lwn.net

lwn.net 피드 구독하기
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
업데이트: 1시간 10분 지남

Security advisories for Tuesday

3시간 32분 지남

Arch Linux has updated python-crypto (code execution) and python2-crypto (code execution).

CentOS has updated bind (C7; C6; C5: denial of service) and bind97 (C5: denial of service).

Debian-LTS has updated pdns-recursor (code execution).

Fedora has updated bind (F24: three denial of service flaws), bind99 (F24: three denial of service flaws), and SimGear (F25: file overwrites).

Gentoo has updated file (multiple vulnerabilities), libxml2 (multiple vulnerabilities), miniupnpc (denial of service), pidgin (multiple vulnerabilities), vlc (code execution), and xdelta (code execution).

openSUSE has updated ark (42.2, 42.1; SPH for SLE12: code execution), encfs (42.2, 42.1, 13.2: code execution from 2014), gstreamer-0_10-plugins-bad (13.2: code execution), gstreamer-0_10-plugins-base (13.2: code execution), gstreamer-0_10-plugins-good (13.2: multiple vulnerabilities), gstreamer-plugins-bad (42.1; 13.2: three vulnerabilities), gstreamer-plugins-base (42.1; 13.2: code execution), gstreamer-plugins-good (42.1; 13.2: multiple vulnerabilities), icinga (14.2, 14.1: two vulnerabilities), icoutils (42.2; 42.1; 13.2: multiple vulnerabilities), openjpeg2 (42.2: multiple vulnerabilities), pcsc-lite (42.2, 42.1, 13.2: privilege escalation), and python-pycrypto (14.2, 14.1, 13.2: denial of service).

Oracle has updated bind (OL7; OL6; OL5: denial of service), bind97 (OL5: denial of service), and docker-engine docker-engine-selinux (OL7; OL6: two vulnerabilities).

Red Hat has updated kernel (RHEL6.5: code execution).

Scientific Linux has updated bind (SL7; SL5,6: denial of service) and bind97 (SL5: denial of service).

카테고리:

[$] The Machine: Controlling storage with a filesystem

화, 2017/01/17 - 10:58오전
Keith Packard is the chief architect for The Machine project at HPE; we covered his talk on this project back in 2015. At the 2017 linux.conf.au Kernel Miniconf, Packard focused on one specific aspect of The Machine's hardware and software configuration: how storage is managed and presented to applications. Like much that is being done with this project, its storage architecture is an interesting combination of new ideas and long-established techniques.
카테고리:

Prokoudine: GIMP 2016 in review

화, 2017/01/17 - 8:37오전
Alexandre Prokoudine looks at user-visible changes for the GNU Image Manipulation Program (GIMP) over 2016. Changes include better handling of layers, channels, masks, and paths, remembering defaults across sessions, improved configurability, color management, and more.
카테고리:

Calligra 3.0 released

화, 2017/01/17 - 7:00오전
Calligra 3.0 has been released. The Calligra Suite includes office, graphics, and project management applications. "We have chosen to cut back on the number of applications. Krita has left us to be independent and although it was emotional it was also done with complete support from both sides. We are saying goodbye to Author, which never differentiated itself from Words. We also removed Brainstorm the purpose of which will be better fitted by a new application (nothing planned from our side). Flow and Stage has gone in this release but we intend to bring them back in the future." The 3.x series updates the applications to use KDE Frameworks 5 and Qt5.
카테고리:

The Linux Test Project has been released

화, 2017/01/17 - 4:27오전
The Linux Test Project test suite stable release for January 2017 is out. There are new test cases, a new shell test library and many tests rewritten to make use of it, and much more. LWN looked at LTP last December.
카테고리:

Monday's security updates

화, 2017/01/17 - 2:44오전

Arch Linux has updated libgit2 (multiple vulnerabilities), nginx (privilege escalation), nginx-mainline (privilege escalation), and wordpress (multiple vulnerabilities).

Debian has updated icoutils (three vulnerabilities), pdns (multiple vulnerabilities), pdns-recursor (denial of service), python-bottle (regression in previous update), and tiff (multiple vulnerabilities).

Debian-LTS has updated botan1.10 (integer overflow), gcc-mozilla (update to GCC 4.8), icedove (multiple vulnerabilities), libx11 (denial of service), otrs2 (code execution), python-bottle (regression in previous update), wireless-regdb (radio regulations updates), and xen (two vulnerabilities).

Fedora has updated bind (F25: three denial of service flaws), bind99 (F25: three denial of service flaws), ca-certificates (F25; F24: certificate update), docker-latest (F25: privilege escalation), gnutls (F24: multiple vulnerabilities), libgit2 (F25: multiple vulnerabilities), and onionshare (F25; F24: file injection).

Gentoo has updated apache (multiple vulnerabilities, one from 2014).

Mageia has updated golang (denial of service) and irssi (multiple vulnerabilities).

Red Hat has updated bind (RHEL7; RHEL5,6: denial of service) and bind97 (RHEL5: denial of service).

Scientific Linux has updated java-1.6.0-openjdk (SL5,6,7: multiple vulnerabilities).

SUSE has updated qemu (SLE12-SP2: multiple vulnerabilities).

카테고리:

Kernel prepatch 4.10-rc4

월, 2017/01/16 - 10:52오전
The 4.10-rc4 kernel prepatch is out for testing. "Things are still looking fairly normal, and this is the usual weekly Sunday rc release. We're up to rc4, and people are clearly starting to find the regressions. Good, good."
카테고리:

Stable kernels 4.9.4 and 4.4.43

월, 2017/01/16 - 6:22오전
The 4.9.4 and 4.4.43 stable kernel updates are available; each contains a relatively large set of important fixes.
카테고리:

Google Infrastructure Security Design Overview

일, 2017/01/15 - 12:46오전
Google has posted an overview of its infrastructure security. It includes information about low-level details, such as physical security and secure boot, encryption of data at rest as well as communications between services and to users, keeping employee devices and credentials safe, and more. Undoubtedly there are lessons here for many different organizations. "This document gives an overview of how security is designed into Google’s technical infrastructure. This global scale infrastructure is designed to provide security through the entire information processing lifecycle at Google. This infrastructure provides secure deployment of services, secure storage of data with end user privacy safeguards, secure communications between services, secure and private communication with customers over the internet, and safe operation by administrators. Google uses this infrastructure to build its internet services, including both consumer services such as Search, Gmail, and Photos, and enterprise services such as G Suite and Google Cloud Platform."
카테고리:

Quantum Computing Is Real, and D-Wave Just Open-Sourced It (Wired)

토, 2017/01/14 - 6:12오전
Wired covers the release of Qbsolv as open-source software (under the Apache License v2) by D-Wave, which is a company that makes quantum computing hardware. Qbsolv is "designed to help developers program D-Wave machines without needing a background in quantum physics". Further: Qbsolv joins a small but growing pool of tools for would-be quantum computer programmers. Last year Scott Pakin of Los Alamos National Laboratory–and one of Qbsolv’s first users–released another free tool called Qmasm, which also eases the burden of writing code for D-Wave machines by freeing developers from having to worry about addressing the underlying hardware. The goal, Ewald says, is to kickstart a quantum computing software tools ecosystem and foster a community of developers working on quantum computing problems. In recent years, open source software has been the best way to build communities of both independent developers and big corporate contributors.

Of course to actually run the software you create with these tools, you’ll need access to one of the very few existing D-Wave machines. In the meantime, you can download a D-Wave simulator that will let you test the software on your own computer. Obviously this won’t be the same as running it on a piece of hardware that uses real quantum particles, but it’s a start.

카테고리:

Security advisories for Friday

토, 2017/01/14 - 2:03오전

Arch Linux has updated ark (code execution), bind (multiple vulnerabilities), docker (privilege escalation), flashplugin (multiple vulnerabilities), irssi (multiple vulnerabilities), lib32-flashplugin (multiple vulnerabilities), and libvncserver (two vulnerabilities).

CentOS has updated java-1.6.0-openjdk (C7; C6; C5: multiple vulnerabilities) and kernel (three vulnerabilities).

Debian has updated rabbitmq-server (authentication bypass).

Debian-LTS has updated asterisk (two vulnerabilities, one from 2014).

Fedora has updated docker (F25: privilege escalation), libgit2 (F24: multiple vulnerabilities), and pcsc-lite (F24: privilege escalation).

Gentoo has updated postgresql (multiple vulnerabilities, two from 2015), runc (privilege escalation), and seamonkey (multiple vulnerabilities).

Mageia has updated flash-player-plugin (multiple vulnerabilities), php-ZendFramework2 (parameter injection), unzip (two vulnerabilities, one from 2014), and webmin (largely unspecified).

Oracle has updated java-1.6.0-openjdk (OL7; OL6; OL5: multiple vulnerabilities) kernel 2.6.39 (OL6; OL5:multiple vulnerabilities), kernel 3.8.13 (OL7; OL6: multiple vulnerabilities), and kernel 4.1.12 (OL7; OL6: multiple vulnerabilities).

Red Hat has updated java-1.6.0-openjdk (multiple vulnerabilities).

Scientific Linux has updated kernel (SL6: three vulnerabilities).

카테고리:

Masnick: Techdirt's First Amendment Fight For Its Life

금, 2017/01/13 - 7:45오전
Over at Techdirt, Mike Masnick writes about a libel suit filed against the site: "As you may have heard, last week we were sued for $15 million by Shiva Ayyadurai, who claims to have invented email. We have written, at great length, about his claims and our opinion — backed up by detailed and thorough evidence — that email existed long before Ayyadurai created any software. We believe the legal claims in the lawsuit are meritless, and we intend to fight them and to win. There is a larger point here. Defamation claims like this can force independent media companies to capitulate and shut down due to mounting legal costs. Ayyadurai's attorney, Charles Harder, has already shown that this model can lead to exactly that result. His efforts helped put a much larger and much more well-resourced company than Techdirt completely out of business."
카테고리:

The 4.9.3 and 4.4.42 stable kernels have been released

금, 2017/01/13 - 4:38오전
Greg Kroah-Hartman has announced the release of the 4.9.3 and 4.4.42 stable kernels. As usual, there are fixes throughout the tree and users of those kernel series should upgrade.
카테고리:

Thursday's security updates

금, 2017/01/13 - 3:26오전

Debian has updated bind9 (three vulnerabilities), ikiwiki (three vulnerabilities), and python-pysaml2 (XML external entity attack).

Debian-LTS has updated libav (two vulnerabilities).

Fedora has updated compat-guile18 (F25; F24: insecure directory creation), mingw-flac (F25: three vulnerabilities from 2015), qpid-java (F25: information disclosure), and springframework-security (F25: security constraint bypass).

openSUSE has updated flash-player (13.2: multiple vulnerabilities).

Red Hat has updated memcached (RHMAP4.2: two vulnerabilities).

Slackware has updated bind (denial of service), gnutls (multiple vulnerabilities), and irssi (multiple vulnerabilities).

SUSE has updated bind (SLE12-SP2,SP1; SLE12; SLE11-SP4,SP3: three vulnerabilities) and flash-player (SLE12-SP1: multiple vulnerabilities).

Ubuntu has updated bind9 (three vulnerabilities) and libvncserver (two vulnerabilities).

카테고리:

[$] LWN.net Weekly Edition for January 12, 2017

목, 2017/01/12 - 11:18오전
The LWN.net Weekly Edition for January 12, 2017 is available.
카테고리:

CVE-2016-9587: an unpleasant Ansible vulnerability

목, 2017/01/12 - 8:03오전
The Ansible project is currently posting release candidates for the 2.1.4 and 2.2.1 releases. They fix an important security bug: "CVE-2016-9587 is rated as HIGH in risk, as a compromised remote system being managed via Ansible can lead to commands being run on the Ansible controller (as the user running the ansible or ansible-playbook command)." Until this release is made, it would make sense to be especially careful about running Ansible against systems that might have been compromised.
카테고리:

[$] Python 2.8?

목, 2017/01/12 - 3:11오전

The appearance of a "Python 2.8" got the attention of the Python core developers in early December. It is based on Python 2.7, with features backported from Python 3.x. In general, there was little support for the effort—core developers tend to clearly see Python 3 as the way forward—but no opposition to it either. The Python license makes it clear that these kinds of efforts are legal and even encouraged—any real opposition to the project lies in its name.

Subscribers can click below for the full article from this week's edition.

카테고리:

Security updates for Wednesday

목, 2017/01/12 - 2:37오전

Debian has updated icedove (multiple vulnerabilities).

Debian-LTS has updated tomcat7 (information disclosure).

Gentoo has updated bind (denial of service), botan (two vulnerabilities), c-ares (code execution), dbus (denial of service), expat (multiple vulnerabilities, one from 2012), flex (code execution), nginx (privilege escalation), ntfs3g (privilege escalation from 2015), p7zip (two code execution flaws), pgbouncer (two vulnerabilities), phpBB (two vulnerabilities), phpmyadmin (multiple vulnerabilities), vim (code execution), and vzctl (insecure ploop-based containers from 2015).

openSUSE has updated jasper (42.2, 42.1: multiple vulnerabilities).

Oracle has updated kernel (OL6: three vulnerabilities).

Red Hat has updated flash-plugin (RHEL6: multiple vulnerabilities), kernel (RHEL6.7: code execution), and kernel (RHEL6: three vulnerabilities).

SUSE has updated freeradius-server (SLE12-SP1,2: insufficient certificate verification) and LibVNCServer (SLE11-SP4: two vulnerabilities).

Ubuntu has updated kernel (16.10; 16.04; 14.04; 12.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiple vulnerabilities), linux-lts-xenial (14.04: three vulnerabilities), linux-raspi2 (16.10; 16.04: two vulnerabilities), linux-snapdragon (16.04: two vulnerabilities), linux-ti-omap4 (12.04: two vulnerabilities), and webkit2gtk (16.04: multiple vulnerabilities).

카테고리:

Kadlec: The MongoDB hack and the importance of secure defaults

목, 2017/01/12 - 2:09오전
Tim Kadlec looks at the ongoing MongoDB compromises and how they came to be. "Before version 2.6.0, that wasn’t true. By default, MongoDB was left open to remote connections. Authentication is also not required by default, which means that out of the box installs of MongoDB before version 2.6.0 happily accept unauthenticated remote connections."
카테고리:

digiKam 5.4.0 is released

수, 2017/01/11 - 2:45오전
The digiKam team has announced the release of version 5.4.0 of the digiKam Software Collection. "This version introduces several improvements to the similarity search engine and a complete re-write of video file support." Under the hood, digiKam has been fully ported to the QtAV framework to handle video and audio files.
카테고리:

페이지