linker (the source of this name should be obvious)." (Thanks to Daniel Qarras)

Comments (4 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Retailer PCI Rebellion: 'No More Storing Credit Card Numbers' (Dark Reading)

Dark Reading has a a report on storing credit card numbers, with the National Retail Foundation advocating that retailers not be forced to store them. "'Data breaches have continued to occur at an unacceptable rate. There have been numerous instances of hackers targeting sophisticated retail computer systems that store or process credit card data, stealing the data and then using it to commit fraud,' he said. '[PCI] is a valiant attempt to prevent large stockpiles of credit card data from getting into the wrong hands. However, it is unlikely PCI will ever be able to keep pace with the continually-evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks. We believe the time has come to rethink the assumptions behind PCI.'"

Comments (none posted)

Linux phishing botnet statistics can be deceptive (TechRepublic)

Chad Perrin at TechRepublic offers some thoughts on recent reports of Linux botnets in The Register, PCWorld, and elsewhere. "The obvious implication is that there are far more compromised Linux systems in phishing botnets than Windows systems. This is reinforced by eBay CISO Dave Cullinane's comment that 'The vast majority of [the phishing sites] we saw were on rootkit-ed Linux boxes, which was rather startling. We expected a predominance of Microsoft boxes and that wasn't the case.'"

Comments (none posted)

Ten ways to make more humane open source software (Humanized)

Humanized has a lengthy article on making free software more user-friendly. "The difference between the Mozilla and Firefox was that Mozilla was the result of developers contributing every web-browser feature they could think of. It only started to become humane once the Firefox team applied a unifying principle — 'Does this help Mom surf the web?' — and pared away features that didn't fit. It’s not enough to duplicate what has come before; even in an established category, a product still needs a unifying design, based on a clear vision of what users need to accomplish."

Comments (13 posted)

Trade Shows and Conferences

Regional Events Rock (Linux Journal)

Jon maddog Hall looks at some regional events. "Regional events allow customers to more easily see and talk with local vendors as well as the more local representatives of the national firms. The more local attendance allows the audience to get "up close and personal" with the speakers, and the age restrictions that exist at a lot of larger events are non-existent at these regional events. I met a lot of Free Software users who were still in strollers. :-)"

Comments (none posted)

Companies

Thank you Michael, but no, thank you... by Charles H. Shulz (Groklaw)

Groklaw has posted a different point of view on the tension between Novell and OpenOffice.org. "While Novell contributes quite normally to OpenOffice.org's import filters, it is also developing an OpenXML export filter that won't be available in OpenOffice.org-- that is, if you choose to use OpenOffice.org and not 'Open Office, Novell Edition'. And since these export filters are supposedly developed in collaboration with Microsoft, this technology would logically include Microsoft's sacred intellectual property that Sun and many others don't want to see covered by the JCA."

Comments (15 posted)

Linux Adoption

The Next Leap for Linux (The New York Times)

The New York Times looks at the current state of desktop Linux. "Until recently, major PC makers shied away from Linux. Now the industry is watching as Dell is selling two Linux-equipped desktop models ($549 and $870, including a monitor) and a $774 notebook PC. (Hewlett-Packard offers Linux systems to businesses, and Lenovo, the Chinese company that bought I.B.M.’s PC division, sells Linux machines in China and says it will soon offer Linux-based computers in the United States.) The Ubuntu version of Linux runs the Dell computers. Because Dell does not have to pay a licensing fee for the operating system, the computers are $80 cheaper than PCs with Windows Vista Home Premium or $50 cheaper than the stripped-down Vista Basic edition."

Comments (19 posted)

Linux set to dominate in embedded systems (EETimes)

EETimes analyzes the increasing use of Linux by embedded systems developers. "Embedded system manufacturers are increasingly committing to Linux as the operating system of choice, and this migration from more traditional and commercial operating systems is set to continue, according to market research group Venture Development Corporation (VDC). A recent survey by VDC (Natick, MA) suggests the majority of current Linux users surveyed plan to use Linux again as their primary operating system on future projects."

Comments (none posted)

Legal

Red Hat: Customers Can Deploy Linux with Confidence (eWeek)

Steve Ballmer, CEO of Microsoft, recently gave a speech in which he said that Linux users needed to compensate Microsoft for patent infringement. Of course requests to "show us the patents" remain unanswered. This vnunet article and this Linux-Watch article are just two of the many articles we've seen.

eWeek takes a look at the responses from Red Hat and the Linux Foundation. "In a scathing response to Ballmer's remarks, Red Hat's IP team said the reality is that the community development approach of free and open-source code represents a healthy development paradigm, which, when viewed from the perspective of pending lawsuits related to intellectual property, is at least as safe as proprietary software. "We are also aware of no patent lawsuit against Linux. Ever. Anywhere," the team said in a blog posting."

Comments (3 posted)

Resources

Bastille: Classic Linux and Unix Security (Enterprise Networking Planet)

Enterprise Networking Planet takes a look at Bastille for system security. "The glamorous new kids in the Linux security parade are SELinux, AppArmor, and all manner of virtualization technologies. (Though it is being discovered that virtual machines, just like chroot jails, aren't all that difficult to break out of, so don't count on them for strong security.) But don't overlook the reliable, helpful old-timer Bastille Linux. Bastille Linux is both a batch of Perl scripts that lead you through hardening your Linux system, and an educational tool. I recommend running it just to get a grounding in basic security measures -- the newfangled things are nice, but the basics are still important and valuable."

Comments (5 posted)

Setting time the right way, the Linux way (Linux-Watch)

Steven J. Vaughan Nichols discusses time issues and NTP client/server configuration in a Linux-Watch article. "Since most computers store the Epoch's number of seconds as a 32-bit signed integer, the "End of Time" will come at 03:14:07 UTC on Tuesday, Jan. 19, 2038. Since we're quickly moving to 64-bit computing, that won't be a real problem. The "End of Time" using a signed 64-bit integer will come sometime on Sunday, Dec. 4 in the year 292,277,026,596. With more than 290 billion years to go, I'm not going to sweat it. Believe it or not, we are already beginning to run into Epoch timing problems. For example, come January 19, 2008, you may get some interesting results from a 30-year mortgage calculator running on an older Linux or Unix system."

Comments (20 posted)

Reviews

Adobe readies Flex Builder for Linux (Tech Watch)

Tech Watch reports on Adobe's release of Adobe Flex Builder for Linux. "Flex Builder is an IDE for building rich Internet applications that leverage Flex and Adobe's Flash Player. Flex Builder Linux Alpha offers most Flex Builder 3 features such as project creation, code coloring, code hints and Ajax bridge. The release requires Sun Java Runtime Environment 1.5.x and the Eclipse 3.3 platform. The alpha product supports several Suse, Red Hat and Ubuntu Linux distributions and the Firefox browser. Plans call for expanding support to other browsers and Linux distributions, said Phil Costa, director of product management at Adobe."

Comments (11 posted)

Good-bye NetWare, hello Linux: Novell Open Enterprise 2.0 (Linux-Watch)

Linux-Watch looks at the release of Novell's Open Enterprise Server 2. "Now, with OES 2.0, the NetWare operating system kernel, NetWare 6.5 SP7, is still there if you run it, but it runs on top of the Xen hypervisor. You can also run the NetWare services, or a para-virtualized instance of NetWare, on top of Xen with the SLES (SUSE Linux Enterprise Server) 10 SP 1 kernel. So, if you're wedded to NetWare and its way of doing things, you don't have to wave good-bye to it."

Comments (none posted)

Laptop With a Mission Widens Its Audience (The New York Times)

David Pogue reviews the OLPC XO laptop for the New York Times. His take is quite favorable, giving Linux two positive stories in as many days in a pretty high-profile publication. "The truth is, the XO laptop, now in final testing, is absolutely amazing, and in my limited tests, a total kid magnet. Both the hardware and the software exhibit breakthrough after breakthrough — some of them not available on any other laptop, for $400 or $4,000."

Comments (36 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Mark Webbink Joins Board of Software Freedom Law Center

The Software Freedom Law Center (SFLC), has announced that Mark Webbink has joined its board of directors. "Webbink comes to SFLC from Red Hat, the premiere Linux and open source vendor, where he served as its first general counsel beginning in 2000. In 2004, he became Red Hat's deputy general counsel for intellectual property, a position he served in until his retirement in August 2007. During his tenure with Red Hat, Webbink wrote and spoke extensively on the subjects of open source software, software patents, and patent reform."

Full Story (comments: 1)

Commercial announcements

KnowledgeTreeLive service launched

KnowledgeTree has announced the launch of KnowledgeTreeLive, a software-as-a-service document management application built on the Amazon Elastic Compute Cloud and the rPath virtual appliance platform. "The KnowledgeTreeLive on-demand document management service brings the powerful capabilities of the open source KnowledgeTree application to users wishing to subscribe to an easy to use, cost-effective and secure hosted application. The KnowledgeTreeLive service includes document management and collaboration features such as document versioning and auditing, metadata and content searching, workflow, tagging and tag clouds, RSS feeds and email triggers.

Full Story (comments: none)

LPA announces African affiliates

The Linux Professional Institute has announces new affiliates in Africa. The LPI "announced new affiliates in East Africa (Uganda, Kenya, Tanzania) and Nigeria. "These two new affiliates are indicative of the growing importance of Linux and Open Source Software both in the field of education and IT capacity development in Africa," said John Meaney, LPI Area Operations Manager for EMEA (Europe, the Middle East, and Africa). Mr. Meaney noted that there was significant interest in the region in Linux professionalism and that he was involved in ongoing discussions with other potential affiliates for the Middle East and Africa."

Full Story (comments: none)

Oracle open-sources the OCI8 database driver for PHP

Oracle has announced the availability of an open-source preview release of OCI8. "Continuing to deliver on its long-standing commitment to the Open Source community, Oracle today announced the contribution and a preview release of an enhanced Oracle Call Interface (OCI8) database driver for PHP. This helps bring breakthrough scalability to PHP applications, further enhancing PHP as a viable development environment for mission-critical applications. The OCI8 database driver for PHP supports important Oracle(R) Database features such as connection pooling and fast application notification, enabling a single industry-standard server to support tens of thousands of database connections while providing higher availability."

Comments (none posted)

Scalix 11.2 released

Version 11.2 of Scalix has been announced. "Scalix, the premier award-winning Linux e-mail, calendaring and messaging company, today announced the release of Scalix 11.2, with significant new features to support hosted multi-tenant environments, the latest Linux servers, and enhanced Microsoft Outlook facilities for mobile devices. Scalix 11.2 allows application service providers (ASPs) to host multiple customers on a single Scalix server without the use of virtualization. They can now easily subdivide a single Scalix installation into multiple independent partitions, each with its own address book and global address list."

Full Story (comments: none)

TransGaming and Mandriva renew OEM agreement

TransGaming has announced that it has renewed an OEM agreement with Mandriva. "TransGaming Inc., a leading developer of software portability products for the electronic entertainment industry, announced today the renewal of the OEM and distribution agreement with Mandriva, the leading retail distribution for the Linux operating system. Under this agreement, MandrivaLinux 2008 customers will receive access to TransGaming's Cedega product that will allow them to play hundreds of PC games out-of-the-box."

Full Story (comments: none)

New Books

Linux Firewalls--New from No Starch

No Starch Press has published the book Linux Firewalls by Michael Rash.

Full Story (comments: none)

Linux Thin Client book from Packt Publishing

Packt Publishing has published the book Linux Thin Client Networks Design and Deployment by David Richards.

Full Story (comments: none)

Resources

FSFE Newsletter

The October 9, 2007 edition of the FSFE Newsletter is online with the latest Free Software Foundation Europe news. Topics include: Microsoft antitrust: A victory for Free Software and freedom of competition, WIPO: FSFE calls for interoperability and Open Standards, Freedom Task Force signs MoU with TIS Free Software Center, Southern Tyrol, Italy, Videos of FSFE president Georg Greve with Chilean Minister of Economy, FSFE supports protest against increased surveillance of digital communication, FSFE presents FSCONS and The Scandinavian Free Software Award, FSFE at OpenExpo, Switzerland and Get active.

Full Story (comments: none)

Contests and Awards

KDE 4.0 Release Event Contest (KDE.News)

KDE.News has an announced the KDE 4.0 Release Event Contest. "The KDE 4.0 Release Event Team is pleased to announce a contest for the KDE 4.0 Release Event. The winners of this contest will be flown out to Mountain View, California on January 17-19, 2008. Hotel and meals will be covered for them during the event. Read on for information about the contest. The purpose of this contest is to find the most enthusiastic KDE community member and reward him or her with a ticket to the KDE 4.0 Release Event held at the Google Headquarters at Mountain View, CA."

Comments (none posted)

Education and Certification

LPI Exams in Portugal and Italy

The Linux Professional Institute will hold discounted LPIC exams at in Portugal on October 12-13 and October 19-21, 2007, and in Italy on October 27, 2007.

Full Story (comments: none)

Upcoming Events

KDE 4.0 release event announced

A three-day event is being held at the Googleplex, 17-19 January 2008, to celebrate the release of KDE 4.0. The schedule is still being worked out, but there will be a keynote by Aaron Seigo and lots of BOFs (Birds of a Feather meetings). Click below for more information.

Full Story (comments: none)

Legal Summit for Software Freedom at Columbia Law School

The Software Freedom Law Center (SFLC) is hosting a legal summit at Columbia Law School in New York City on 12 October 2007. Speakers include Eben Moglen, Dan Ravicher, Richard Fontana, Matt Norwood, Karen Sandler and James Vasile and the summit covers "licensing, copyrights and patents, and corporate issues related to Software Freedom." Click below for more information.

Full Story (comments: none)

NLUUG 25 year anniversary conference

The NLUUG, the Dutch Unix Users Group, has announced its 25th anniversary conference. "The programme committee and the NLUUG board members are very excited about this 25th anniversary conference on November 7th, at the "Beurs of Berlage" in Amsterdam, the Netherlands. Do not miss this extraordinary conference!"

Full Story (comments: none)

Events: October 18, 2007 to December 17, 2007

The following event listing is taken from the LWN.net Calendar.

Date(s)	Event	Location
October 17 October 19	2007 WebGUI Users Conference	Madison, WI, USA
October 17 October 19	Web 2.0 Summit	San Francisco, CA, USA
October 18 October 20	HackLu 2007	Kirchberg, Luxembourg
October 19 October 21	ToorCon 9	San Diego, CA, USA
October 20 October 21	Ubucon.de	Krefeld (Köln), Germany
October 20	PostgreSQL Conference Fall 2007	Portland, OR, USA
October 20	./freedom & opensource day - PERU	Lima, PERU
October 21 October 25	OOPSLA 2007	Montreal, Canada
October 21 October 26	Colorado Software Summit	Keystone, CO, USA
October 22 October 26	OpenGL Bootcamp with Rocco Bowling	Atlanta, GA, USA
October 22 October 23	She's Geeky - A Women's Tech (un)Conference	Mountain View, CA, USA
October 23 October 25	Open aLANtejo 07 - CNSL07	Évora, Portugal
October 23 October 26	Black Hat Japan	Tokyo, Japan
October 25 October 26	FSOSS 2007 - Free Software and Open Source Symposium	Toronto, Canada
October 27 October 28	FOSSCamp 2007	Cambridge, MA, USA
October 27	Linux Day Italy	many cities around country, Italy
October 28 November 2	Ubuntu Developer Summit	Cambridge, Massachusetts, USA
October 29	3rd International Workshop on Storage Security and Survivability	Alexandria, VA, USA
October 29 November 1	Fall VON Conference and Expo	Boston, MA, USA
October 30 October 31	BCS'07	Jakarta, Indonesia
October 31 November 1	LinuxWorld Conference & Expo	Utrecht, Netherlands
November 1 November 2	The Linux Foundation Japan Symposium	Tokyo, Japan
November 2	5th ACM Workshop on Recurring Malcode	Alexandria, VA, USA
November 2 November 3	Embedded Linux Conference, Europe	Linz, Austria
November 2 November 4	Real-Time Linux Workshop	Linz, Austria
November 3	Linux-Info-Tag Dresden	Dresden, Germany
November 5 November 9	Python Bootcamp with Dave Beazley	Atlanta, USA
November 7	NLUUG 25th anniversary conference	Beurs van Berlage, Amsterdam, The Netherlands
November 7	Alfresco North American Community Conference 2007	New York, NY, USA
November 8 November 9	Blog World Expo	Las Vegas, NV, USA
November 10 November 11	Linuxtage	Essen, NRW, Germany
November 11 November 17	Large Installation System Administration Conference	Dallas, TX, USA
November 12 November 16	Ruby on Rails Bootcamp with Charles B. Quinn	Atlanta, USA
November 12 November 15	OWASP & WASC AppSec 2007 Conference	San Jose, USA
November 12 November 16	ApacheCon US 2007	Atlanta, GA, USA
November 13 November 14	IV Latin American Free Software Conference	Foz do Iguacu, Brazil
November 15 November 18	Piksel07	Bergen, Norway
November 15	Alfresco European Community Conference	Paris, France
November 16 November 18	aKademy-es 2007	Zaragoza, Spain
November 20 November 23	DeepSec ISDC 2007	Vienna, Austria
November 22 November 23	Conferencia Rails Hispana	Madrid, Spain
November 24	LinuxDay in Vorarlberg (Deutschland, Schweiz, Liechtenstein und Österreich)	Dornbirn, Austria
November 26 November 29	Open Source Developers' Conference	Brisbane, Australia
November 28 November 30	Mono Summit 2007	Madrid, Spain
November 29 November 30	PacSec 2007	Tokyo, Japan
December 1	Django Worldwide Sprint	Online, World
December 1	London Perl Workshop 2007	London, UK
December 4 December 8	FOSS.IN 2007	Bangalore, India
December 7 December 8	Free Software Conference Scandinavia	Gotherburg, Sweden
December 7 December 8	PGCon Brazil	Sao Paulo, Brazil
December 10	Paris on Rails (2nd Edition)	Paris, France
December 11 December 12	3rd DoD Open Conference: Deployment of Open Technologies and Architectures within Military Systems	Vienna, VA, USA
December 15 December 22	Unix Meeting 2007	IRC, Worldwide

If your event does not appear here, please tell us about it.

Web sites

Free Software Directory gets a new look

The Free Software Directory has undergone a web site makeover. "The Free Software Directory is a project of the Free Software Foundation (FSF) and United Nations Education, Scientific and Cultural Organization (UNESCO). We catalog useful free software that runs under free operating systems — particularly the GNU operating system and its GNU/Linux variants."

Comments (none posted)

Announcing Planet CentOS

The Planet CentOS web site has been announced. "The CentOS team is pleased to announce the Planet CentOS website. Are you wondering what is cooking in the kitchens of the CentOS developers? Wait no longer, Planet CentOS aggregates the blogs of CentOS contributors, merging them into one feed. You can read Planet CentOS with your favorite RSS/Atom reader, or through the Planet CentOS website." (Thanks to Daniel de Kok).

Comments (none posted)

Audio and Video programs

Samba and Google Summer of Code Podcast

A podcast with a discussion of Samba projects from the Google Summer of Code has been announced. "The podcast features several members of the Samba Team -- Jeremy Allison, Andrew Bartlett, Jelmer Vernooij, Jerry Carter, Kai Blin, Rafal Szczesniak, Stefan Metzmacher and Steve French -- and is a fun listen, covering everything from Samba development itself to Samba's participation in the Google Summer of Code."

Comments (none posted)

Page editor: Forrest Cook