Brief items

MITRE Warns CVE Program Faces Disruption (Security Week)

Security Week is one of several outlets reporting that the funding for the CVE program at MITRE disappears as of April 16.

Maintained by MITRE Corporation, a not-for-profit organization that operates federal R&D centers, the CVE program is funded through multiple channels, including the U.S. government, industry partnerships, and international organizations.

Earlier this month, in anticipation of the US government funding cuts, MITRE initiated layoffs that affected more than 400 employees in its Virginia office. The cuts were ordered after the Trump administration announced more than $28 million in canceled contracts for the company.

Comments (41 posted)

CISA extends funding to the CVE program (BleepingComputer)

Sergiu Gatlan reports that the US government has extended funding for the Common Vulnerabilities and Exposures (CVE) program, following yesterday's reports that funding would run out as of April 16.

"The CVE Program is invaluable to cyber community and a priority of CISA," the U.S. cybersecurity agency told BleepingComputer. "Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners' and stakeholders' patience."

The article also mentions the launch of a CVE Foundation, to transition the CVE program to a dedicated foundation and eliminate "a single point of failure in the vulnerability management ecosystem", as well as a European vulnerability database (EUVD) backed by the European Union Agency for Cybersecurity (ENISA). Details on these initiatives are scant at the moment, and it is unclear whether restoration of funding will have any impact on these efforts.

Comments (3 posted)

Catanzaro: Dangerous arbitrary file read vulnerability in Yelp

GNOME contributor Michael Catanzaro has written a blog post about a noteworthy vulnerability in GNOME's help browser, Yelp.

I don't normally blog about particular CVEs, but Yelp CVE-2025-3155 is noteworthy because it is quite severe, public for several weeks now, and not yet fixed upstream. In short, help files can read your filesystem and execute arbitrary JavaScript code, allowing an attacker to exfiltrate any files your Unix user has access to.

The vulnerability was first reported on December 25, and it was made public on March 26 after the 90-day-disclosure deadline was reached. Patches have been proposed to fix the issue. The bug reporter has published a writeup demonstrating the attack. Catanzaro asks that Linux vendors "please consider applying the provided patches even though they have not yet been accepted upstream".

Comments (33 posted)

Security quotes of the week

The #CyberSecurity community is just (re-)learning the concept of a Single Point of Failure. Let's hope that a more decentralized way of sharing security knowledge will arise, that does not depend on a single company, nation or organisation.

— Florian Schmidt

Probably the last CVE indexed before it goes dark should be CVE-2025-DOGE (critical, local privilege escalation vulnerability that leads to malicious code execution and data exfiltration).

— Brian Krebs

Comments (none posted)

Kernel release status

The current development kernel is 6.15-rc2, released on April 13. Linus said: "Nothing particularly stands out to me, but it's early in the release yet, so let's see how it goes."

Stable updates: 6.14.2, 6.13.11, 6.12.23, 6.6.87, 6.1.134, 5.15.180, 5.10.236, and 5.4.292 were released on April 10.

Comments (none posted)

Quote of the week

Given the news of the potential disruption of the CVE main server, I've reserved 1000 or so ids for the kernel now, which should last us a few weeks.

— Greg Kroah-Hartman

Comments (none posted)

Fedora Linux 42 released (Fedora Magazine)

The Fedora Project has announced the release of Fedora Linux 42, with "what's new" articles for Fedora Workstation and Fedora KDE Plasma Desktop. There is also a last-minute warning about the live media for the release:

We discovered a problem with the Live boot media at the last minute, and since the release was already out of the airlock, we can't do much about it. It doesn't damage anything, but is annoying: just booting the Live media adds an unexpected entry to the UEFI boot loader even when Fedora Linux 42 is not installed to the local system.

This is primarily a concern when you are dual-booting with a different operating system, or if you're just running the Live image and not intending to actually install.

See the release notes for more information, and LWN's coverage of Fedora 42.

Comments (none posted)

Manjaro Linux 25.0 released

Version 25.0 ("Zetar") of the Arch-based Manjaro Linux distribution is now available. This release includes Linux kernel 6.12, GNOME 48, KDE 6.3, Xfce 4.18, and more.

Comments (none posted)

Distribution quotes of the week

Can we just stop building for i686 in Fedora in general, instead of burning maintainer time figuring out deps problems like this... ? What's the blocker and how much longer do we have to put up with its burden in Fedora ?

— Daniel P. Berrangé

Let's agree that anything we cannot fix also cannot be a blocker. Third-party proprietary software has had two decades to figure this [transition to 64-bit] out. That's more than long enough.

— Michael Catanzaro

Debian isn't a government: We don't have prisons, people with guns, weapons of war, or the ability to force anyone to live under our rules. We are a volunteer association, which means the final backstop for any decision made in Debian is that Debian has to retain its volunteers or it will cease to exist. The constitution is there to help us make decisions that are sufficiently supported by the community of volunteers that make up the project such that the project doesn't fall apart. It doesn't need the rigor of a parliament or court system.

— Russ Allbery

I think this is because there's a substantial contingent in Debian who "hate politics". They see us "doing politics" and dislike us for it. They think think Debian can avoid politics (spoiler: it's a project of thousands of humans, we can't) and therefore they think the drama is the fault of whoever is complaining.

In these circumstances it is hardly surprising that we have some teams that are well-known to be dysfunctional and toxic, but which nothing is ever done about. Anyone who tries to take them on gets punished, because taking on toxicity is by definition political.

I wish we could get *better* at doing politics. If we did it better, we would have much a nicer environment *and* we would probably spend a lot less emotional energy on the politics, overall.

— Ian Jackson

Comments (6 posted)

Malcolm: 6 usability improvements in GCC 15

Over on the Red Hat Developer site, David Malcolm has an article about improvements in GCC 15, specifically focusing on the diagnostic information that the compiler emits. This includes ASCII art with a "⚠️" warning emoji to display the execution path when it detects a problem (like an infinite loop in one of his examples), better C++ template errors, machine-readable diagnostics using Static Analysis Results Interchange Format (SARIF), better messages regarding C23 compatibility since that is the default C version for GCC 15, and more. Since the changes are focused on messages, there is the inevitable color-scheme update as well:

GCC will use color when emitting its text messages on stderr at a suitably modern terminal, using a few colors that seem to work well in a number of different terminal themes—but the exact rules for choosing which color to use for each aspect of the output have been rather arbitrary.

For GCC 15, I've gone through C and C++'s errors, looking for places where two different things in the source are being contrasted, such as type mismatches. These diagnostics now use color to visually highlight and distinguish the differences.

Comments (26 posted)

Pinta 3.0 released

Version 3.0 of the Pinta image editor has been released. The most notable change in this release is that Pinta has been ported to GTK 4.0 and libadwaita. It also includes a number of improvements, new effects, and bug fixes.

Comments (2 posted)