Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

Linux Growth Demands Bigger Talent Poo

Today at LinuxCon and CloudOpen we're making an announcement that signifies the natural next step in helping to build a qualified talent pool of Linux professionals worldwide:The Linux Foundation Certification Program. We sought to create a new Linux certification program that is innovative, highly valued among Linux pro’s and employers and advances the state-of the-art of certification exams. We think it's a different approach to testing and can help advance Linux by bringing more Linux talent into the market. The exams are available anytime, anywhere; performance based with testing in the command line; and distribution flexible. Let me tell you a bit more about why we believe this is so important. Linux today powers most of the technology infrastructure that runs our daily lives. It is the fastest growing platform in nearly every sector of technology from embedded systems, mobile devices and consumer electronics to the cloud, enterprise server, high performance computing and more. Read more

Linux Foundation to offer new certification for IT workers

With an eye toward deepening the global Linux talent pool, the Linux Foundation today announced that it will offer two new certifications for engineers and administrators. The Linux Foundation Certified System Administrator, or LFCS, and the Linux Foundation Certified Engineer, or LFCE certificates will be granted to applicants who pass an automated online exam. The cost will be $300, although the foundation will hand out 1,000 free passes to attendees at LinuxCon, where the announcement was made. Read more More: Linux Foundation Debuts Linux Certification Effort

Parsix GNU/Linux 7.0 Test 1 Is an Interesting Debian and GNOME 3.12 Combination

Parsix GNU/Linux 7.0 Test 1, a live and installation DVD based on Debian, aiming to provide a ready-to-use, easy-to-install desktop and laptop-optimized operating system, has been released and is now ready for testing. Read more

Linux Founder Linus Torvalds 'Still Wants the Desktop'

The Linux faithful gathered today at LinuxCon to hear core Linux developers, especially Linus Torvalds—and the audience wasn't disappointed. In a keynote panel session, Torvalds spoke of his hopes and the challenges for Linux in 2014. Linux kernel developer Greg Kroah-Hartman moderated the discussion and commented that Linux already runs everywhere. He asked Torvalds where he thinks Linux should go next. Read more