LWN.net Weekly Edition for July 17, 2003

RFCs - insufficiently free?

Debian bug 92810 has the distinction of being one of the oldest release-critical bugs in the entire distribution. It was first reported on April 3, 2001, and has been the subject of occasional debate for over two years. Its resolution at the end of June, 2003 has left few people happy. Bug 92810, it seems, embodies an issue which remains unresolved in the free software community: how documentation should be licensed.

The issue at hand is how the Internet Society Request For Comments (RFC) documents are licensed. The RFCs are the core of the design of the Internet; they are the standards the describe the protocols, formats, algorithms, and conventions that make the net work. There are RFCs covering everything from the basic network protocols (i.e. for IP and TCP), email headers (RFC 2822) and HTML (RFC 1866) to netiquette (RFC 1855), avian datagram protocols (RFC 1149), and the Y10K problem (RFC 2550). Without the RFC series, the standards-based, interoperable Internet would not exist.

For anybody implementing or otherwise working with a network protocol, the relevant RFCs are required reading. So it is not surprising that a project like Debian would package up the RFC collection and include it with its distribution. The doc-rfc package is useful for Debian developers and its presence would not be questioned, except for a bit of a licensing problem. RFCs, it turns out, are required to carry a specific copyright notice (as specified in RFC 2223) which includes the following text:

This license, of course, does not allow the free creation of derived versions of the RFCs except in certain circumstances. That restriction violates the Debian Free Software Guidelines (DFSG). Most distributors would not be overly concerned about this problem; the license does allow them to distribute the RFC collection, after all. But the Debian Project takes its social contract seriously, and that contract requires that the distribution be "100% free software." Since the RFCs do not meet the DFSG (though there is not a complete consensus on that point), they have been evicted from the Debian distribution. Debian users wanting to install the doc-rfc package will have to look for it in the non-free area.

To many, Debian's uncompromising stance on licensing seems like a pedantic exercise carried out by people with nothing better to do with their time. But Debian is serving an important role in the community by serving as its conscience and early warning system. As recent events have shown, licensing is important. Every set of bits comes with its own copyright and its own restrictions. Failure to pay attention to those restrictions can lead to unwanted contact with lawyers, and is best avoided. Debian's high sensitivity to licensing problems brings those problems out into the open before somebody gets burned, and often leads to licensing changes which make the problems go away. Even when nothing changes, the Debian process points out where the open issues are.

The open issue in this case is that there is still no consensus on what free licensing means when applied to documentation. As a general rule, those who write text tend to want to maintain more control over their works than those to write code. Consider, for example, the Free Software Foundation's Free Documentation License, which includes a vast number of restrictions on modification and redistribution. (Debian, incidentally, is the group that has done the most to point out the non-free aspects of the FDL).

The Internet Society wants to retain enough control so that copies of a particular standard (and that's what the RFCs are) reflect the standard. A modified version of an RFC no longer reflects the standard, so such modifications are not allowed. The motivation is understandable and reasonable, but there is an important question which must be kept in mind. What happens if, sometime in the future, the Internet Society is coopted over to the Dark Side and starts moving the network standards in a proprietary or repressive direction? With the current licensing, there is no right to fork the RFCs and attempt to maintain a free, interoperable net. The RFC collection, thus, is truly not free. This result is almost certainly not what the Internet Society had in mind when it adopted its copyright notice, but that is the way it has turned out.

Five years or so ago, new software releases often were accompanied by new, one-off licenses that, as often as not, turned out to not be free. In more recent times, a relatively small set of well-known licenses has been adopted by most developers. Documentation, however, remains in the "roll your own license" stage. With luck, this area, too, will soon evolve toward a reasonable set of truly free licenses which reflect the needs and interests of writers.

Comments (26 posted)

Graphics programs for Linux

[This article was contributed by Joe 'Zonker' Brockmeier]

With the 1.0 release of Scribus this week, we thought we'd take a look at the state of open source graphics applications. There's a wide variety of these applications, and they are rapidly maturing, though maybe not quite as quickly as some might like. The most popular, and most mature in terms of features and polish, open source graphics application is The GNU Image Manipulation Program, better known as the GIMP. For those who are unfamiliar with the GIMP, it's very similar to Adobe Photoshop in nature, and offers much of the functionality of Photoshop though it still lacks some features that make Photoshop attractive to folks working with high-quality print publications. The GIMP has been around for quite some time, but the open source community has lacked a full-featured desktop publishing (DTP) programs like QuarkXPress, Adobe InDesign or PageMaker, Adobe Illustrator and CorelDraw.

The 1.0 release of Scribus may help fill that gap. While it still needs some work, Scribus is similar to Adobe InDesign and QuarkXPress. Unlike Quark or InDesign, though, Scribus is available under the GNU GPL and runs on Linux. I've tried Scribus on and off for some time now, and it definitely shows promise. After downloading the 1.0 release, I was impressed by how far Scribus has come in a fairly short time. It offers all the features you'd need to produce a decent company newsletter or flyer, allows you to prepare a document for printing or convert to PDF for electronic publishing. Scribus saves documents in an XML-type format, and can export projects to PDF, Encapsulated PostScript (EPS) and/or Scalable Vector Graphics (SVG) format.

There are a few glitches; some of the tools don't act quite as you might expect, and there are a few features that you'd definitely want in desktop publishing application that aren't in Scribus just yet. For example, the "text chain" feature doesn't seem to work predictably, and it doesn't seem possible to create a text box with multiple columns for text. But, a few shortcomings aside, Scribus is definitely a boon for folks who want to see Linux succeed on the desktop. While it may not be perfect, it should be good enough to attract a strong audience that will help to see it move forward in much the same way the GIMP has over the years.

Sodipodi is vector-based drawing application that looks very promising. Sodipodi is similar to Adobe Illustrator or CorelDraw, though it's not quite in the same league as those applications just yet. Judging by the images in the Sodipodi gallery, however, it has plenty to offer. Right now, Sodipodi is at the 0.32 release. It has quite a few features, and it's very usable, but it still needs to mature a bit before it's ready for "prime time." For example, Sodipodi only saves in the SVG format, and exports to PNG. It doesn't handle EPS or PDF right now, though EPS is on the tasks list. However, it has a full enough feature set, and is stable enough, that it can be used to create some really nice graphics.

Another GPL'ed Illustrator-like application that's been coming along nicely is Sketch. Sketch is also at a very usable stage, though it, too, has a ways to go before it will give Illustrator a run for its money. Like Sodipodi and Scribus, Sketch seems to be maturing at a fairly steady pace. Sketch is implemented mostly in Python, and is very stable. Sketch does write to EPS and Adobe Illustrator format, and reads XFig files, Adobe Illustrator files, Corel CMX, SVG and its own format, though it lacks support for TrueType fonts which may be a drawback for some users.

If you're interested in older graphics apps for Linux, there's Xfig. Xfig has quite a few features, though it doesn't seem to be under active development and it isn't the most user-friendly application.

OpenOffice.org's Draw is a suitable replacement for applications like Microsoft Publisher. It doesn't do all the fancy text-wrangling and so-forth that you'll find in Sodipodi or Scribus, but it's a nice and simple application for folks who want to create a office flyer, flowcharts and similar projects. Dia is another good application for producing diagrams for print or electronic publishing.

If your tastes are a little more simple, there are a few apps that are aimed at less complex projects. KPaint is a straightforward application that can be used to create very simple graphics, much like the Microsoft Windows Paint program. For those looking for programs for small kids, Tux Paint is a kid-oriented drawing program with a simple interface, sound effects and a restricted file interface that prevents users from accessing the host filesystem. As much as professional-quality graphics apps are necessary for Linux to succeed on the desktop, the low-end graphics apps need to be there as well. After all, who would want to deny their five-year-old the ability to mouse around and create pictures to e-mail to grandma?

The good news is that Linux graphics applications are starting to mature to the point that they're suitable for a fair range of uses. They're certainly good enough for home use, creating Web graphics and low-end DTP. The bad news is that open source graphics apps still need some work before they'll be ready to replace programs like QuarkXPress or Adobe Illustrator. Given enough attention, though, open source graphics applications could start finding their way into professional publishing houses within a few years.

Comments (20 posted)

SCO insider trading watch

Things have been relatively quiet on the SCO front recently; one gets the sense that, perhaps, the company's lawyers were finally able to convince management that a bit of discretion might be helpful. Silence does not mean that nothing is going on, however. Among other things, SCO's executives continue to slowly cash in their stock to take advantage of its current, inflated price. Here's the latest insider trading roundup:

Who	Role	Shares	Income	Filings
Opinder Bawa	VP Global Services	22,916	$142,200	1
Robert Bench	CFO	25,100	$174,100	1, 2, 3
Reginald Charles Broughton	VP International Sales	15,000	$161,600	1, 2, 3
Jeff Hunsaker	VP Worldwide Marketing	10,000	$103,500	1, 2
Michael Olson	VP Finance	14,000	$135,900	1, 2
Michael Sean Wilson	VP Corporate Development	6000	$64,800	1

That's a total of 93,000 shares sold since the suit was filed, for a net of $782,000. This sum is a small down payment on the bonanza that SCO hopes to eventually enjoy as a result of its actions. The big payoff may remain in the future, but one could understand if even the most confident SCO executive feels the need to collect a little now, on the off chance that things fail to go as planned.

It's worth noting that Opinder Bawa has quietly left the company, shortly after selling all shares in his possession.

Finally, it has emerged that - as many had speculated - the "mystery licensee" is none other than Sun Microsystems. The Unix license purchased by Sun came with a nice bonus: an option to buy 210,000 shares of SCO stock for $1.83 per share. Neither company has yet made any statements about why things were done this way. Most software license agreements do not include stock options, after all. A high level of paranoia is not yet called for, but it is natural to wonder just what Sun is up to here.

Comments (5 posted)

Conference season

The Ottawa Linux Symposium will be held July 23 to 26 in the Ottawa Conference Center. As always, OLS looks to be a strong, technical conference with a special emphasis on kernel development. Once again, LWN editor Jonathan Corbet will be there; be sure to get up early (10:00 AM) on Wednesday to catch his talk on driver porting.

OLS will be preceeded by a two-day kernel developers' summit, same as last year. The draft agenda includes a number of VM topics, "killing off devfs," power management, SCSI, asynchronous I/O, and numerous other topics. Once again, stay tuned to LWN for information from the meeting.

The LinuxWorld Conference and Expo takes place August 4 to 7 in San Francisco. LWN hasn't made it to LinuxWorld for a little bit, so we are pleased to note that Rebecca Sobol will be there this time around. It will be nice to be back.

Comments (none posted)

Page editor: Jonathan Corbet

Security

Brief items

Decreased security through monitoring

Worth a read: this Cringely column on electronic eavesdropping. The "Communications Assistance to Law Enforcement Act" (CALEA), passed in the mid 1990's, requires telecommunications providers to make life easy for law enforcement agencies wanting to listen to phone conversations. Apparently, the implementation of CALEA is not all that one might wish for:

CALEA systems have, according to Cringely, been hacked into by numerous bad guys, both domestic and foreign.

CALEA can be seen as a classic example of a bad governmental project gone worse, and as a dark omen of what the "total information awareness" system could bring. But there is a wider lesson here as well. Many organizations put monitoring capabilities into their networks as part of their security and policy enforcement operations. This monitoring can be performed by web proxies, mailers, intrusion detection systems, outsourced security services, and so on. Knowing what is happening on a network can be most helpful in keeping that network secure, but it is always worth remembering that these monitoring capabilities can be turned against you. Before putting in a facility that watches what you and your users are doing, it's worth putting some thought into how that facility will be secured and what could happen if it is compromised. Sometimes it might be better to watch a bit less.

Comments (1 posted)

New vulnerabilities

apache: multiple vulnerabilities in Apache HTTP server

Package(s):	apache	CVE #(s):	CAN-2003-0192 CAN-2003-0253 CAN-2003-0254
Created:	July 11, 2003	Updated:	September 22, 2003
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of the Apache HTTP Server 2.0.47. This release fixes four security vulnerabilities: Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one. [CAN-2003-0192] Certain errors returned by accept() on rarely accessed ports could cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253] Denial of service was caused when target host is IPv6 but ftp proxy server can't create IPv6 socket. [CAN-2003-0254] The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests. [VU#379828]
Alerts:	Red Hat RHSA-2003:243-01 2003-09-22 Red Hat RHSA-2003:240-01 2003-09-04 Mandrake MDKSA-2003:075-1 2003-08-28 Mandrake MDKSA-2003:075 2003-07-21 Conectiva CLA-2003:698 2003-07-21 Trustix 2003-0025 2003-07-11

Comments (none posted)

Mozilla: heap-based buffer overflow in Mozilla-based browsers

Package(s):	Mozilla	CVE #(s):	CAN-2002-1308
Created:	July 15, 2003	Updated:	July 21, 2003
Description:	A heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL referencing a malformed .jar file, which overflows a buffer during decompression. This has been fixed in Mozilla 1.0.2.
Alerts:	Red Hat RHSA-2003:162-02 2003-07-21 Red Hat RHSA-2003:162-01 2003-07-15

Comments (none posted)

mpg123 - buffer overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0577
Created:	July 16, 2003	Updated:	September 30, 2003
Description:	The mpg123 utility contains a buffer overflow vulnerability which can allow an attacker to execute arbitrary code by way of a malicious MP3 file.
Alerts:	Gentoo 200309-17 2003-09-30 Mandrake MDKSA-2003:078 2003-07-23 Conectiva CLA-2003:695 2003-07-15

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

phpgroupware - cross-site scripting and other exploits

Package(s):	phpgroupware	CVE #(s):	CAN-2003-0504 CAN-2003-0582
Created:	July 16, 2003	Updated:	October 1, 2003
Description:	Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is being actively exploited. Version 0.9.14.005 fixed several other vulnerabilities including cross-site scripting issues that can be exploited to obtain sensitive information such as authentication cookies. See this Security Corportation report for more information. CAN-2003-0504 CAN-2003-0582
Alerts:	Debian DSA-365-1 2003-08-05 Conectiva CLA-2003:703 2003-07-23 Mandrake MDKSA-2003:077 2003-07-23 Conectiva CLA-2003:697 2003-07-16

Comments (none posted)

traceroute-nanog: integer overflow

Package(s):	traceroute-nanog	CVE #(s):	CAN-2003-0453
Created:	July 16, 2003	Updated:	July 16, 2003
Description:	There is an integer overflow vulnerability in traceroute-nanog (an enhanced version of traceroute) which may be exploited to execute arbitrary code.
Alerts:	Debian DSA-348-1 2003-07-11

Comments (none posted)

ucd-snmp - heap overflow

Package(s):	ucd-snmp	CVE #(s):
Created:	July 16, 2003	Updated:	July 16, 2003
Description:	The snmpnetstat tool (part of the ucd-snmp package) contains a heap overflow vulnerability which, when confronted with a hostile server, can be exploited to run arbitrary code.
Alerts:	Conectiva CLA-2003:696 2003-07-15

Comments (none posted)

Updated vulnerabilities

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

CUPS: vulnerability in the CUPS IPP implementation

Package(s):	cups	CVE #(s):	CAN-2003-0195
Created:	May 27, 2003	Updated:	July 22, 2003
Description:	Phil D'Amore of Red Hat discovered a vulnerability in the CUPS IPP (Internet Printing Protocol) implementation. The IPP implementation is single-threaded, which means only one request can be serviced at a time. An attacker could make a partial request that does not time out and therefore creates a denial of service. In order to exploit this bug, an attacker must have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	Conectiva CLA-2003:702 2003-07-22 Gentoo 200306-09 2003-06-14 Debian DSA-317-1 2003-06-11 SuSE SuSE-SA:2003:028 2003-06-06 Yellow Dog YDU-20030602-3 2003-06-02 Mandrake MDKSA-2003:062 2003-05-29 Slackware ssa:2003-149-01 2003-05-29 Red Hat RHSA-2003:171-01 2003-05-27

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):	ethereal	CVE #(s):	CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:	June 23, 2003	Updated:	November 10, 2003
Description:	Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:	SCO Group CSSA-2003-030.0 2003-11-07 Yellow Dog YDU-20030718-2 2003-07-18 Red Hat RHSA-2003:203-01 2003-07-03 Gentoo 200306-13 2003-06-25 Conectiva CLA-2003:662 2003-06-25 Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

gtksee: buffer overflow

Package(s):	gtksee	CVE #(s):	CAN-2003-0444
Created:	June 30, 2003	Updated:	July 11, 2003
Description:	Viliam Holub discovered a bug in gtksee whereby, when loading PNG images of certain color depths, gtksee would overflow a heap-allocated buffer. This vulnerability could be exploited by an attacker using a carefully constructed PNG image to execute arbitrary code when the victim loads the file in gtksee.
Alerts:	Gentoo 200307-05 2003-07-11 Debian DSA-337-1 2003-06-29

Comments (none posted)

imagemagick: insecure temporary file

Package(s):	imagemagick	CVE #(s):	CAN-2003-0455
Created:	June 30, 2003	Updated:	July 10, 2003
Description:	There are circumstances in which imagemagick's libmagick library creates temporary files without taking appropriate security precautions. This vulnerability could be exploited by a local user to create or overwrite files with the privileges of another user who is invoking a program using this library.
Alerts:	OpenPKG OpenPKG-SA-2003.034 2003-07-10 Debian DSA-331-1 2003-06-27

Comments (none posted)

kernel 2.4 - two new vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2003-0244 CAN-2003-0246
Created:	May 14, 2003	Updated:	July 25, 2003
Description:	The 2.4.20 (and prior) kernel contains a couple of vulnerabilities that are worth fixing. The ioperm() system call doesn't perform proper checking, allowing a local user to manipulate arbitrary I/O ports. The networking code contains a remotely exploitable denial of service condition; see the May 24 Security Page for details.
Alerts:	Mandrake MDKSA-2003:066-2 2003-07-25 Conectiva CLA-2003:701 2003-07-22 Mandrake MDKSA-2003:066-1 2003-07-21 Mandrake MDKSA-2003:074 2003-07-15 Slackware SSA:2003-168-01 2003-06-17 Mandrake MDKSA-2003:066 2003-06-11 Debian DSA-312-1 2003-06-09 Debian DSA-311-1 2003-06-08 Red Hat RHSA-2003:187-01 2003-06-03 Red Hat RHSA-2003:145-01 2003-05-27 EnGarde ESA-20030515-017 2003-05-15 Red Hat RHSA-2003:172-00 2003-05-14

Comments (2 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

nethack: buffer overflow

Package(s):	nethack, slashem, falconseye	CVE #(s):	CAN-2003-0358 CAN-2003-0359
Created:	February 18, 2003	Updated:	July 15, 2003
Description:	Overflowing a buffer in nethack may lead to privilege escalation to games uid. Read the the full advisory for the details. Note that falconseye does not contain the file permission error CAN-2003-0359 which affected some other nethack packages.
Alerts:	Debian DSA-350-1 2003-07-15 Debian DSA-316-3 2003-06-17 Debian DSA-316-2 2003-06-11 Debian DSA-316-1 2003-06-11 Gentoo 200302-08 2003-02-18

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

pam_xauth: root exploit

Package(s):	pam_xauth	CVE #(s):	CAN-2002-1160
Created:	February 13, 2003	Updated:	July 10, 2003
Description:	The pam_xauth module is used to forward xauth information from user to user in applications such as 'su'. Andreas Beck discovered that versions of pam_xauth supplied with Red Hat Linux since version 7.1 would forward authorization information from the root account to unprivileged users. This could be used by a local attacker to gain access to an administrator's X session. In order to exploit this vulnerability, the attacker would have to get the administrator, as root, to use su to the account belonging to the attacker.
Alerts:	Conectiva CLA-2003:693 2003-07-10 Mandrake MDKSA-2003:017-1 2003-04-28 Red Hat RHSA-2003:035-10 2003-02-12

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PHP: Cross site scripting vulnerability

Package(s):	PHP	CVE #(s):	CAN-2003-0442
Created:	July 2, 2003	Updated:	August 13, 2003
Description:	In PHP version 4.3.1 and earlier, when transparent session ID support is enabled using the "session.use_trans_sid" option, the session ID is not escaped before use. This allows a Cross Site Scripting attack.
Alerts:	Mandrake MDKSA-2003:082-1 2003-08-12 Mandrake MDKSA-2003:082 2003-08-04 Yellow Dog YDU-20030710-2 2003-07-10 Debian DSA-351-1 2003-07-16 Conectiva CLA-2003:691 2003-07-08 OpenPKG OpenPKG-SA-2003.032 2003-07-07 Red Hat RHSA-2003:204-01 2003-07-02

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

radiusd-cistron: possible remote system compromise

Package(s):	radiusd-cistron	CVE #(s):	CAN-2003-0450
Created:	June 13, 2003	Updated:	July 11, 2003
Description:	The package radiusd-cistron is an implementation of the RADIUS protocol. Unfortunately the RADIUS server handles large NAS numbers incorrectly. This leads to overwriting internal memory of the server process and may be abused to gain remote access to the system the RADIUS server is running on.
Alerts:	Gentoo 200307-03 2003-07-11 Conectiva CLA-2003:664 2003-06-27 Debian DSA-321-1 2003-06-13 SuSE SuSE-SA:2003:030 2003-06-13

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

semi: insecure temporary file

Package(s):	semi, wemi	CVE #(s):	CAN-2003-0440
Created:	July 7, 2003	Updated:	October 1, 2003
Description:	semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and semi, potentially with contents supplied by the attacker. wemi is a fork of semi, and contains the same bug. CAN-2003-0440
Alerts:	Gentoo 200308-02 2003-08-14 Yellow Dog YDU-20030723-2 2003-07-23 Red Hat RHSA-2003:234-01 2003-07-23 Debian DSA-339-1 2003-07-06

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcptraceroute: problems dropping root privileges

Package(s):	tcptraceroute	CVE #(s):	CAN-2003-0489
Created:	June 28, 2003	Updated:	July 10, 2003
Description:	tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets. This may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.
Alerts:	Gentoo 200306-14 2003-06-28 Debian DSA-330-1 2003-06-23

Comments (none posted)

teapop: SQL injection

Package(s):	teapop	CVE #(s):	CAN-2003-0515
Created:	July 9, 2003	Updated:	October 1, 2003
Description:	teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL under the privileges of the database user as which teapop has authenticated. CAN-2003-0515
Alerts:	Gentoo 200309-18 2003-09-30 Debian DSA-347-1 2003-07-08

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):	unzip	CVE #(s):	CAN-2003-0282
Created:	July 1, 2003	Updated:	November 13, 2003
Description:	A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:	SCO Group CSSA-2003-031.0 2003-11-07 Debian DSA-344-2 2003-08-26 Slackware SSA:2003-237-01 2003-08-25 Mandrake MDKSA-2003:073-1 2003-08-19 Conectiva CLA-2003:724 2003-08-18 Red Hat RHSA-2003:199-02 2003-08-15 Yellow Dog YDU-20030710-1 2003-07-10 Gentoo 200307-02 2003-07-11 OpenPKG OpenPKG-SA-2003.033 2003-07-10 Debian DSA-344-1 2003-07-08 Mandrake MDKSA-2003:073 2003-07-07 Conectiva CLA-2003:672 2003-07-02 Immunix IMNX-2003-7+-017-01 2003-07-02 Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vixie-cron: Local vulnerability

Package(s):	vixie-cron	CVE #(s):	CVE-2001-0559
Created:	April 17, 2003	Updated:	October 3, 2003
Description:	From the ISS advisory: "Vixie Cron is a scheduling daemon that ships with several Linux distributions. Vixie Cron version 3.0pl1 could allow a local attacker to gain root privileges. Crontab fails to properly drop privileges in certain cases after a crontab modification operation. A local attacker could exploit this vulnerability to gain root privileges on the system since crontab is installed setuid root." Note: this vulnerability is dated May 07 2001, and was first mentioned in LWN on the May 10, 2001 security page.
Alerts:	Conectiva CLA-2003:758 2003-10-03 Conectiva CLA-2003:757 2003-10-03 Conectiva CLA-2003:628 2003-04-17

Comments (none posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xbl: buffer overflows

Package(s):	xbl	CVE #(s):	CAN-2003-0451 CAN-2003-0535
Created:	June 20, 2003	Updated:	July 9, 2003
Description:	Steve Kemp discovered several buffer overflows in xbl, a game, which can be triggered by long command line arguments. This vulnerability could be exploited by a local attacker to gain gid 'games'. This has been assigned CVE # CAN-2003-0451. Another buffer overflow was discovered in xbl which could also be exploited by a local attacker to gain gid 'games'. This has been assigned CVE # CAN-2003-0535.
Alerts:	Debian DSA-345-1 2003-07-08 Debian DSA-327-1 2003-06-19

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Xpdf - command execution vulnerability

Package(s):	Xpdf	CVE #(s):	CAN-2003-0434
Created:	June 18, 2003	Updated:	July 24, 2003
Description:	Xpdf suffers from the same sort of "execute arbitrary code embedded in a malicious document" vulnerability that is so widespread in other PostScript and PDF interpreters.
Alerts:	Mandrake MDKSA-2003:071-1 2003-07-23 Yellow Dog YDU-20030723-1 2003-07-23 Red Hat RHSA-2003:196-02 2003-07-17 Conectiva CLA-2003:674 2003-07-04 Mandrake MDKSA-2003:071 2003-06-27 Gentoo 200306-11 2003-06-25 Yellow Dog YDU-20030620-1 2003-06-20 Red Hat RHSA-2003:196-01 2003-06-18

Comments (none posted)

ypserv: denial of service

Package(s):	ypserv	CVE #(s):	CAN-2003-0251
Created:	June 25, 2003	Updated:	July 11, 2003
Description:	From the Red Hat advisory: "A vulnerability has been discovered in the ypserv NIS server prior to version 2.7. If a malicious client queries ypserv via TCP and subsequently ignores the server's response, ypserv will block attempting to send the reply. This results in ypserv failing to respond to other client requests." The fix is up upgrade to version 2.8.0.
Alerts:	Gentoo 200307-04 2003-07-11 Yellow Dog YDU-20030627-1 2003-06-27 Mandrake MDKSA-2003:072 2003-06-27 Red Hat RHSA-2003:173-01 2003-06-25

Comments (none posted)

Resources

July CRYPTO-GRAM newsletter

Bruce Schneier's CRYPTO-GRAM newsletter for July is out. It looks at fighting back against stupid "security" measures, spam filtering problems, Password Safe, and security FUD. "People, it seems, are not buying the new cool security products. There are half a dozen reasons for this, but FUD is a big one. We have threatened customers with the big bad nasties of the Internet. We have promised customers that -- this time for sure -- our products would solve their problems. But guess what? Customers have gotten cynical. They've noticed that it isn't all that bad out there."

Full Story (comments: 1)

LinuxSecurity.com newsletters

The latest Linux Advisory Watch and Linux Security Week newsletters from LinuxSecurity.com are available.

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test1, which was released by Linus on July 13. As is appropriate in this stage of development, this patch consists (almost) entirely of fixes. See the long-format changelog for the details.

The last of the 2.5 kernels was 2.5.75, released on July 10. This patch merged the anticipatory I/O scheduler (covered here last January), a new set of "kblockd" kernel threads (designed to handle block I/O operations without creating more such operations themselves), a scary new "nointegrity" JFS mount option, some software suspend tweaks, and, of course, lots of fixes and updates. See the long-format changelog for more.

Linus's BitKeeper tree contains a handful of small fixes, as of this writing.

Alan Cox has gotten back into the 2.6 prepatch business; his latest is 2.6.0-test1-ac2. This patch is made up almost entirely of fixes which have not yet made their way to Linus. Andrew Morton's 2.6.0-test1-mm1 is a much more bleeding-edge affair; it contains the latest ACPI code, the SELinux security module, a bunch of asynchronous I/O work, the 64-bit dev_t type, and much other stuff. The -mm tree is also where the bulk of the scheduler interactivity work is being done.

The current stable kernel is 2.4.21. The 2.4.22 process continues to move relatively quickly; 2.4.22-pre6 (consisting almost entirely of fixes) was released on July 14.

Comments (none posted)

Kernel development news

The 2.6 test series begins

On July 13, Linus began the 2.6.0-test series of development kernels. The move to the -test naming scheme indicates that the 2.5 development period is truly done, and that the focus is now strongly on stabilization. To that end, the -test1 release restricted itself to fixes and updates - except for the addition of Andries Brouwer's cryptoloop driver.

This sort of announcement usually results in a flurry of "but X hasn't been merged yet" postings. Things are much quieter this time around. It would seem that, for the most part, the features that the developers want to see in the kernel are mostly in place. There are a few remaining loose ends, however:

• The expanded dev_t type. Most of the ground work has been done, but the size of dev_t has not yet been changed in Linus's tree. It is widely expected that this work will be completed before 2.6.0 goes out.

• Power management still needs some work. Much of that work has been done, but it has not yet been packaged up and submitted to Linus.

• The NSA SELinux security module is being proposed for inclusion. Linus has not made his feelings known on this patch, but, since it does not affect anything outside of the module itself, adding SELinux should be relatively easy to justify. Andrew Morton has indicated that SELinux will show up in his -mm tree shortly.

• Support for many (or most) non-x86 architectures is not current in the mainline kernel. This is a pretty standard state of affairs; the official 2.6.0 kernel will certainly lack functioning support for several architectures.

• There is some continuing unease over the state of the 2.5 scheduler, which shows problems with certain kinds of loads.

In the past, Linus has not always been successful in making this kind of freeze stick. This time around, however, Andrew Morton will be involved in the stabilization process. Since Andrew will also be maintaining the resulting 2.6 kernel, he'll have a strong incentive to keep a lid on things during the test phase.

Now, of course, is the time for people with an interest in 2.6 to try out the -test releases. Before trying out a 2.6-test kernel for the first time, however, a reading of Dave Jones's "what to expect" document is highly recommended (Joe Pranevich's Wonderful World of Linux 2.6 is also worth a look). Also note that putting a 2.6-test kernel on a production system is a risky thing to do; there are still known bugs and security issues to be dealt with.

Comments (2 posted)

64GB on 32-bit systems

Once upon a time - not that long ago - the Linux kernel was unable to work with more than 1GB of physical memory (actually, just a little bit less). This limit was imposed by a couple of fundamental design decisions in the kernel:

• All physical memory was directly reachable via a kernel virtual address. When the kernel has direct access to all memory, manipulating that memory is easy. But, to operate in this mode, the system cannot have more memory than the kernel is able to address.

• The virtual address space was split into two large pieces: the bottommost 3GB for user-space addresses, and the top 1GB for kernel addresses.

The 3/1 split was not imposed by any particular external factor; instead, it was a compromise chosen to balance two limits. The portion of the address space given over to user addresses limits the maximum size of any individual process on the system, while the kernel's portion limits the maximum amount of physical memory which can be supported. Allowing the kernel to address more memory would reduce the maximum size of every process in the system, to the chagrin of Lisp programmers and Mozilla users worldwide. There were, however, patches in circulation to change the address space split for specific needs.

The 2.3 development series added the concept of "high memory," which is not directly addressable by the kernel. High memory complicated kernel programming a bit - kernel code cannot access an arbitrary page in the system without setting up an explicit page-table mapping first. But the payoff that comes with high memory is that much larger amounts of physical memory can now be supported. Multi-gigabyte Linux systems are now common.

High memory has not solved the problem entirely, however. The kernel is still limited to 1GB of directly-addressable low memory. Any kernel data structure which is frequently accessed must live in low memory, or system performance will be hurt. Increasingly, low memory is becoming the new limiting factor on system scalability.

Consider, for example, the system memory map, which consists of a struct page structure for every page of physical memory in the system. The memory map is a fundamental kernel data structure which must be placed in low memory. It takes up 40 bytes for every (4096-byte) page in the system; that overhead may seem small until you consider that, if you want to put 64GB of memory into an x86 box, the memory map will grow to some 640 megabytes. This structure thus takes most of low memory by itself. Low memory must also be used for every other important data structure, free memory, and the kernel code itself. For a 64GB system, 1GB of low memory is insufficient to even allow the system to boot, much less do the sort of serious processing that such machines are bought for.

One approach to solving this problem is page clustering - grouping physical pages into larger virtual pages. Among other things, this technique reduces the size of the memory map. Page clustering was covered here back in February.

Recently, Ingo Molnar posted a patch which takes a very different approach. Rather than try to squeeze more into 1GB of low memory, Ingo's patch makes low memory bigger. This is done by creating separate page tables to be used by user-space and kernel code, eliminating the need to split the virtual address space between the two realms. With this patch, a user-space process has a page table which gives it access to (almost) the full 4GB virtual address space. When the system goes into kernel mode (via a system call or interrupt), it switches over to the kernel page tables. Since none of the kernel page table space must be given to user processes, the kernel, too, can use the full 4GB address space. The maximum amount of addressable low memory thus quadruples.

There are, of course, costs to this approach, or it would have been adopted a long time ago. The biggest problem is that the processor's translation buffer (a hardware cache which stores the results of page table lookups) must be flushed when the page tables are changed. Flushing the TLB hurts because subsequent memory accesses will be slowed by the need to do a full, multi-level page table lookup. And, as it turns out, the TLB flush is, itself, a slow operation on x86 processors. The additional overhead is enough to cause a significant slowdown, especially for certain kinds of loads.

The cost by the separated page tables is more than most users will want to pay. For those who have applications requiring large amounts of memory - and who, for whatever reason, cannot just get a 64-bit system - this patch may well be the piece that makes everything work. Of course, the chances of such a patch getting in to the mainline kernel before 2.7 are about zero. But it would not be surprising to see it show up in certain vendors' distributions as an option.

Comments (5 posted)

Bug trackers and kernel development

The Kernel Bug Tracker ("bugme") is a BugZilla system run by the Open Source Development Lab. It currently holds information on over 300 reported bugs in the 2.5 kernel. The Tracker is seen by many as a useful tool that brings some organization and discipline to the task of stabilizing the kernel. So it came as a surprise to many when David Miller, maintainer of the networking subsystem, requested that networking bugs not be entered into the Tracker. It is, he says, the wrong way of solving the problem.

The complaint with bug tracking systems is that they try to centralize what is otherwise an inherently distributed process. Bugs accumulate in the database, and a single person gets the job of managing all the bugs for a particular subsystem. If that person does not devote a significant amount of time to the task, the tracking system quickly clogs up with outdated reports, duplicated entries, and generally useless stuff. The time that goes into maintaining the bug tracker is, of course, time that is not available to actually fix the bugs.

The proper way of dealing with bugs, according to David, is to simply report them to the relevant mailing list. The report will be seen by the developers who can fix the bug, others who have been affected by the bug can contribute additional information, and fixes can be publicly discussed. And people who, for whatever reason, do not want to deal with a particular bug report can simply hit "delete" and the message goes away.

Of course, the "goes away" part is not always popular with those who report bugs; they would rather see the report hang around and annoy people until one of them deals with the problem. But anybody who has sent a few bug reports to a public list knows that those reports can simply vanish without a trace - a rather unsatisfying result. Why bother to report bugs if the reports can simply be ignored?

According to David (and others), the lossy nature of mailing list bug reporting is actually a feature. Bug reporting, it is said, is a process similar to patch submission. Users who do not get satisfaction from a bug report should resubmit it. If the bug is not important enough for the user to "maintain" the report, it's not worth a whole lot of effort to fix.

The "submit and retry" approach does have some advantages. Since it puts more of the responsibility for bug reports on the users submitting those reports, it scales more reliably as the number of users increases. Unimportant or "operator error" bugs vanish automatically without anybody having to shovel them out of a bug tracking system. Bugs which are fixed by (seemingly) unrelated patches also fade away automatically. The whole thing works in a scalable way without the need for central managers.

This approach is foreign and scary, however, to those who feel the need to track every bug and keep a firm hand on the development process. It provides FUD fodder for those who would portray free software development as immature and untrustworthy. It's also frustrating to those who want to retain bug report information for statistical or data mining purposes. It is, however, typical of how the kernel development process works in general. And that process, for all its faults, has produced excellent results over years as the kernel (and its development team) has grown.

Comments (13 posted)

Patches and updates

Kernel trees

• Alan Cox: Linux 2.6.0-test1-ac1. (July 14, 2003)

• Alan Cox: Linux 2.6.0-test1-ac2. (July 16, 2003)

• Andrew Morton: 2.6.0-test1-mm1. (July 16, 2003)

• Stephen Hemminger: 2.6.0-test1-osdl1. (July 16, 2003)

• Stephen Hemminger: 2.5.75-osdl1. (July 15, 2003)

• Randy.Dunlap: 2.5.75-kj1. (July 15, 2003)

Core kernel code

• Davide Libenzi: SCHED_SOFTRR linux scheduler policy .... (July 10, 2003)

• Con Kolivas: O4int interactivity. (July 10, 2003)

• Con Kolivas: SCHED_ISO for interactivity. (July 11, 2003)

• ffrederick@prov-liege.be: rbtree branch access. (July 11, 2003)

• Michal Wronski: Posix Message Queues. (July 14, 2003)

• ffrederick@prov-liege.be: ipc kobject model against 2.6t1. (July 15, 2003)

• Tom Zanussi: dynamic printk. (July 15, 2003)

• Nigel Cunningham: ANNOUNCE: Software Suspend for 2.4 kernel v1.0. (July 15, 2003)

• Rusty Russell: local_t. (July 16, 2003)

Device drivers

• Jean Tourrilhes: nsc 39x support. (July 10, 2003)

• Jean Tourrilhes: VIA driver. (July 10, 2003)

• Flameeyes: LIRC drivers for 2.5.74 - 2nd version. (July 11, 2003)

• Greg KH: USB fixes for 2.5.75. (July 11, 2003)

• Thomas Sailer: USB audio.c: make trigger semantics more OSS compliant. (July 11, 2003)

• Alan Cox: PATCH: AC97 updates from 2.4. (July 14, 2003)

• Alan Cox: PATCH: Add Kahlua audio from 2.4. (July 14, 2003)

• Rudo Thomas: update emu10k1 to the latest CVS (and more). (July 15, 2003)

• Grover, Andrew: ACPI patches updated (20030714). (July 15, 2003)

Documentation

• Steven Cole: [PATCH] 2.4.22-pre4-bk update Documentation/Changes, scripts/ver_linux for quota-tools.. (July 10, 2003)

• Steven Cole: [PATCH] 2.5.74-bk update Documentation/Changes, scripts/ver_linux for quota-tools.. (July 10, 2003)

Filesystems and block I/O

• Andries.Brouwer@cwi.nl: cryptoloop. (July 11, 2003)

• Trond Myklebust: 2.5.75 Support dentry revalidation under open("."). (July 11, 2003)

• Trond Myklebust: 2.5.75 Support dentry revalidation under open(".") (revised). (July 14, 2003)

• Joe Thornber: dm: v4 ioctl interface. (July 11, 2003)

• Tom Zanussi: relayfs. (July 15, 2003)

• Tom Zanussi: relayfs Documentation. (July 15, 2003)

• Tom Zanussi: relayfs include files. (July 15, 2003)

• Tom Zanussi: relayfs VFS-related files. (July 15, 2003)

• Tom Zanussi: relayfs API and common code. (July 15, 2003)

• Tom Zanussi: relayfs scheme-dependent code. (July 15, 2003)

Memory management

• J.A. Magallon: do_generic_direct_write: bad flag check. (July 10, 2003)

• Greg Ungerer: : linux-2.5.75-uc0 (MMU-less fix ups). (July 11, 2003)

Networking

• Jeff Garzik: more net driver merges. (July 11, 2003)

Architecture-specific

• J.A. Magallon: 2.4.22-pre3: P3 and P4 for chekc_gcc. (July 10, 2003)

• Tavis Ormandy: 2.4.21: Optionally Configure UAC Policy via Sysctl (Alpha). (July 10, 2003)

• john stultz: linux-2.4.22-pre4_x440-acpi-fix_A0. (July 10, 2003)

• john stultz: linux-2.4.22-pre4_x440-acpi-fix_A1. (July 10, 2003)

• Anders Gustafsson: add xbox subarchitecture. (July 10, 2003)

• Andi Kleen: Deprecate sysctl(2), add sysctl_name. (July 11, 2003)

• Yoshinori Sato: 2.5.75 h8300 archtecure support update. (July 11, 2003)

Security-related

• Stephen Smalley: Add SELinux module to 2.6.0-test1. (July 14, 2003)

Benchmarks and bugs

• Con Kolivas: 2.5.75 with contest. (July 15, 2003)

• Con Kolivas: 2.5.75-mm1 with contest. (July 15, 2003)

Miscellaneous

• John Levon: OProfile: __exit fixes. (July 10, 2003)

• John Levon: OProfile: needed fix to IO-APIC timer. (July 10, 2003)

• John Levon: OProfile: fix a comment. (July 10, 2003)

• Neil F. Brown: ANNOUNCE: nfs-utils 1.0.4. (July 14, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Ten Years of Slackware

[This article was contributed by Ladislav Bodnar]

Yes, you have been taken exactly 10 years back in history when Slackware Linux 1.0 was rather unceremoniously unveiled to those who had the determination and skill to get it installed on their computers. Since the actual development had started at some point in 1992, it is safe to say that Slackware Linux is the oldest surviving Linux distribution on the market today. It was created by Patrick Volkerding and originally based on one of the first ever Linux distributions called SLS Linux by Soft Landing Systems.

The Linux veterans among the readers will remember that Slackware 1.0 came on 24 floppy disks, 13 of which were the essential A series, while the remaining 11 floppies contained XFree86 and graphical applications. What exciting features could one find in Slackware 1.0? The Linux kernel was at version 0.99pl11 alpha. It came with math emulation and normal hard drive support, TCP/IP, support for ext2fs, msdos and several other file systems, and it even supported a PS/2 style mouse. It was compiled with libc 4.4.1 and g++ 2.4.5. The graphical part of the distribution was based on XFree86 1.3 and the OpenLook Virtual Window Manager was the default desktop environment.

New releases followed in rapid succession and six new Slackware versions were announced during the remaining 5 months of that year. A much improved Slackware Linux 2.0 was released in July 1994. It came with a choice between a stable Linux kernel 1.0.9 and a development kernel 1.1.18, and included XFree86 2.1.1. It was about this time that Patrick Volkerding turned the Slackware distribution commercial in cooperation with Morse Telecommunication, who were about to release the product on a bootable CD, together with printed documentation.

The Linux Journal magazine interviewed Patrick Volkerding in the second issue of the newly launched publication in April 1994. "Why did you call it Slackware?", was one of the questions. "My friend J.R. 'Bob' Dobbs suggested it.", replied Patrick. "Although I've seen people say that it carries negative connotations, I've grown to like the name. It's what I started calling it back when it was really just a hacked version of SLS and I had no intention of putting it up for public retrieval. When I finally did put it up for FTP, I kept the name. I think I named it 'Slackware' because I didn't want people to take it all that seriously at first." Interestingly, a potential merge of Slackware with Debian was under consideration in those days, claimed the 27-year old creator of Slackware Linux.

Slackware Linux 3.0 (kernel 1.2.13) came out in August 1995 and this was followed by a considerable slowdown in the frequency of new releases. It took the distribution almost four years to reach version 4.0 (kernel 2.2.6) in May 1999 (see this review). This trend was broken 5 months later when another new release was announced, and to the surprise of many, it was called Slackware Linux 7.0 (kernel 2.2.13)! Why the sudden escalation of the version number? The Slackware web site explains: "I think it's clear that some other distributions inflated their version numbers for marketing purposes, and I've had to field (way too many times) the question 'why isn't yours 6.x' or worse 'when will you upgrade to Linux 6.0' which really drives home the effectiveness of this simple trick. Sorry if I haven't been enough of a purist about this. I promise I won't inflate the version number again (unless everyone else does again ;)

In the following years, the Slackware release cycle settled to about one per year, while the more adventurous users followed the distribution's continuously evolving current branch. But the infamous dotcom bust brought a period of uncertainty to the future of Slackware development. This happened when Slackware's primary distributor Walnut Creek merged with BSDi, which was later acquired by another company called WindRiver. Things started to look bleak when WindRiver announced in April 2001 that it would no longer support the development of Slackware. Patrick Volkerding: "I'm working on setting up a company so we can handle the publishing ourselves. Unfortunately, I'm broke. I can get funding to publish and ship the release to all the subscribers (and anyone else who wants it), but have no money to pay my fellow friends until we make some."

Luckily for all Slackware fans, things turned out rather nicely as Patrick Volkerding teamed up with Bob Bruce, the founder of Walnut Creek, to form a company handling product sales. And, according to this interview, Slackware is actually a profitable business: Patrick Volkerding: "There were certainly times I looked around at the trade shows at new distributions with larger booths and more employees and wondered if I'd made the right move, but in retrospect I'm glad I kept things small. Most of those companies aren't around anymore. When the investments dried up they couldn't afford to continue operating at a loss. Most of the funding for the Slackware project comes from people who have subscribed to the CD releases, or bought CDs from our Web site. This is what pays the bills and enables us to give away free software to everybody else."

Things have always been kept simple and quiet at Slackware and this is perhaps the main reason why the distribution's 90% market share, which it enjoyed before 1996, has dwindled substantially, as new distributions with a lot more ambition have come to dominate the server rooms. Despite that, Slackware remains one of the top five Linux distributions in terms of popularity and server deployments. Its mailing lists, which have now been transferred into an online user forum at userlocal.com, have become a large collection of some 170,000 posts over the years, while the sheer number of active Slackware community sites in dozens of languages, perhaps only rivaled by the number of sites devoted to Debian, is a clear indication that Slackware remains a powerful force in the world of Linux distributions.

Happy birthday, Slackware! Thank you for all the great work during the past decade and we look forward to more "slacking" for many more years to come!

Comments (3 posted)

Distribution News

Debian GNU/Linux

The July 16 issue of the Debian Weekly News is available. This week's topics include the Debconf talk schedule, software patents, the G++ 3.2 transition, RFC licensing, and several others.

ServerBeach, a provider of self-managed hosting services, now offers Debian GNU Linux on Starter Servers and Power Servers.

Comments (none posted)

Gentoo Weekly Newsletter -- Volume 2, Issue 28

The Gentoo Weekly Newsletter for July 14, 2003 is out, with a look at Gentoo Linux at LinuxTag and the news that ViewCVS is back up.

Full Story (comments: none)

Mandrake Linux Community Newsletter - Issue #81

The Mandrake Linux Community Newsletter for July 10, 2003 is out. This week's top story is a message from the CEO about MandrakeSoft's Status.

Full Story (comments: none)

Lycoris Unveils OS For Tablet PC Platform

Lycoris unveiled a new OS for the tablet PC, Desktop/LX Tablet Edition. The Tablet Edition is now available for tablet manufacturers and resellers. Click below for more information.

Full Story (comments: none)

Microtel to Bundle SuSE Linux for Walmart.com

SuSE Linux and Microtel Computer Systems have announced that Microtel PCs preloaded with the SuSE Linux 8.2 operating system are for sale at Walmart.com.

Comments (none posted)

Red Hat Enterprise Linux-rebuild mailing list and mini-HOWTO

A new mailing list has been announced, for the discussion of rebuilding and installing a Linux system based on the SRPMS of Red Hat Enterprise Linux. There is also a mini-HOWTO on the subject. Click below for more information.

Full Story (comments: none)

Slackware Linux

Slackware Linux reports some security fixes to nfs-utils this week. You can find the advisories on our Security page. Of course the slackware-current changelog has the details.

Comments (none posted)

Trustix Secure Linux

Trustix has released more bug fixes for TSL 2.0. This round fixes bugs in anaconda, kernel, mkinitrd and pptpd. Click below for more information.

Full Story (comments: none)

Create Debian Linux packages (IBM DeveloperWorks)

IBM DeveloperWorks looks at the process of creating Debian packages. "The Debian packaging system is one of the most elegant methods of installing, upgrading, and removing software available. For all you fans of other packaging systems, before you send your flames, please note that I said "one of" and not simply "the most." Other packaging systems have their charms, but in this article I'm going to focus on the Debian packaging system. Specifically, I'm going to look at creating Debian packages so you can distribute your packages in Debian format -- or simply create packages for your own use."

Comments (1 posted)

New Distributions

BG-Rescue Linux

BG-Rescue Linux is a Busybox 0.60.5 and uClibc 0.9.19 based rescue system with kernel 2.4.21. It is loaded either from two floppy disks or from one 2.8MB El Torito CD. The system runs entirely in RAM. Version 0.1.3 was released July 15, 2003.

Comments (none posted)

Minor distribution updates

Ark Linux

Ark Linux has released v1.0-0.alpha8.2 with major feature enhancements. "Changes: Updates have been made to many components of the operating system, such as kernel 2.4.21, KDE 3.1.2, and gcc 3.3. Internationalization has been improved. The system has been adapted to work with 2.5.x/2.6pre kernels, although these kernels are not installed by default. Many bugs were fixed."

Comments (none posted)

Crash Recovery Kit

Crash Recovery Kit has released version 2.4.21, based on Red Hat Linux 9. Click below for more information.

Full Story (comments: none)

DeLi Linux

DeLi Linux has released v0.3 with minor feature enhancements. "Changes: Many bugfixes were made. Better i18n support has been added. New packages provide a small SQL database, graphical FTP clients, a new FTP server, and a new samba client."

Comments (none posted)

distccKNOPPIX

distccKNOPPIX has released v0.0.5 with minor feature enhancements. "Changes: Versions 3.2 and 2.95 of gcc, g++, and cpp were included, but there are still uncertainties about how to best prepare the ISOs for the different compiler versions. A small hack was implemented to display the IP address when the distccd daemon starts, and some unneeded locales were removed."

Comments (none posted)

floppyfw

floppyfw has released v2.0.6 with minor bugfixes. "Changes: This version fixes a few bugs regarding packages and a few other minor issues."

Comments (none posted)

Morphix

Morphix has released v0.4 with major feature enhancements. "Changes: Numerous fixes have been made to the base module. WiFi support has been added (prism2 + Orinoco), USB has been fixed, and a 2.4.21-xfs kernel is used. All main modules have been updated to the latest packages in Debian sid, giving you Firebird 0.6 in Light and Mozilla 1.4 in Heavy, and KDE modules. The Game module has been split up, and now the ISO includes an Enemy Territory minimod instead of the Q3A or UT2003 demos, which are now available as minimodules separately. The number of minimodules has grown from 4 to 16, including scientific, rescue, console, and security minimodules."

Comments (none posted)

NSA Security Enhanced Linux

NSA Security Enhanced Linux has released v2003071106 with minor feature enhancements. "Changes: The base kernel versions have been updated to 2.5.74 and 2.4.21. The SELinux API redesign with xattr support has been completed for the 2.5-based kernel. The SELinux daemon and utility patches have been ported to the new API. Support for the AT_SECURE auxv entry was added. Changes were made to bprm hook permission checking and nosuid operation. A report, "Securing the X Window System with SELinux", was added to documentation discussing adding SELinux controls to the window system. Many contributed patches have been merged, and RPM spec files and SRPMs are now provided."

Comments (none posted)

RxLinux

RxLinux has released v1.4.7 with minor feature enhancements. "Changes: A fix for automatic serial console configuration using kudzu, and addition of /usr/dirname needed by the Java runtime wrapper."

Comments (none posted)

Slackware Live CD

Slackware Live CD has released v2.9.0.20 with major feature enhancements. "Changes: This release added bdiff, dbdiff, xdos (a DOSEMU and FreeDOS suite), the Samba client and smbmount, nfsutils, rdist, rsync, nmap, BitchX, the joe, jove, and jed editors, the "most" filter, the Fluxbox window manager, raidtools, jfsutils, reiserfsprogs, xfsprogs, umsdos-progs, and zoneinfo. It is now possible to install your own packages in /usr/local and to copy the CD to hard disk. Netscape and some useless KDE themes were removed. Executables are now compressed with the upx packer."

Comments (none posted)

stresslinux

stresslinux has released v0.2.0 with major feature enhancements. "Changes: All kernels were recompiled with i2c-2.8.0 and lm_sensors 2.8.0. The busybox was updated to version 1.0.0pre1. Various other little fixes were also made."

Comments (none posted)

TrinityOS

TrinityOS has released v07/07/03 with major feature enhancements. "Changes: An update to the kernel compiling script "build-it", installation of OpenSSH to TrinityOS and deprecation of the use of SSH.com code (though instructions are still present), updated thoughts on RPM hell (it's not that bad now) and patch/errata support, and other bugfixes."

Comments (none posted)

Page editor: Rebecca Sobol

Development

BusyBox 1.0.0-pre1 released

Version 1.0.0-pre1 of BusyBox, an integrated collection of Unix-like command line utilities for embedded systems, has been released. The project has been fairly quiet this year, the previous release, version 0.60.5, was issued in October, 2002.

This version has been submitted for testing, the real version 1.0.0 release should happen sometime near the end of July, 2003 if all goes according to the plan. The Changelog file has lots of gory details concerning what has changed.

For embedded systems and minimalist Linux distributions, BusyBox is able to replace a large number of command line utilities as well as some common shells with a single binary that has a modest memory footprint. Developers who wish to further minimize the size of the binary can selectively compile in only the parts that are desired for the particular system. BusyBox can be built on most platforms that support GCC, the GNU Compiler Collection.

The project has a number of well known contributors including original author Bruce Perens of Debian fame, Linus Torvalds, and many other notable individuals. The current project maintainer is Erik Andersen.

For a list of the command line utilities that BusyBox mimics, as well as a full explanation of the utility, take a look at the online man page and README documents.

BusyBox has been released under the GNU General Public License (GPL).

Comments (none posted)

System Applications

Audio Projects

ALSA 0.9.5 available

Version 0.9.5 of the ALSA sound driver is available. Change information is in the source code.

Comments (none posted)

Ogg Traffic

The July 15, 2003 edition of Ogg Traffic is out with Ogg Vorbis audio compression software news. "It's time for a new Ogg Traffic, and this issue has lots of things to shout about! Brendan has released version 2.0 of libshout, and many other exciting events are happening."

Comments (none posted)

Clusters and Grids

OpenSSI 0.9.8 (SourceForge)

Version 0.9.8 of OpenSSI, a Single System Image for clustering environments, has been announced. "The source code has been completely reorganized. There are new instructions for installation. This release features improvements to the OpenSSI-enhanced /dev filesystem and LVS. Furthermore, it can now migrate processes linked to libpthread, including Perl processes."

Comments (none posted)

Database Software

Firebird 1.5 Release Candidate 4 available

Version 1.5 Release Candidate 4 of the Firebird database is available. "The development of Firebird 1.5 release is in final development stage ! The Release Candidate means that we're "almost there", and we turned our focus to remaining known issues and rough edges, final testing and bug squashing. We made a lot of progress with it thanks to your feedback."

Comments (1 posted)

Electronics

XCircuit 3.1.17 released

Version 3.1.17 of XCircuit, an electronic schematic drawing utility, is available. Change information is in the source code.

Comments (none posted)

Mail Software

milter-sender/0.29 beta available

Version 0.29 beta of milter-sender, a real-time sender address verification utility for Sendmail 8.12, is available. This release includes two important bug fixes, see the Change Log file for more information.

Comments (none posted)

Medical Software

Kidwai Clinical Management Laboratory System 2.0 (LinuxMedNews)

LinuxMedNews has an announcement for version 2.0 of the Kidwai Clinical Management Laboratory System. "Kidwai is a system to automate a critical component of a cancer hospital's existing (non-computerized) management system. It automates the entire process of managing Individual Patients Laboratory Requisition details, from the registration of a patient for a specific test (on site), to a doctor viewing the patient's tests results from a terminal."

Comments (none posted)

Web Site Development

Eddie 1.5.3 announced

Version 1.5.3 of Eddie, a WAN and LAN clustering tool for web servers, has been released. "This version is a maintenance release that make Eddie run on Erlang/OTP R9B-1 (latest version)."

Full Story (comments: none)

fcForum 1.1.4 Released to the Community (ZopeMembers)

Version 1.1.4 of fcForum is available for Zope. "fcForum is an open source, XHTML 1.0, CSS 2.0 standards compatible, ZClass-based Message Board Product, intended to be ready for use out-of-the-box with almost no configuration required at all, and with a clean and neat user interface." Version 1.1.4 now provides three forum types, admin-only, member-only, and public.

Comments (none posted)

GroupUserFolder reaches v1.2 ! (ZopeMembers)

Zope Members News has an announcement for version 1.2 of GRUF, a tool for managing groups of users from within Zope.

Comments (none posted)

mnoGoSearch 3.2.13 released

Version 3.2.13 of the mnoGoSearch web site search engine is available. New features and bug fixes are documented in the Change Log file.

Comments (none posted)

osCommerce 2.2 Milestone 2 (SourceForge)

SourceForge has an announcement for version 2.2 of osCommerce, an open-source e-commerce system. "The Milestone 2 release contains numerous updates to strengthen the security on both client and server side of operations. osCommerce, formerly titled The Exchange Project, is a feature packed out-of-the-box online shop ecommerce solution for both PHP3 and PHP4 web servers. Maintenance is made easy with a friendly GUI thats given to the Administration Tool."

Comments (none posted)

Quixote 0.6.1 released

Version 0.6.1 of Quixote, a Python-based Web Application Framework, has been released. See the announcement for details.

Comments (none posted)

Tiki 1.7 RC1 released (SourceForge)

Version 1.7 of Tiki, a CMS Groupware application, has been released. "Tiki 1.7 includes a lot of new features, including multi-server capability, workflow engine (galaxia), WYSIWYG editor, WML&PDA extensions (HawHaw), an events and groups calendar, many new plugins, several feature enhancements, and more."

Comments (none posted)

How to Avoid Writing Code (O'Reilly)

Kake Pugh writes about mining databases with Perl on O'Reilly. "One of the most boring programming tasks in the world has to be pulling data out of a database and displaying it on a web site. Yet it's also one of the most ubiquitous. Perl programmers being lazy, there are tools to help make boring programming tasks less painful, and two of these tools, Class::DBI and the Template Toolkit, create a whole which is far more drudgery-destroying than its parts."

Comments (none posted)

Integrating mod_perl with Apache 2.1 Authentication (O'Reilly)

Geoffrey Young covers issues on Apache authentication with Perl. "Furthermore, even though the standard Apache distribution came with modules to support both Basic and Digest authentication, Apache (and thus mod_perl) only offered an API for interacting with Basic authentication. If you wanted to use Digest authentication, flat files were the only password storage medium available. With both of these restrictions, it seemed impractical to deploy Digest authentication in all but the most limited circumstances."

Comments (none posted)

Privoxy default.action 1.7 released (SourceForge)

A new action file for Privoxy, a web proxy with filtering capabilities, has been released. "This actions file fixes a number of configuration issues with the 3.0.2 release. Everyone is encouraged to upgrade."

Comments (none posted)

Miscellaneous

New Project Formed: OpenGroupware.org

The OpenGroupware.org ('OGo') project announced its formation and the release of its groupware server software. The OGo software is based initially on the contribution of the code of SKYRiX 4.1 Groupware Server.

Full Story (comments: none)

Desktop Applications

Audio Applications

Three new releases of gmorgan

It's been a busy week for gmorgan developer Josep Holborn. Three new versions of the organ synthesizer with auto-accompaniment and rhythm station have been released. Version 0.02 adds a drum velocity mixer and a batch song player/editor. Version 0.03 adds a drum pattern editor, demo patterns and songs, and bug fixes. Version 0.04 adds a new song file format, batch play additions, and the ability to export MIDI files.

Comments (none posted)

lcdplugin 0.6.3 alpha released

Lcdplugin, an extension to winamp that connects to an external LCD display, has been updated. Version 0.6.3 alpha adds custom character map for each LCD, dynamic menus, configurable text for system state changes, and bug fixes.

Comments (none posted)

Desktop Environments

GNOME 2.2.2 released (GnomeDesktop)

GnomeDesktop.org has the announcement for version 2.2.2 of the GNOME Desktop and Developer Platform. "The 2.2.x series is devoted to bugfixes, translations, and general polish of our major 2.2 stable release. We strongly recommend upgrading to 2.2.2 in particular, as it contains an amazing amount of improvements since the last release."

Comments (none posted)

GARNOME 0.25.0 is out (GnomeDesktop)

Version 0.25.0 of GARNOME, the GNOME distribution for testers and tweakers, has been announced. Most of the changes involve updated package versions.

Comments (none posted)

KDE-CVS-Digest

KDE.News summarizes the contents of the July 11, 2003 KDE-CVS-Digest: "In this week's digest: The KDE Kolab client nears release. Klaviatura, a simple proof-of-concept on-screen keyboard is added to kdenonbeta demonstrating the possibilities of QAccessible and DCOP. The KDevelop CVS service is improved."

Comments (none posted)

KDE Traffic #58

Issue #58 of KDE Traffic is out. Topics include Artsbuilder/Kdenonbeta, IDE?, Knopdex, introducing brockenboring, and cute kittens.

Comments (none posted)

KDE Gains Support for International Domain Names

According to KDE.News, the Konqueror browser and KDE base libraries now support domain names written in non-ASCII character sets. "Konqueror and the KDE base libraries in CVS now support domain names written with names outside the usual strict 7-bit ASCII letters. This means that one can now register and access domain names written in proper letters for almost all languages in the planet, not just English. Konqueror is among the first browsers to support this new technology, developed in cooperation with VeriSign which has also been cooperating with the Safari and Mozilla teams (Mozilla IDN announcement and explanation)."

Comments (none posted)

XFce4 RC1 released

Version 4-RC1 of the XFce desktop environment is available. "RC 1 is the third public development release of the next generation of the XFce desktop environment and the first release candidate. If no large problems are found this is intended to become 4.0. XFce 4 is a complete rewrite from XFce 3."

Full Story (comments: none)

Games

Gaudi 0.1.4 released

Version 0.1.4 of Gaudi, a graphical blueprint editor that is part of the WorldForge game project, has been released. This version features a number of bug fixes, the screen shots are impressive.

Comments (none posted)

Pygame developments

The Pygame site lists new versions of the games Pyrunner, Chat, and Pathological.

Comments (none posted)

Graphics

JFreeChart 0.9.9 released (SourceForge)

An announcement has been placed on SourceForge for JFreeChart version 0.9.9. "JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots."

Comments (none posted)

GUI Packages

SPTK 2.0 alpha 5 released

SPTK version 2.0 alpha 5, a widget toolkit for FLTK, has been released and includes a number of bug fixes.

Comments (none posted)

Interoperability

wine20030709 released

Version 20030709 of Wine has been announced. Changes include: more Direct3D and DirectSound improvements, inter-process clipboard support, improved locale handling, progress on the kernel/ntdll separation, and bug fixes.

Comments (none posted)

Wine Traffic

The July 11, 2003 edition of Wine Traffic is out. Topics include: Wine-20030709, AutoCAD Tips, Linux Refresher Course, Viva la Kernel Module Idea, RPC Via Windows Messages and Other OLE Fun, and Structured Exception Handling Support for GCC.

Comments (none posted)

Mail Clients

SquirrelMail 1.4.1 released (SourceForge)

Version 1.4.1 of SquirrelMail, a PHP4-based Web email client, has been released. "This is the second release of the stable 1.4.x series. This release added no new user features, focusing strictly on bugfixes and performance enhancements."

Comments (none posted)

Office Applications

AbiWord Weekly News

Issue #152 of the AbiWord Weekly News is out. "1.99.2 tarballs on Source Forge and Savannah, the official statement on the TextMaker advertisement, printing bugs fix backported to stable, MailMerge (or is it now DataSources) successfully functions with GnomeDB, Math editing in AbiWord and how you can help the Open Text Summariser in your language. All that and wise-cracks to the FootNotes users, plus two screenshots depicting the evolution of DataSources."

Comments (none posted)

AbiWord 1.99.2 (AbiWord 2.0 Beta 2) released (GnomeDesktop)

GnomeDesktop.org has an announcement for version 1.99.2 of the AbiWord word processor. "The AbiWord team continue to steam ahead for a world-rocking 2.0 release. Thanks very much to bug reporters. We've now made many, many fixes to our first beta and thanks to Tomas Frydrych and his helpers we now have ligature support for fontsets that support them."

Comments (none posted)

AbiWord gets GDA/Gnome-DB support! (GnomeDesktop)

AbiWord now has support for GDA/Gnome-DB. "Just before AbiWord 2.0 gets out the door, some developers couldn't resist adding the feature you all really want to see: an integrated GNOME Office Suite! To be more precise: AbiWord gets GDA/Gnome-DB support! With the GDA plugin, you can import data directly into your AbiWord documents from all data sources GDA supports!"

Comments (none posted)

Evolution 1.4.3 released (GnomeDesktop)

Version 1.4.3 of the GNOME Evolution groupware suite has been released. "This release fixes some several problems, including some crashers, some memory leaks and an issue with certain buggy POP servers that caused mail download to not work properly. 1.4.0 users are strongly encouraged to upgrade."

Comments (none posted)

Evolution 2.0 UI proposal (GnomeDesktop)

GnomeDesktop.org looks at possible UI changes to Evolution. "Here at Ximian we have been brainstorming a bit about what happens next in the Evolution world. One of the ideas that has come up is a substantial overhaul of Evolution's UI."

Comments (none posted)

OpenOffice.org 1.1 RC is available

The release candidate for OpenOffice.org version 1.1 is available. "OpenOffice.org1.1 RC is expected to be feature complete with no more features added before the final OpenOffice.org 1.1 release. This release addresses user feedback and is ready for everyday use by everyone."

Full Story (comments: none)

Scribus 1.0 released

Scribus 1.0 ("the first open source desktop publishing application capable of generating professional 'press-ready' results") has been released. It is a Qt-based application which runs on almost anything; there is a long list of features aimed at the creation of high-quality output, and Scribus can be scripted in Python. We hope to have a closer look at this release shortly; in the mean time, click below for the 1.0 announcement.

Full Story (comments: 16)

Video Applications

Xawdecode 1.7.0 is out (SourceForge)

Version 1.7.0 of Xawdecode is available. "X11 TV application based on xawtv 2.x series which adds many enhancements like Xvideo rendering support, deinterlacing, real time divx recording, integrated alevt teletext browser and provides a plugin API to add any functionnality one might think of."

Comments (none posted)

Web Browsers

ChatZilla for Mozilla Firebird (MozillaZine)

MozillaZine reports that the Firebird browser now supports the ChatZilla IRC client. "ChatZilla has been available for Firebird for a while now but many people still assume that it only works with the Mozilla Application Suite."

Comments (none posted)

Epiphany 0.8.0 ''Girlish Edition'' Released (GnomeDesktop)

Version 0.8.0 of Epiphany, the GNOME web browser, has been released.

Comments (none posted)

Trunk Frozen for Mozilla 1.5 Alpha (MozillaZine)

According to MozillaZine, the Mozilla 1.5 trunk has been frozen. "While the tree is frozen, all checkins to the trunk require approval from drivers@mozilla.org or they will not be allowed to land. The freeze is expected to last for a few days and the trunk will be reopened when Mozilla 1.5 Alpha is released."

Comments (none posted)

Miscellaneous

Terminal Server Client 0.120 Released (GnomeDesktop)

Version 0.120 of Terminal Server Client has been announced. "A new release of Terminal Server Client, a frontend for rdesktop and other remote desktop tools, has been unleashed. Version 0.120 now supports RDP (using rdesktop), VNC (using *vncviewer), XDMCP (using Xnest), and ICA (using wfica). Along with continued HIGification and usability improvements, support was added for the Citrix ICA client. Banner problems have been adjusted and translations updated."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for July 8-15, 2003 is out. Topics include: heap profiling, adding data persistency in Ocaml, Seeking feedback on a project, new calendar library, and First alpha release of the FoC library.

Full Story (comments: none)

Java

Jython Needs Developers

Jython, an implementation of the Python language in Java, needs developer help. ..."But the thing is that there has always been a bit of a shortage of core Jython developers, and lately things have been even worse. Apparently Finn Bock hasn't been active for a while, and Samuele Pedroni et al. don't have time for everything. I don't know the details of the whole story, but Guido mentioned about this in his EuroPython keynote, and the message was that there aren't enough core developers right now for Jython. "

Comments (2 posted)

Java programming dynamics, Part 3: Applied reflection (IBM developerWorks)

Dennis M. Sosnoski writes about Java command line argument processing on IBM's developerWorks. "Command line argument processing is one of those nasty chores that seems to keep coming around no matter how many times you've dealt with it in the past. Rather than writing variations of the same code over and over, why not use reflection to simplify the job of argument processing? Java consultant Dennis Sosnoski shows you how. In this article, Dennis outlines an open source library that makes command line arguments practically handle themselves."

Comments (none posted)

Lisp

HTML-TEMPLATE initial release

The initial release of HTML-TEMPLATE, a Common Lisp library that is used for filling HTML templates, has been released.

Full Story (comments: none)

XMLS 0.4 released

XMLS 0.4 is available. "Xmls is a small, simple, non-validating xml parser for Common Lisp. It's designed to be a self-contained, easily embedded parser that recognizes a useful subset of the XML spec. It provides a simple mapping from xml to lisp s-expressions and back."

Full Story (comments: none)

ML

MLton 20030711 available

Version 20030711 of MLton, the standard ML compiler, is available. "Improvements include support for Sparc/SunOS, completion of the basis library implementation, support for calling SML from C, and libraries for weak pointers and finalization."

Full Story (comments: none)

Pascal

Free Pascal version 1.0.10 released

Version 1.0.10 of Free Pascal is available. "This is a bugfix release mostly. However, to support the Lazarus IDE, and several other projects, some enhancements are included anyway".

Full Story (comments: none)

Perl

Perl 5.8.1 Release Candidate One (use Perl)

UsePerl has an announcement for Perl 5.8.1 release candidate 1. "Please text extensively, especially if you had problems with Perl 5.8.0."

Comments (none posted)

Perl 5.8.1 RC2 is Out (use Perl)

UsePerl has announced the availability of Perl 5.8.1-RC2. "jhi writes "The RC1 had one embarassing build failure (in AIX), one new feature (the hash randomisation) made optional instead of default (we are still weighing our options), and the v-strings deprecation message was added."

Comments (none posted)

This Week on perl5-porters (use Perl)

The July 7-13, 2003 edition of This Week on perl5-porters is out. "In a two-release-candidate-week, there are plenty of things to summarize. Learn what happened behind the scenes : random seeding of hashing, deprecation of vstrings, signals, floats, and the other things."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The July 13, 2003 edition of This week on Perl 6 has been published. Topics include: Targeting Parrot from GCC, Timely destruction and TRACE_SYSTEM_AREAS, Parrot is not feature frozen, Perl* Abstraction, Fun with ParrotIO, Jako groks basic PMCs, I want a Ponie!, Exceptions!, Perl 6 Rules at OSCON, and more.

Comments (none posted)

PHP

PHP Weekly Summary for July 14, 2003

The PHP Weekly Summary for July 14, 2003 is out. Topics include: Technical questions? MD5, SHA1 calculations, API version number, OCI8 with 4.3.2, Manual translation, PHP 5 for Netware, Reflection API, strip_tags() updated.

Comments (none posted)

phpDocumentor 1.2.1 released (SourceForge)

Version 1.2.1 of phpDocumentor, a PHP documentation solution, has been released. "The phpDocumentor team is pleased to announce the release of phpDocumentor 1.2.1. This is a bug fix release, all users who had problems with 1.2.0 should upgrade."

Comments (none posted)

Common Style Mistakes, Part 2 (O'ReillyNet)

O'Reilly's OnLamp.com site has an article on PHP coding tips. "In the second of a series on PHP Paranoia, John Coggeshall gives three tips to write code that's easier to understand."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL for July 14, 2003 is out with news and links for the Python community.

Full Story (comments: none)

python-dev Summary

The latest Python-dev Summary is out. "This is a summary of traffic on the python-dev mailing list from June 1, 2003 through June 30, 2003. It is intended to inform the wider Python community of on-going developments on the list and to have an archived summary of each thread started on the list."

Comments (none posted)

LDAP Programming in Python (Linux Journal)

Linux Journal has published a HOWTO article on using python-ldap to access LDAP services from Python. "You've heard about the next generation directory protocol called LDAP (lightweight directory access protocol), and you're wondering if it's possible to write programs that can interact with it. Maybe you've even set up an LDAP server of your own, and now you want to write programs for it. To these ends, this article gets you ready to write your own programs to automate the querying process of LDAP servers."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The July 14, 2003 edition of Dr. Dobb's Tcl-URL! is out with the weeks' Tcl/Tk news.

Full Story (comments: none)

XML

Serialize XML data (IBM developerWorks)

Tinny Ng covers XML data serialization on IBM's developerWorks. "IBM developer Tinny Ng shows you how to serialize XML data to a DOMString with different encodings. You'll also find examples that demonstrate how to use the MemBufFormatTarget, StdOutFormatTarget, and LocalFileFormatTarget output streams in XML4C/Xerces-C++."

Comments (none posted)

A Survey of APIs and Techniques for Processing XML (O'Reilly)

Dare Obasanjo writes about XML processing tools on O'Reilly. "This article provides an overview of the current landscape of techniques for processing XML and runs the gamut from discussing old mainstays, such as push model APIs and tree model APIs as exemplified by SAX and DOM, to newer participants in the XML world such as cursor APIs and pull model parsers as exemplified by the .NET Framework's XPathNavigator and the XmlPull API respectively."

Comments (none posted)

Transclusion with XSLT 2.0 (O'Reilly)

Bob DuCharme writes about transclusion and XSLT on O'Reilly. "Transclusion is a hypertext concept that began in the work of Ted Nelson, who coined the term "hypertext". Roughly speaking, transclusion is the inclusion of a resource, or part of a resource, potentially from anywhere in the world, within a new one. For example, the HTML img element is a form of transclusion. Nelson envisioned dynamic compound documents consisting entirely of pointers to pieces of other documents, with the compound ones automatically reflecting updates to the transcluded pieces."

Comments (none posted)

Editors

Leo 3.12 beta 2 released (SourceForge)

Version 3.12 beta 2 of Leo, a scriptable programmer's editor and browsing tool, is available. "This version fixes many bugs and adds a few new features. There are no known serious bugs in this version of Leo."

Comments (none posted)

PyPE 1.1 announced

Version 1.1 of PyPE, the Python Programmer's Editor, is available. "PyPE (Python Programmers Editor) was written in order to offer a lightweight but powerful editor for those of you who think emacs is too much and idle is too little. Syntax highlighting is included out of the box, as is multiple open documents via tabs."

Comments (none posted)

Miscellaneous

Create Debian Linux packages (IBM developerWorks)

Joe "Zonker" Brockmeier shows how to build Debian packages on IBM's developerWorks. "Learn the basics of creating Debian packages for distributing programs and source code. This article shows all the necessary components of a package and how to put them together to end up with a final product."

Comments (1 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

'Open Source' Database Poses Threat to Oracle (Wall Street Journal)

The Wall Street Journal looks at the impact that open-source databases are having on commercial database companies. "But now, Oracle and other database suppliers face a growing threat from below: "open source" databases, which give customers a free or low-cost alternative to commercial products. While the impact has been small so far, some analysts expect open-source software to eventually turn databases into a low-cost commodity, just as the open-source Linux operating system is posing a threat to Microsoft Corp.'s Windows franchise."

Comments (1 posted)

Inside the open-source development model (News.com)

News.com is running this article from HBS Working Knowledge which looks into the open-source development model. "Many people have wondered why these people give their work away. The truth is that many projects have become incorporated in order to protect themselves from individual liability. Since the founding of the Free Software Foundation in 1985, a number of new nonprofit foundations have formed, often around specific technologies, to serve the interests of programmers."

Comments (1 posted)

The politics of open-source software (News.com)

This News.com article looks at the efforts of the Initiative for Software Choice (ISC) as it attempts to ensure that government agencies won't favor open-source over proprietary software. "The ISC is by far the most vocal opponent of a growing trend: Legislation that, if enacted, would all but prohibit government agencies from purchasing proprietary software for their own use. The ISC asserts that such legislation could jeopardize the future of the worldwide commercial software industry."

Comments (4 posted)

Linux To Become A De Facto Standard (IT-Director)

IT-Director.com is carrying a column by Robin Bloor on why Linux is the only reasonable choice for "server virtualization" applications. "It qualifies because it spans so many platforms - from small devices up to IBM's zSeries mainframe. It also qualifies because, like TCP/IP, it doesn't actually belong to anyone. It runs on most chips and is rapidly becoming the developer platform of choice. So the idea is starting to emerge that you virtualise storage by the use of SANs and NAS and you virtualise server hardware by the use of Linux - thus making it feasible to switch applications from one server to another automatically, and quickly."

Comments (1 posted)

Trade Shows and Conferences

The State of Open Source (O'ReillyNet)

O'RellyNet reports from OSCON 2003. "The night that divides the two days of tutorials from the three-day conference at the fifth annual O'Reilly Open Source Convention is reserved for the States of the Union addresses. Luminaries from the open source communities of Perl, Python, PHP, MySQL, Apache, and Linux each spoke for just under a half hour to present their take on the current state of their technology and where it is headed."

Comments (none posted)

Kapor's Thoughts on Desktop Linux (O'ReillyNet)

Daniel Steinberg reports on Kapor's keynote from OSCON 2003 in this O'ReillyNet article. "Six years later, in 1991, Linux was introduced. Kapor argues that Linux is so successful on the server that it is attracting parasitic companies whose business offerings consist of little more than Linux-centered litigation. As for desktop computing, Kapor asserts that Linux is gaining credibility in this era of Net-centric computing as this focus on the Net is in the DNA of Linux."

Comments (2 posted)

SCO vs. Linux: Show Me the Money (eWeek)

eWeek covers a panel discussion at OSCON. "In a late afternoon panel discussion titled "The IP Wars: SCO Versus Linux," moderator Chris DiBona, vice president and founder of Damage Studios, said the topic essentially involves a "SCO versus everybody else talk," adding that the lawsuit was probably brought for financial reasons as IBM is a player with a lot of money.""

Comments (2 posted)

Here's how Linux gets to the desktop (ZDNet)

This ZDNet article focuses on Mitch Kapor's keynote at OSCON. "Kapor said he would not be surprised to see 10 percent of global desktops running Linux in the near future. That's a good bet."

Comments (3 posted)

Open source flexes its muscle at OSCON (ZDNet)

ZDNet's David Berlind went to OSCON. "Eric Raymond, president of the Open Source Initiative, was comparing open source to cockroaches as he explained to my 13-year-old son the simplicity of open source, why it has caught on with such rabid intensity, and why the buzz was undeniably vibrant here at OSCON '03."

Comments (1 posted)

Open Source on Rise in Government (eWeek)

eWeek covers Lisa Wolfisch Nyman's OSCON talk titled "Open Source in Government". "A 2002 report from the MITRE Corp. also identified 110 open-source software tools in use at the Department of Defense. And this year, the office of the CIO at the Department came out with an official open-source software policy, which placed open-source software under the same requirements of Commercial Off The Shelf (COTS) products and the same security certification, she said."

Comments (none posted)

OpenOffice.org at OSCON

Louis Suarez-Potts overviews the OpenOffice.org coverage at the O'Reilly OSCON.

Full Story (comments: none)

Linux Rules the Day at CA World (eWeek)

eWeek goes to Linux Solution Day at the CA World conference. "Computer Associates International Inc., which has pegged Tuesday as Linux Solution Day at its CA World conference here, is working on a range of new Linux deals, initiatives and products, including an upcoming formal partnership with Linux solution provider Ximian Inc."

Comments (1 posted)

Companies

AOL axes Gecko team, dumps Netscape (MozillaZine)

According to MozillaZine, AOL has laid off the Mozilla developers. "It has been learned through public and private sources that AOL has cut or will cut the remaining team working on Mozilla in a mass firing and are dismantling what was left of Netscape (they've even pulled the logos off the buildings). Some will remain working on Mozilla during the transition, and will move to other jobs within AOL."

Comments (none posted)

Sun expands Unix deal with SCO (News.com)

News.com looks into deals between Sun and SCO. "The pact, signed earlier this year, expanded the rights Sun acquired in 1994 to use Unix in its Solaris operating system. But there's more to the relationship: SCO also granted Sun a warrant to buy as many as 210,000 shares of SCO stock at $1.83 per share as part of the licensing deal, according to a regulatory document filed Tuesday."

Comments (7 posted)

Walmart.com sells Microtel PC with SuSE Linux software (InfoWorld)

InfoWorld reports that Microtel PCs with SuSE Linux 8.2 installed will be available from Walmart.com. "For SuSE, this is a first not only with Microtel, which designs, manufacturers, and customizes computers, but also with Wal-Mart, one of the biggest retailers in the U.S., Egle said. "The deal with Wal-Mart is very important to us because it opens the door to the huge U.S. consumer market," he said."

Comments (2 posted)

Linux Adoption

Linux wins big over Microsoft in Munich (USA Today)

USA Today covers some concessions by Microsoft as the company tried (unsuccessfully) to win in Munich. "A Linux victory in Munich would be a stunning blow. So Ballmer visited Mayor Christian Ude to assure him Microsoft would do what it takes to keep the city's business. Documents obtained by USA TODAY show Microsoft subsequently lowered its pricing to $31.9 million and then to $23.7 million -- an overall 35% price cut. The discounts were for naught." (Thanks to Jamie Strandboge)

Comments (8 posted)

Japan Mulls Switch To Linux For Public Servants Data (TechWeb)

TechWeb is running an Associated Press article proclaiming that the Japanese government is considering using Linux when it upgrades its computer data files for public servants in 2005. "Japan has chosen a proposal submitted by a group made up of Fujitsu, IBM Japan, and Oki Electric Industry Co. The companies suggest using Linux to manage salary and other personnel data for the nation's 800,000 central government employees, government official Masanobu Arao said Wednesday."

Comments (4 posted)

Open Asia: GNU/Linux gaining visibility across the continent (NewsForge)

NewsForge covers some wins for GNU/Linux in Asia. "Like the legendary story of the blind men and the elephant, the role that GNU/Linux is actually playing is both difficult to notice and hard to understand. There are hints from all over that GNU/Linux has excited the imagination of a generation, whose members are suddenly finding the rules of the software game drastically altered -- in their favour, for a change."

Comments (none posted)

Linux users rate stability over TCO (Australian IT)

The Australian IT covers a survey by Computer Associates. "According to the survey, which involved 2500 corporate customers across the globe, 95 per cent of companies rated Linux's reliability as its most important contribution to business value. Acquisition cost was the next most popular choice, cited by 89 per cent. TCO came out at the bottom list, with 65 per cent of companies listing it as a contributor to value."

Comments (2 posted)

Interviews

Interview: Andrew Morton (LinuxWorld)

LinuxWorld.com.au interviews kernel hacker Andrew Morton. "There simply is no room for great flights of self-expressive fancy in the Linux kernel. It is very much an exercise in maintenance and gradual evolution. You'll see much more innovation and change in the application world than in the kernel" (Thanks to Howie D).

Comments (3 posted)

Slash'EM Interview (O'Reilly)

O'Reilly interviews game developers Warren Cheung and J. Ali Harlowe. "Any worthwhile Nethack variant eventually finds a home in Slash'EM. Tracking those variants and the main Nethack sources is quite a job though. Howard Wen recently interviewed Warren Cheung and J. Ali Harlowe, the lead developers of Slash'EM."

Comments (none posted)

Resources

Device Classes (LinuxJournal)

Greg KH covers necessary insructions for making your new device driver play nice in the 2.6 kernel, in the August issue of Linux Journal. "In the 2.5.69 kernel, the driver class support was rewritten radically. In previous kernel versions, class support was tied tightly to the driver and device support. A class would be bound to the device at the same time it was registered to a driver. This did work for a number of devices and classes, but some real-world devices did not fit very well into this model. Now, class support is tied only loosely to devices and drivers; in fact, a device or driver is not even needed to use the class code now, as the tty class code shows. The class code is now split into three different types of structures: classes, class devices and class interfaces."

Comments (none posted)

Reviews

A Microsoft guy tackles Linux (NewsForge)

NewsForge has an article from a Linux convert. "I am not especially a Linux advocate. I go with whatever software works best for me in terms of usefulness and feasibility. I'm Microsoft-certified, so persons meeting me classify me as The Microsoft Guy. However, thanks to the people I met at last month's Free, Libre and Open Source Conference, and guidance from the Trinidad and Tobago Linux Users' Group (TTLUG) mailing list, I have learned that free and open source applications are ready for mainstream use. Armed with my newfound knowledge, not only was it unbelievably easy to move from Windows XP to Red Hat Linux 9, I had fun doing it!"

Comments (none posted)

Survey: What Linux needs now (NewsForge)

Joe Barr looks at what Linux needs (according to a survey he ran) on NewsForge. "My biggest surprise came when I thought about what is not on the list. The great anti-Linux mantra is gone. It has disappeared. Not one of the more than 60 responses mentioned a need for easier installation of the operating system. Kudos to everyone who helped to make that happen."

Comments (3 posted)

OGo: No go so far (NewsForge)

This NewsForge article concludes that the recently announced OpenGroupware.org (OGo) software is not yet ready for the enterprise. "There is an important lesson to be learned here. It's one thing to announce the formation of a project and the release of code; it's another to announce that the software that will change the industry has arrived. Announcement of the project would have been greeted warmly, but there is no way anyone can claim that the software released on July 10 is actually usable by organizations. I wouldn't want to be in the shoes of someone who actually read the press release and downloaded the software with hopes of using the software in business. Someone like that might be slow to touch the project again after finding that the press release promises don't match the reality."

Comments (12 posted)

Miscellaneous

Linux Reconstructing Tree of Life (Wired)

Wired covers the use of a Linux cluster to figure out the relationships of thousands of species on the evolutionary tree. ""The computer project has certainly grown over the years, but the real innovations that made this possible are the concept of cluster computing and the Linux operating system," [biologist Ward] Wheeler added. "Linux makes it so easy to create a supercomputer."" (Thanks to "Fuzzy Gorilla")

Comments (none posted)

The Significance Of Open Source (Processor.com)

Russell Pavlicek begins a new bi-weekly column at Processor.com called "Open Source Perspective". In this first column he looks at the significance of open source. "Open source is not a gimmick. The world of IT is filled with buzzwords and trends. Those of us who have been around a while are used to seeing the ebb and flow of concepts in computing that sometimes resemble the fickle tastes of a fashion show runway more than they do the disciplines of logic and science. Like Visicalc skills on a resume, these supposedly "killer" technologies fade into oblivion in just a few short years. Open source is not one of these."

Comments (none posted)

Some Xbox Fans Microsoft Didn't Aim For

The NYTimes looks at XBox hackers. (Registration required) "It is unclear just how many Xbox hackers there are. Officials of the Interactive Digital Software Association, a trade group of video game publishers, said that Xbox hacking appeared more prevalent in parts of Asia than in North America. Michael Steil, a 24-year-old German who is project leader of a group that calls itself the Xbox Linux Project, said by e-mail that a full version of Linux software for the Xbox had been downloaded more than 220,000 times." (Thanks to Martin Leisner)

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

The Mozilla Foundation launches

A press release has gone out announcing the creation of the Mozilla Foundation, which will "promote the development, distribution and adoption of the award-winning Mozilla standards-based web applications and core technologies." The Foundation is starting off with a $2 million donation from AOL and $300,000 from Mitch Kapor, who will be the Foundation's chair. This move seems, at a first look, to be a good and necessary development for the Mozilla project. It does also, however, seem to represent the beginning of AOL's exit from the Mozilla development business.

Comments (3 posted)

PoPy and PygreSQL projects are merging! (ZopeMembers)

Zope Members News reports that the PyGreSQL and PoPy projects are merging. "The developers of PyGreSQL and PoPy are pleased to announce that they have decided to merge the two projects. It was felt that the two projects were alike in many ways but with different strengths which will allow them to create a more powerful product over all."

Comments (none posted)

Desktop Linux Technology and Market Overview

Mitch Kapor's Open Source Application Foundation just released a 34 page report (PDF format) on the Desktop Linux market, written by Bart Decrem. The paper concludes that Desktop Linux in no longer a technical challenge, it is a marketing challenge. (Thanks to David A. Wheeler)

Comments (none posted)

Commercial announcements

ERP5 and CPS form alliance to build a Global Information System

ERP5 and Collaborative Portal Server are partnering to offer the first open-source global information system, known as the Collaborative Portal Server (CPS).

Full Story (comments: none)

Analyst: embedded Linux costs more

A group called the Embedded Market Forecasters has announced a new white paper which, they say, shows that embedded Linux projects take much longer and cost way more than Windows projects. "The estimated average total cost of development for a Windows Embedded design project was $480,000, versus $1.5 million for an Embedded Linux project." Attempts to obtain the actual paper from their site end with a broken link, but we'll keep trying.

Comments (14 posted)

Qli Linux Computers Celebrates Lindependence Month

Qli Linux Computers is running a special promotion: Buy In July to register for your chance to receive your computer for free.

Full Story (comments: 1)

realMethods Open Sources Its J2EE Framework

realMethods has announced it is now part of the Open Source Initiative (OSI), making its commercially successful J2EE Framework available as open source under the GNU General Public License (GPL).

Comments (none posted)

New Books

"The Art of Assembly Language" from No Starch Press

No Starch Press has published "The Art of Assembly Language" by Randall Hyde.

Full Story (comments: none)

"Linux in a Nutshell, Fourth Edition" Released by O'Reilly

The fourth edition of Linux in a Nutshell by Ellen Siever, Stephen Figgins, and Aaron Weber (published by O'Reilly) has been released.

Full Story (comments: none)

Resources

An introduction to Thunderbird, part 2

Nidelven IT has published part two of An introduction to Thunderbird, which details the use of the Thunderbird Mail/News client.

Comments (2 posted)

Contests and Awards

Sangoma sponsors "Ultimate Linux Geek Contest"

Sangoma Technologies is sponsoring Linux Journal’s Search for the Ultimate Linux Geek. The winner gets a Cruise for two on Linux Lunacy to Alaska this September 13-20, 2003.

Full Story (comments: 3)

Linux Journal Awards Winners

Linux Journal has announced the winners of its Editors' Choice Awards. LWN.net is pleased to be named the winner of the Best Web Site award.

Comments (4 posted)

Awards at TPC (use Perl)

Use Perl has announced the winners of the Perl awards that were presented at OSCON.

Comments (none posted)

Event Reports

Danny O'Brien's OSCON report

Danny O'Brien's Oblomovka BLOG page covers the recent OSCON event. "The lightning talks worked very well at OSCON (and proved hilariously stereotypical : the Python talks were well-ordered to a Netherlandish extent, the Emerging Tech ones were largely performed by people with brightly died hair, and the Perl talks were even more ADHD than you'd imagine). At the end-of-conference press overview, Nat said he was going to go for lightning keynotes next year: 800 pundits in half-an-hour."

Comments (none posted)

Upcoming Events

ESC Boston 2003

The next Embedded Systems Conference will be held in Boston, Mass. on September 15-18, 2003. "ESC Boston's 70+ conference sessions will delve into hot design topics, including wireless, serial communications, Linux/Open Source, real-time development and software design. These sessions focus on delivering the technical insight necessary to make embedded system designs stronger, faster, and more reliable."

Full Story (comments: none)

LinuxWorld Conference & Expo UK rescheduled

The LinuxWorld Conference & Expo UK conference that was scheduled for September 3 and 4, 2003 has been rescheduled, tentatively for some time in 2004. Thanks to Daniel James.

Comments (none posted)

Plone Training in Bern, Switzerland August 21th 2003 (ZopeMembers)

According to ZopeMembers News, 4teamwork will be holding a Plone training day on August 21, 2003 in Bern, Switzerland.

Comments (none posted)

Web Days Europe Call for Submissions

A Call for Submissions has gone out for the Web Days Europe conference, which is taking place across Europe in September and October, 2003.

Full Story (comments: none)

Events: July 17 - September 11, 2003

Date	Event	Location
July 17, 2003	Debcamp	Oslo, Norway
July 18 - 20, 2003	Debconf 3	(The University of Oslo)Oslo, Norway
July 23 - 26, 2003	Ottawa Linux Symposium	Ottawa Canada
July 23 - 25, 2003	YAPC::Europe 2003	(CNAM Conservatory)Paris, France
July 25 - 27, 2003	Fifth Annual Linux Festival in Kaluga Region	(bank of the river Protva)Kaluga region, Russia
July 29 - August 2, 2003	The 10th Annual Tcl/Tk Conference	Ann Arbor, Michigan
July 31 - August 3, 2003	UKUUG Linux Developers' Conference(LINUX 2003)	(George Watson's College)Edinburgh Scotland
August 4 - 7, 2003	LinuxWorld Conference and Expo 2003	(Moscone Convention Center)San Francisco, CA
August 5 - 7, 2003	5th Annual CERT Conference(NEbraskaCERT)	(Scott Conference Center)Omaha, NE USA
August 7 - 10, 2003	Chaos Communication Camp 2003	Paulshof, Altlandsberg, Germany
August 18 - 21, 2003	New Security Paradigms Workshop 2003(NSPW 2003)	(Centro Stefano Francini)Ascona, Switzerland
August 23 - 25, 2003	KDE Developers' Conference	(Zamek Castle)Nove Hrady, Czech Republic
August 27 - 29, 2003	International Conference on Principles and Practice of Declarative Programming(PPDP 2003)	(Uppsala University)Uppsala, Sweden
September 3 - 4, 2003	LinuxWorld Conference & Expo (Cancelled)	(The NEC)Birmingham, UK
September 11 - 12, 2003	Python for Scientific Computing Workshop(SciPy'03)	(CalTech)Pasadena, CA

Comments (none posted)

Web sites

New www.perl.org (use Perl)

Use Perl has an announcement for the redesigned www.perl.org site, a Perl language portal.

Comments (none posted)

New Russian Zope'n'Python community-site (ZopeMembers)

Zope Members News has an announcement for a new Russian Zope community web site that is being beta tested. "We are glad to present new project for zope community. New Russian zope site xen|ru based on Zope and CMF."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook