Security Leftovers

• Door 02: Marketing department or selection bias? - Open Source Security

  Josh and Kurt talk about cybersecurity statistics and the value of the data we have.

• Security updates for Tuesday

  Security updates have been issued by Debian (libxstream-java, musl, mutt, pdfresurrect, vips, and zsh), Fedora (libuv, nodejs, thunderbird, and xen), openSUSE (libssh2_org, mutt, neomutt, and thunderbird), Oracle (firefox and thunderbird), Red Hat (firefox, rh-nodejs12-nodejs, rh-php73-php, and thunderbird), Scientific Linux (thunderbird), SUSE (libX11, mariadb, mutt, python-pip, python-setuptools, and python36), and Ubuntu (containerd, php-pear, and sniffit).

• Two More X.Org Server Security Advisories Issued - Possible Privilege Escalation - Phoronix

  Trend Micro's Zero Day Initiative has uncovered two more security issues with the aging X.Org Server that as we roll into 2021 is still powering most of the Linux desktops. The security researchers found multiple input validation failures with the X.Org Server's XKB keyboard extension. Insufficient checks on different checks could lead to out-of-bounds memory accesses or buffer overflows.

• X.Org server security advisory: December 1, 2020

  X.Org server security advisory: December 1, 2020
  
  
  Multiple input validation failures in X server XKB extension
  ============================================================
  
  These issues can lead to privileges elevations for authorized clients
  on systems where the X server is running privileged.
  
  * CVE-2020-14360 / ZDI CAN 11572 XkbSetMap Out-Of-Bounds Access
  
  Insufficient checks on the lengths of the XkbSetMap request can lead to
  out of bounds memory accesses in the X server.
  
  * CVE-2020-25712 / ZDI-CAN-11839 XkbSetDeviceInfo Heap-based Buffer Overflow
  
  Insufficient checks on input of the XkbSetDeviceInfo request can lead
  to a buffer overflow on the head in the X server.
  

• xorg-server 1.20.10

  Xorg-server 1.20.10 has been released. This version fixes security issues that could lead to privilege escalation, or other problems.

Graphics: Intel, NVIDIA and Mesa

• Intel Begins Preparing Linux Graphics Driver Support For Xe HP As "Gen12.5" - Phoronix

  Xe HP is Intel's discrete GPU aiming to compete against the latest-generation AMD and NVIDIA compute accelerators. Xe HP isn't scheduled to reach general availability until well into 2021 while now as they begin ramping up their sampling of Xe HP to potential customers, the Linux open-source driver support is preparing to roll-out. While Xe HP is about scaling up Intel Xe Graphics (Gen12), the Xe HP driver support is introducing it as a new "Gen12.5" target rather than just "Gen12" that is used by Tiger Lake / Rocket Lake / Xe LP.

• NVIDIA Is Working On DMA-BUF Passing That Should Help Improve Their Wayland Support

  NVIDIA is working on allowing their proprietary driver to support passing buffers as DMA-BUF. In turn this should allow for better supporting their proprietary driver on Wayland compared to the EGLStreams mess. A Phoronix reader tipped us off to NVIDIA developer comments last month in response to a KDE EGLStreams bug. A bug report was opened regarding that restarting the compositing breaks the EGLStreams back-end for KDE's KWin.

• Mesa Now 2~5x Faster For SPECViewPerf Following OpenGL Optimizations - Phoronix

  Well known open-source AMD Linux graphics driver developer Marek Olšák has just merged one of his largest set of optimizations in recent times: 2~5x faster performance for SPECViewPerf. SPECViewPerf is the common industry benchmark for measuring graphics performance for professional applications with benchmark viewsets from 3ds Max, CATIA, Maya, Solidworks, Siemens NX, and other programs. The performance when using Mesa drivers have been lagging but now thanks to common Mesa infrastructure improvements by Mesa, the performance is wildly improved.

New Videos About GNU/Linux

• The Top 8 Linux Window Managers of 2020 - YouTube

  So many people do their "top distros" list or a "top apps" list. It's past time that someone did a "top window managers" list. So here is my top eight window managers that are available on Linux.

• Why Did Vivaldi Send Me A Merch Box?? - YouTube

  A few months back I made a video on the Vivaldi browser licence and they liked the video so much that they decided to send me a box of merch so today we're going to unbox it and see what this web browser company sent me.

• LIBREM 5 is shipping, Chromium opens up, and Ubuntu Web Remix offers a Chrome OS alternative - YouTube

  This month, we have the Librem 5 finally shipping to backers, a new open source Chrome OS alternative, Google being more open with Chromium, and tons of Linux gaming improvements.