Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Android Leftovers

GNOME 3.28 Linux Desktop Environment Development Kicks Off with First Snapshot

GNOME developer Javier Jardón is kicking off the development of the GNOME 3.28 desktop environment with the first snapshot, GNOME 3.27.1, which is now available for public testing. Read more

How to manage casual contributors to open source projects

Increasingly, people want to contribute to projects casually—when they want to, rather than adhering to a schedule. This is part of a broader trend of "episodic volunteering" noted by a wide range of volunteer organizations and governments. This has been attributed not only to changes in the workforce, which leave fewer people able to volunteer with less spare time to share, but also to changes in how people perceive the act of volunteering. It is no longer seen as a communal obligation, rather as a conditional activity in which the volunteer also receives benefits. Moreover, distributed revision-control systems and the network effects of GitHub, which standardize the process of making a contribution, make it easier for people to contribute casually to free/libre/open source software (FLOSS) projects. Read more

5 ways to invigorate education with Raspberry Pi

A couple of years ago, I was talking to PayPal senior director of software development Harper Reed at All Things Open in Raleigh, N.C., when he suggested that the best way to invigorate education would be to purchase Raspberry Pis en masse and put them in public libraries. Although many schools have made sizeable investments in classroom technology, those investments have done little to advance students' understanding of how the technology works. That's where the Raspberry Pi comes in, as it's the ideal vehicle to demonstrate the educational efficacy of open source software and open hardware in the classroom. Read more