Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Debian Finally Moves to GCC 5

Ubuntu and Debian developers have been working for some time to make GCC 5.x the default compiler for the project, and they have finally made it. Ubuntu was the first one to achieve this, and now it looks like Debian has joined the party as well. Read more

Open source Chromecast competitor, Matchstick, is dead

Nearly a year ago, Matchstick hit Kickstarter with the goal of bringing a more open HDMI dongle to challenge the likes of the Chromecast and Fire TV Stick. Today, however, its creators made a painful revelation. They’re not going to be able to deliver a satisfactory product, and that means around 17,000 backers won’t be getting their hands on the Firefox OS-based Matchsticks they were hoping for when they pledged their support to the project last fall. Read more

Lockheed Open Sources Its Secret Weapon In Cyber Threat Detection

The cybersecurity team at Lockheed Martin will share some defensive firepower with the security community at Black Hat this week with the open source release of an internal advance threat tool it has been using in house for three years now. Dubbed Laika BOSS, this malware detection platform is meant to help security analysts better hunt down malicious files and activity in an enterprise environment. Read more

Bodhi Linux 3.1.0 Pre Invites Users to Test the New Moksha Desktop Environment

Bodhi, a Linux operating system based on Ubuntu that features a minimalist approach and really low system requirements, has just received a testing version for the upcoming 3.1.0 release. Read more