LWN.net

Ubuntu 14.04.3 LTS released

ris — 2015-08-07T23:04:57+00:00

The third update to the 14.04 Long Term Support release is available for Desktop, Server, Cloud, and Core products, as well as other flavors of Ubuntu with long-term support. "We have expanded our hardware enablement offering since 12.04, and with 14.04.3, this point release contains an updated kernel and X stack for new installations to support new hardware across all our supported architectures, not just x86."

Firefox 39.0.3 is out

ris — 2015-08-07T21:29:38+00:00

Firefox 39.0.3 has been released. According to the release notes there are various security fixes. This does include a fix for the recently report active exploit.

CentOS Linux 6.7 released

ris — 2015-08-07T19:03:26+00:00

CentOS Linux 6.7 has been released for x86 and x86_64. "There are many fundamental changes in this release, compared with the past CentOS Linux 6 releases, and we highly recommend everyone study the upstream Release Notes as well as the upstream Technical Notes about the changes and how they might impact your installation. (See the 'Further Reading' section of the CentOS release notes."

Security updates for Friday

ris — 2015-08-07T16:54:41+00:00

Arch Linux has updated firefox (information leak) and wordpress (multiple vulnerabilities).

Debian has updated kernel (multiple vulnerabilities).

Debian-LTS has updated openssh (two vulnerabilities) and remind (buffer overflow).

Fedora has updated drupal6-cck (F22; F21: unspecified vulnerability), lighttpd (F22; F21: log injection), mantis (F22; F21: information disclosure), opensaml-java (F22; F21: missing host name verification), opensaml-java-openws (F22; F21: missing host name verification), and openstack-swift (F22: arbitrary object deletion).

Oracle has updated kernel 3.8.13 (OL7; OL6: information leak), kernel 2.6.39 (OL6; OL5: two vulnerabilities), and kernel 2.6.32 (OL6; OL5: two vulnerabilities).

Ubuntu has updated firefox (15.04, 14.04, 12.04: information leak) and openjdk-6 (12.04: multiple vulnerabilities).

Privacy Badger 1.0

corbet — 2015-08-07T11:54:01+00:00

The Electronic Frontier Foundation has announced the 1.0 release of the Privacy Badger browser extension. "As you browse the Web, Privacy Badger looks at any third party domains that are loaded on a given site and determines whether or not they appear to be tracking you (e.g. by setting cookies that could be used for tracking, or fingerprinting your browser). If the same third party domain appears to be tracking you on three or more different websites, Privacy Badger will conclude that the third party domain is a tracker and block future connections to it." The extension is distributed under GPLv3; see this page for more information.

An active Firefox exploit

corbet — 2015-08-07T11:13:49+00:00

Mozilla has posted a warning about a Firefox vulnerability that is currently being actively exploited on the net. "The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the 'same origin policy') and Firefox’s PDF Viewer. Mozilla products that don’t contain the PDF Viewer, such as Firefox for Android, are not vulnerable. The vulnerability does not enable the execution of arbitrary code but the exploit was able to inject a JavaScript payload into the local file context. This allowed it to search for and upload potentially sensitive local files." There is a security update for the problem.

Grasch: A Frank Look at Simon: Where To Go From Here

jake — 2015-08-06T20:25:49+00:00

On his blog, Peter Grasch considers the future for the Simon speech-recognition system for KDE. He is passing the torch and will no longer be actively participating in the project, but he spent some time passing on his knowledge and some thoughts on where things might go from here. In addition, he built a working prototype of a speech-based command and control system for the Plasma desktop called Lera. "If anything, Lera is a starting point. The next steps would be to move Simon’s “eventsimulation” library into a separate framework, to be shared between Lera and Simon. Lera could then use this to type out the recognition results (see Simon’s Dictation plugin). Then, I would suggest porting a simplified notion of “Scenarios” to Lera, which should only really contain a set of commands, and maybe context information (vocabulary and “grammar” can be synthesized automatically from the command triggers). The implementation of training (acoustic model adaption) would then complete a very sensible, very usable version 1.0."

Federated Cloud Sharing in ownCloud 8.1 (ownCloud blog)

jake — 2015-08-06T18:13:59+00:00

The ownCloud blog has a post about federated file sharing between ownCloud instances in ownCloud 8.1, but it also looks at the wider view of federation between various kinds of cloud servers. ownCloud founder Frank Karlitschek has a series of posts (It is Time to Federate Our Clouds, The Next Generation File Sync and Share Technology, and The Federated Architecture of Next Generation File Sync and Share) on federation technology and has also proposed a cross-cloud-platform federation API: "In addition, today Frank proposed a draft of a Federated Cloud Sharing API to the Open Cloud Mesh working group with the goal of jump-starting a discussion about what is needed to enable federation between different file sharing implementations. Sharing among ownClouds is great, but the true power of a federated file cloud is available when you can share among different implementations seamlessly, because you all speak the same common language. This is the goal of the Open Cloud Mesh working group (of which ownCloud is a member as well), and outside of that, drafts have been shared with a number of well known standards organizations around web technologies and fellow open source file share and sync projects to get the work started."

Security updates for Thursday

jake — 2015-08-06T14:31:55+00:00

CentOS has updated kernel (C7: multiple vulnerabilities, one from 2014).

Fedora has updated kernel (F22: three vulnerabilities).

openSUSE has updated ghostscript (13.2, 13.1: code execution) and php5 (13.2, 13.1: two vulnerabilities).

Red Hat has updated kernel (RHEL7: multiple vulnerabilities, one from 2014) and kernel-rt (RHEL7; RHEL6: multiple vulnerabilities, one from 2014).

Scientific Linux has updated kernel (SL7: multiple vulnerabilities, one from 2014).

SUSE has updated oracle-update (Manager 2.1: multiple vulnerabilities).

Ubuntu has updated cinder (15.04: arbitrary file reads), python-keystoneclient, python-keystonemiddleware (15.04, 14.04: two vulnerabilities, one from 2014), and swift (15.04, 14.04, 12,04: two vulnerabilities, one from 2014).

[$] LWN.net Weekly Edition for August 6, 2015

corbet — 2015-08-06T01:24:32+00:00

The LWN.net Weekly Edition for August 6, 2015 is available.

[$] "Big data" features coming in PostgreSQL 9.5

jake — 2015-08-05T18:16:58+00:00

PostgreSQL 9.5 Alpha 2 is due to be released on August 6. Not only does the new version support UPSERT, more JSON functionality, and other new features we looked at back in July, it also has some major enhancements for "big data" workloads. Among these are faster sorts, TABLESAMPLE, GROUPING SETS and CUBE, BRIN indexes, and Foreign Data Wrapper improvements. Taken together, these features strengthen arguments for using PostgreSQL for data warehouses, and enable users to continue using it with bigger databases.

Security updates for Wednesday

ris — 2015-08-05T15:55:50+00:00

Debian has updated wordpress (regression in previous update).

Debian-LTS has updated ia32-libs (multiple vulnerabilities).

Red Hat has updated java-1.5.0-ibm (RHEL5,6: multiple vulnerabilities) and node.js (RHOSE2.1; RHOSE2.0: man-in-the-middle attack).

SUSE has updated java-1_6_0-ibm (SLEM12: multiple vulnerabilities).

Ubuntu has updated oxide-qt (15.04, 14.04: multiple vulnerabilities).

[$] Fuzzing perf_events

jake — 2015-08-05T12:36:11+00:00

You might be surprised to learn that starting with Linux 2.6.31 (in 2009) it has been rather easy to crash the Linux kernel. This date marks the introduction of the perf_event subsystem. It is likely that perf_event is not any more prone to errors than any other large kernel subsystem, but it has the distinction of being subjected to intense testing from the perf_fuzzer tool, which methodically probes the interface for bugs.

Click below (subscribers only) for the full article from perf_fuzzer author Vince Weaver.

LibreOffice 5.0 released

corbet — 2015-08-05T11:53:37+00:00

The LibreOffice 5.0 release is out. "LibreOffice 5.0 sports a significantly improved user interface, with a better management of the screen space and a cleaner look. In addition, it offers better interoperability with office suites such as Microsoft Office and Apple iWork, thanks to new and improved filters to handle non standard formats." See this post from Michael Meeks for a detailed description of the work that went into this release.

Coalition Announces New ‘Do Not Track’ Standard for Web Browsing

ris — 2015-08-04T19:50:42+00:00

The Electronic Frontier Foundation (EFF), privacy company Disconnect and a coalition of Internet companies have announced a stronger “Do Not Track” (DNT) setting for Web browsing—"a new policy standard that, coupled with privacy software, will better protect users from sites that try to secretly follow and record their Internet activity, and incentivize advertisers and data collection companies to respect a user’s choice not to be tracked online."