Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Leftovers: Software

  • Flowblade Video Editor 1.12 Released, Adds 2 New Tools
    A shiny new version of open-source video editor Flowblade is available for download. Flowblade 1.12 introduces a pair of new tools. Progress has also been made towards creating a distribution agnostic .AppImage, though, alas, there are still kinks to be ironed out so you won’t find an app image of the current release.
  • Vivaldi 1.8 Web Browser Launch Imminent As First Release Candidate Is Out
    Vivaldi's Ruarí Ødegaard announced today, March 24, 2017, the release and immediate availability of the first Release Candidate of the forthcoming Vivaldi 1.8 web browser for all supported platforms. Dubbed as Vivaldi Snapshot 1.8.770.44, the Release Candidate of Vivaldi 1.8 is here to fix some last-minute bugs for the new History feature, which is the star of the new upcoming web browser release based on the latest Chromium 57 open-source project, as well as to improve the user interface zoom functionality.
  • Epiphany 3.24 Web Browser Has New Bookmarks UI, Improves Tracking Protection
    GNOME 3.24 arrived a couple of days ago, and it's the biggest release of the popular desktop environment so far, shipping with lots of new features and improvements across all of its applications and components. During its 6-month development cycle, we managed to cover all the major features implemented in the GNOME 3.24 desktop environment, but also the various improvements included in many of the apps that are usually distributed under the GNOME Stack umbrella.
  • Firefox Sync Support Is Coming to GNOME Web
    GNOME Web (aka the browser formerly known as Epiphany) is working to add Firefox Sync support, letting users keep bookmarks, history and open-tabs in sync across devices.

Games and CrossOver

Red Hat and Fedora

Android Leftovers