openSUSE has updated ctdb (Leap42.1, 13.2: privilege escalation), libtorrent-rasterbar (Leap42.1, 13.2: denial of service), ntp (Leap42.1: multiple vulnerabilities), and kernel (Leap42.1: multiple vulnerabilities).
Red Hat has updated chromium-browser (RHEL6: multiple vulnerabilities).
Ubuntu has updated dnsmasq (16.04, 15.10: denial of service), expat (two vulnerabilities), haproxy (16.04: denial of service), spice (16.04, 15.10, 14.04: two vulnerabilities), wget (code execution), and xmlrpc-c (12.04: multiple vulnerabilities).
Debian has updated libxslt (three vulnerabilities).
Fedora has updated expat (F23: multiple vulnerabilities), GraphicsMagick (F23; F22: multiple vulnerabilities), iperf3 (F23; F22: denial of service), sudo (F22: information leak), and wget (F22: code execution).
Scientific Linux has updated ImageMagick (SL6,7: multiple vulnerabilities).
The 4.7-rc4 prepatch is now available for testing. Linus Torvalds said that it is "pretty small" with "nothing particularly worrisome". The development cycle proceeds apace with the usual sorts of changes: "The statistics look very normal: about two thirds drivers, with the rest being half architecture updates and half "misc" (small filesystem updates,. some documentation, and a smattering of patches elsewhere)."
Those concerned about the proliferation of application-packaging formats will soon have one fewer to worry about. At his blog, Matthias Klumpp announces that he intends to scale back his work on Limba, the cross-distribution application-packaging format he has developed as an extension of the ideas in the earlier Listaller. The decision comes on the heels of discussions with Flatpak developer Alexander Larsson, since the two projects overlap in many respects: "Alex and I had very productive discussions, and except for the modularity issue, we were pretty much on the same page in every other aspect regarding the sandboxing and app-distribution matters."
Given that he has several other active projects in development, Klumpp has decided to throttle back on Limba, although he will continue to hack on it "as a research project" and sees several opportunities where it might still fit into vendor-independent software distribution down the road. "This is good news for all the people out there using the Tanglu Linux distribution, AppStream-metadata-consuming services, PackageKit on Debian, etc. – those will receive more attention," Klumpp concludes.
Debian has updated drupal7 (privilege escalation).
openSUSE has updated wireshark (13.2, Leap 42.1: multiple vulnerabilities).
Scientific Linux has updated firefox (SL 5,6,7: multiple vulnerabilities), kernel (SL6: multiple vulnerabilities), ntp (SL 6,7: multiple vulnerabilities), spice-server (SL6: multiple vulnerabilities), squid (SL6: multiple vulnerabilities), and squid34 (SL6: multiple vulnerabilities).
Debian has updated icedove (code execution).
Debian-LTS has updated libav (code execution).
Red Hat has updated kernel (RHEL6.5: two remote denial of service vulnerabilities).