Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Writer on Linux philosopy opens up

My favorite distributions are Fedora for my main workstation, laptop, and netbook. I generally use Centos for servers and firewalls. I have tried other distributions, but I prefer the Red Hat related ones because I started out with Red Hat 17 years ago, and I worked as a trainer for Red Hat for a while. It is what I know best. I also use Centos and, to a lesser extent, Fedora for teaching the classes I have written myself for the training portion of my business. I use LibreOffice Writer for writing documents like this article and the class lab projects, and I also keep records of the work I do for my customers; sort of a log of my activities. I use LibreOffice Calc for creating invoices, LibreOffice Impress for presentations, and GnuCash for my personal and business accounting needs. Thunderbird and Firefox provide for email and Internet browsing, respectively. I have added a few plugins to each to expand their capabilities to better meet my personal and business needs. For example, I use the Lightning calendar extension for Thunderbird and a Google extension to keep my calendar synchronized on multiple devices. Read more

Q4OS Is an Interesting Windows Clone and Linux Distro at the Same Time

Q4OS is a Linux operating system that implements a desktop environment that is very similar with the older Windows versions. The developer have just released a new update and they are now much closer to a much stable release. Read more

New Releases

Here’s How to Create the Perfect Ubuntu Origami Unicorn - Video

After announcing last week the Ubuntu Origami Unicorn contest, which can bring an awesome new BQ Aquaris E4.5 Ubuntu Edition phone to a user that folds the best-looking Unicorn, today Canonical decided that it’s finally time to show the world how to make the perfect origami unicorn. Read more Also: Canonical Eyes Telecom, NFV Innovation with Ericsson Cloud Partnership