Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

RPM 4.12 Brings New Switches, New Rpm2Archive Utility

RPM 4.12 has been released as the latest version of the RPM Package Manager. This most recent upgrade brings a fair amount of additions, bug-fixes, API changes, binding improvements,a new plug-in system, and more. First up, RPM 4.12 brings a host of new command-line switches: --nopretrans, --noposttrans, --noplugins, --reinstall, --exportdb, --importdb, --recommends, --suggests, --supplements, and --enhances. RPM 4.12 also brings a rpm2archive utility for converting RPM payloads into tar archives. Read more

Qt Creator 3.2.1 released

We are happy to announce Qt Creator 3.2.1. This release contains a range of bugfixes, including fixes for: a freeze when using the current project or the all projects locator filters via keyboard shortcut a deployment error in the OS X packages which led to the Clang code model plugin not loading a crash when opening the context menu on C++ macro parameters For a full list of fixes, please see our change log. Read more

GNOME Control Center 3.14 RC1 Corrects Lots of Potential Crashes

GNOME Control Center, GNOME's main interface for the configuration of various aspects of your desktop, has been updated to version 3.14 RC1, along with a lot of the packages from the GNOME stack. Read more

Rust Developers Planning For The Rust 1.0 Language

Rust, the general purpose, safe, and concurrent programming language developed by Mozilla Research, is starting to assemble their vision of Rust 1.0. A new post on the Rust Programming Language Blog is laying out the path to Rust 1.0. The developers hope to move to Rust 1.0 soon with a beta coming out hopefully by the end of the year and the official release to follow. This Rust 1.0 milestone is to signify the Rust design "feeling right" and a promise to maintain backwards compatibility for future 1.x releases. Read more