openSUSE has updated curl (13.1, 12.3: two cookie-handling vulnerabilities).
Oracle has updated automake (OL5: code execution from 2012), bind97 (OL5: three vulnerabilities, two from 2013), conga (OL5: multiple vulnerabilities some going back to 2012), krb5 (OL5: code execution), krb5 (OL5: multiple vulnerabilities, two from 2013), and nss, nspr (multiple vulnerabilities, one from 2013).
SUSE has updated squid3 (SLE11SP3: denial of service).
Click below (subscribers only) for the full report from LinuxCon North
Red Hat has updated krb5 (RHEL5: code execution).
The OpenSSL project is widely known due to its broad adoption as the SSL/TLS library of choice for open-source software—though, in April, it also became widely known because of a particularly vicious security vulnerability. To a large degree, the project weathered the storm, but the project has also undertaken some changes in the wake of the incident. The most recent is the adoption of a public security policy describing how issues of various kinds will be dealt with.
openSUSE has updated php5 (13.1, 12.3: multiple vulnerabilities), ppp (13.1, 12.3: privilege escalation), python-django (13.1, 12.3: multiple vulnerabilities), and flash-player (11.4: multiple vulnerabilities).
Red Hat has updated automake (RHEL5: code execution), bind97 (RHEL5: denial of service), conga (RHEL5: multiple vulnerabilities), krb5 (RHEL5: multiple vulnerabilities), and nss, nspr (RHEL5: multiple vulnerabilities).
Scientific Linux has updated axis (SL5&6: SSL hostname verification bypass).
Ubuntu has updated python-django (multiple vulnerabilities).
Mageia has updated dump (denial of service/possible code execution), glibc (two vulnerabilities), libgadu (missing ssl certificate validation), mariadb (code execution), and moodle (two vulnerabilities).
openSUSE has updated LibreOffice (13.1, 12.3: two vulnerabilities).
Ubuntu has updated curl (two cookie-handling vulnerabilities).
At his blog, Matthias Klumpp provides an update on recent work in Listaller, the cross-distribution framework for third-party package installation. The core issue is that Listaller currently relies on PackageKit's plugin infrastructure, which is going away. As a result, Klumpp has started work on a substantial rewrite of Listaller that will integrate with AppStream and other up-to-date tools. He is also, notably, taking this opportunity to trim down the project in other respects: "The new incarnation of Listaller will only support installations of statically linked software at the beginning. We will start with a very small, robust core, and then add more features (like dependency-solving) gradually, but only if they are useful. There will be no feature-creep like in the previous version."