Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Firefox OS media-casting stick strikes Kickstarter gold

The first Firefox OS based media player has arrived on Kickstarter, in the form of a $25 open-spec HDMI stick that supports Chromecast-like content casting. The Matchstick, which has already zoomed past its Kickstarter campaign’s $100,000 funding goal, with 28 days still remaining, was teased back in June by Mozilla developer evangelist Christian Heilmann. The unnamed prototype was billed as an open source HDMI stick that runs Mozilla’s Linux-based Firefox OS and offers casting capabilities. Few details were revealed at the time except that the device used the same DIAL (DIscovery And Launch) media-casting protocol created by Netflix and popularized by Google’s Chromecast. Read more

Open source history, present day, and licensing

Looking at open source softwares particularly, this is a fact that is probably useful to you if you are thinking about business models, many people don't care about it anymore. We talk about FOSS, Free and Open Source Software, but if we really are strict there's a difference between free software and open source software. On the left, I have free software which most typically is GPL software. Software where the license insures freedom. It gives freedoms to you as a user, but it also requires that the freedoms are maintained. On the right-hand side, you have open source software which is open for all, but it also allows you to close it. So here we come back to the famous clause of the GPL license, the reciprocity requirement which says, "If I am open, you need to be open." So software that comes under the GPL license carries with it something that other people call a virus. I call it a blessing because I think it's great if all software becomes open. Read more

Leftovers: Software

Proprietary

today's howtos