Language Selection

English French German Italian Portuguese Spanish

Security Advisories

Filed under
Security

Less critical

Ubuntu has issued updates for the kernel. These fixes two vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

Solution:

Apply updated packages. Links to updates

Highly critical

SUSE has issued updates for multiple packages. These fix various vulnerabilities, which can be exploited by malicious, local users to escalate their privileges and by malicious people to compromise a vulnerable system.

Solution:

Apply updated packages.

Updated packages are available using YaST Online Update or the SUSE FTP site. Full description.

Less critical

Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.

Successful exploitation requires that the option "Prefer HTML to plain text" is enabled (not default setting).

The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.

Solution:

Disable the "Prefer HTML to plain text" setting. Link.

Serious
Red Hat Inc. is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory. XFree86 is an implementation of the X Window System that provides low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPixMap images, Red Hat said. An attacker could use a malicious XPixMap file to execute code on a user's system. Source for this one.

More in Tux Machines

How Linux became my job

I've been using open source since what seems like prehistoric times. Back then, there was nothing called social media. There was no Firefox, no Google Chrome (not even a Google), no Amazon, barely an internet. In fact, the hot topic of the day was the new Linux 2.0 kernel. The big technical challenges in those days? Well, the ELF format was replacing the old a.out format in binary Linux distributions, and the upgrade could be tricky on some installs of Linux. Read more

Linux 4.16-rc2

It's been a quiet week, and rc2 is out. I take the fairly quiet rc be a good sign for 4.16, but honestly, rc2 is often fairly calm. That's probably because people are taking a breather after the merge window, but also simply because it might take a while to find any issues. But let's be optimistic, and just assume - at least for now - that it's because all is well. The diffstat is fairly odd, but that often happens with small rc's just because then just a couple of pulls will skew things easily in one or two directions. This time the patch is about one third architecture updates (arm64, x86, powerpc), one third tooling (mostly 'perf') and one third "rest". And yes, the bulk of that rest is drivers (gpu, nvme, sound, misc), but those drivers are still distinctly *not* the bulk of the whole patch. Go out and test, it all looks fine. Read more Also: Linux 4.16-rc2 Kernel Released

OpenStreetMap in IkiWiki and Why OpenStreetMap is in Serious Trouble

  • OSM in IkiWiki
    Since about 15 years ago, I have been thinking of creating a geo-referenced wiki of pubs, with loads of structured data to help searching. I don't know if that would be useful for anybody else, but I know I would use it! Sadly, the many times I started coding something towards that goal, I ended blocked by something, and I keep postponing my dream project.
  • Why OpenStreetMap is in Serious Trouble
    That said, while I still believe in the goals of OpenStreetMap, I feel the OpenStreetMap project is currently unable to fulfill that mission due to poor technical decisions, poor political decisions, and a general malaise in the project. I'm going to outline in this article what I think OpenStreetMap has gotten wrong. It's entirely possible that OSM will reform and address the impediments to its success- and I hope it does. We need a Free as in Freedom geographic dataset.

Linux KPI-Based DRM Modules Now Working On FreeBSD 11

Thanks to work done by Hans Petter Selasky and others, this drm-next-kmod port is working on FreeBSD 11 stable. What's different with this package from the ports collection versus the ported-from-Linux Direct Rendering Modules found within the FreeBSD 11 kernel is that these DRM modules are using the linuxkpi interface. Read more