Language Selection

English French German Italian Portuguese Spanish

Whoops: KDE fliccd Buffer Overflow Vulnerabilities

Filed under
KDE
Security

"Erik Sjölund has reported some vulnerabilities in KDE, which can be exploited by malicious, local users to gain escalated privileges and potentially by malicious people to compromise a vulnerable system."

"The vulnerabilities are caused due to boundary errors in fliccd and can be exploited to cause stack-based buffer overflows... in KDE 3.3 through 3.3.2."

Quoted.

No word from KDE on the subject as of yet.

More in Tux Machines

PostmarketOS update brings HDMI support for the PinePhone and PineTab

When the PinePhone postmarketOS Community Edition smartphone began shipping to customers in September it came with a version of the operating system with one important feature missing: HDMI output. So when my phone arrived a few weeks ago I was able to spend some time familiarizing myself with the operating system and I could plug in the included Convergence Dock to use USB accessories including a keyboard, mouse, and storage. But I wasn’t able to connect an external display. Now I can. Read more

today's howtos

  • How To Install Ubuntu 20.10 Groovy Gorilla

    This tutorial explains Ubuntu 20.10 Groovy Gorilla computer installation. You will prepare at least two disk partitions, finishing it all in about twenty minutes, and enjoy! Let's start right now.

  • How to install Ubuntu 20.10 - YouTube

    In this video, I am going to show how to install Ubuntu 20.10.

  • How To Install Webmin on Ubuntu 20.04 LTS - idroot

    In this tutorial we will show you how to install Webmin on Ubuntu 20.04 LTS, as well as some extra required packages by Webmin control panel

  • Running Ironic Standalone on RHEL | Adam Young’s Web Log

    This is only going to work if you have access to the OpenStack code. If you are not an OpenStack customer, you are going to need an evaluation entitlement. That is beyond the scope of this article.

  • Introduction to Ironic

    The sheer number of projects and problem domains covered by OpenStack was overwhelming. I never learned several of the other projects under the big tent. One project that is getting relevant to my day job is Ironic, the bare metal provisioning service. Here are my notes from spelunking the code.

  • Adding Nodes to Ironic

    TheJulia was kind enough to update the docs for Ironic to show me how to include IPMI information when creating nodes.

  • Secure NTP with NTS

    Many computers use the Network Time Protocol (NTP) to synchronize their system clocks over the internet. NTP is one of the few unsecured internet protocols still in common use. An attacker that can observe network traffic between a client and server can feed the client with bogus data and, depending on the client’s implementation and configuration, force it to set its system clock to any time and date. Some programs and services might not work if the client’s system clock is not accurate. For example, a web browser will not work correctly if the web servers’ certificates appear to be expired according to the client’s system clock. Use Network Time Security (NTS) to secure NTP. Fedora 331 is the first Fedora release to support NTS. NTS is a new authentication mechanism for NTP. It enables clients to verify that the packets they receive from the server have not been modified while in transit. The only thing an attacker can do when NTS is enabled is drop or delay packets. See RFC8915 for further details about NTS. NTP can be secured well with symmetric keys. Unfortunately, the server has to have a different key for each client and the keys have to be securely distributed. That might be practical with a private server on a local network, but it does not scale to a public server with millions of clients. NTS includes a Key Establishment (NTS-KE) protocol that automatically creates the encryption keys used between the server and its clients. It uses Transport Layer Security (TLS) on TCP port 4460. It is designed to scale to very large numbers of clients with a minimal impact on accuracy. The server does not need to keep any client-specific state. It provides clients with cookies, which are encrypted and contain the keys needed to authenticate the NTP packets. Privacy is one of the goals of NTS. The client gets a new cookie with each server response, so it doesn’t have to reuse cookies. This prevents passive observers from tracking clients migrating between networks.

  • Comfortable Motion: Absolutely Cursed Vim Scrolling - YouTube

    Have you ever felt like Vim was too useful and thought hey let's change that, well that's what this dev thought and now we have a plugin called comfortable motion that's adds physics based scrolling into vim, what's physics based scrolling you ask. Well it's scrolling that occurs based on how long you hold down the scroll key.

  • Running Cassandra on Fedora 32 | Adam Young’s Web Log

    This is not a tutorial. These are my running notes from getting Cassandra to run on Fedora 32. The debugging steps are interesting in their own right. I’ll provide a summary at the end for any sane enough not to read through the rest.

  • Recovering Audio off an Old Tape Using Audacity | Adam Young’s Web Log

    One of my fiorends wrote a bunch of music back in high school. The only remainig recordings are on a casette tape that he produced. Time has not been kind to the recordings, but they are audible…barely. He has a device that produces MP3s from the tape. My job has been to try and get them so that we can understand them well enough to recover the original songs. I have the combined recording on a single MP3. I’ve gone through and noted the times where each song starts and stops. I am going to go through the steps I’ve been using to go from that single long MP3 to an individual recording.

  • Role of Training and Certification at the Linux Foundation

    Open source allows anyone to dip their toes in the code, read up on the documentation, and learn everything on their own. That’s how most of us did it, but that’s just the first step. Those who want to have successful careers in building, maintaining, and managing IT infrastructures of companies need more structured hands-on learning with real-life experience. That’s where Linux Foundation’s Training and Certification unit enters the picture. It helps not only greenhorn developers but also members of the ecosystem who seek highly trained and certified engineers to manage their infrastructure. Swapnil Bhartiya sat down with Clyde Seepersad, SVP and GM of Training and Certification at the Linux Foundation, to learn more about the Foundation’s efforts to create a generation of qualified professionals.

  • Hetzner build machine

    This is part of a series of posts on compiling a custom version of Qt5 in order to develop for both amd64 and a Raspberry Pi. Building Qt5 takes a long time. The build server I was using had CPUs and RAM, but was very slow on I/O. I was very frustrated by that, and I started evaluating alternatives. I ended up setting up scripts to automatically provision a throwaway cloud server at Hetzner.

Leftovers: Debian, Graphics and Audiocasts

  • Integer Scaling To Come With Linux 5.11 For Intel Graphics Driver - Phoronix

    Going back more than a year there have been Intel "i915" kernel graphics driver patches implementing integer mode scaling support while finally for Linux 5.11 in early 2021 the support will have landed. Intel added integer mode scaling to their Windows graphics driver back in 2019 to provide better clarity when upscaling games (particularly pixel art type content) and other software. The Linux patches materialized in September 2019 for nearest-neighbor integer mode scaling and then seemingly forgotten about. The capability works with Gen11 / Ice Lake and newer.

  • Linux Support for Variable Refresh Rates On Gen12+ Intel GPUs Is On The Way - LinuxReviews

    Intel developer Manasi Navare has submitted a series of patches for the Linux kernel that brings support for variable refresh rates on Intel's latest graphics chips to the Linux kernels i915 driver. The feature is only enabled on Tiger Lake, Sapphire Rapids and newer Intel graphics chips. [...] You do not need a special "Freesync" monitor to use adaptive vertical synchronization, Freesync is just a marketing term used by AMD. The DisplayPort specification has included variable refresh rate (VRR) as an option feature since DP 1.4 and there are many monitors with support for it that are not marketed as "Freesync" or "gaming" monitors. Monitors that are marketed as "Freesync" support the standard DisplayPort VRR protocol so you don't need to use a AMD graphics card to get the benefits of a Freesync monitor. You will soon be able to use one of the very latest Intel CPU's with integrated graphics or one of Intel's upcoming dedicated graphics cards with Freesync monitors on Linux.

  • Salsa updated to GitLab 13.5

    Today, GitLab released the version 13.5 with several new features. Also Salsa got some changes applied to it. [...] It's been way over two years since we started to use Google Compute Engine (GCE) for Salsa. Since then, all the jobs running on the shared runners run within a n1-standard-1 instance, providing a fresh set of one vCPU and 3.75GB of RAM for each and every build. GCE supports several new instance types, featuring better and faster CPUs, including current AMD EPICs. However, as it turns out, GCE does not support any single vCPU instances for any of those types. So jobs in the future will use n2d-standard-2 for the time being, provinding two vCPUs and 8GB of RAM..

  • Social Media Regulation and Journalism

    Doc Searls, Katherine Druckman, and Petros Koutoupis talk social media regulation and its relationship to journalism and the threat to Section 230.

  • Automation Entropy Factor | Self-Hosted 30

    Chris gets left out in the cold after a Home Assistant glitch, and Alex puts a big batch of USB hard drives to the test Plus a great pick for you pack rats, feedback, and more.

  • Tribalism and Toxicity in the Linux Community - YouTube

    Gatekeeping, tribalism and toxicity in the Linux community. We're tired of it and it's time to silence it. But WHY does it happen, and HOW do we DEAL with it?

Oracle/Red Hat/Fedora Leftovers