Wednesday, June 3rd, 2015

Time	Event
3:57p	Security advisories for Wednesday CentOS has updated kernel (C5: privilege escalation). Debian has updated jqueryui (regression in previous update) and wireshark (multiple vulnerabilities). Fedora has updated httpd (F21: mis-handling of Require directives), libtiff (F22: two vulnerabilities), nss (F22: cipher-downgrade attacks), nss-softokn (F22: cipher-downgrade attacks), and nss-util (F22: cipher-downgrade attacks). openSUSE has updated fuse (13.2: privilege escalation), nbd (13.2, 13.1: denial of service), and php5 (13.2, 13.1: multiple vulnerabilities). Oracle has updated kernel (OL5: privilege escalation). Red Hat has updated kernel (RHEL5: privilege escalation) and virtio-win (RHEL7; RHEL6: denial of service). Scientific Linux has updated kernel (SL5: privilege escalation). Ubuntu has updated qt4-x11, qtbase-opensource-src (15.04, 14.10, 14.04, 12.04: multiple vulnerabilities). (Comment on this)
4:58p	[$] Automotive Grade Linux and a distribution for cars At the 2015 Automotive Linux Summit in Tokyo, Dan Cauchy from the Linux Foundation (LF) kicked off the first day's program with an announcement: that the LF's Automotive Grade Linux (AGL) workgroup has decided to build its own Linux distribution, which it plans to run as an ongoing, long-term project. While the desire for a workgroup to create a distribution tailored to its needs is nothing new, the announcement had several in the crowd wondering what this decision meant for Tizen IVI—which, up until now, has served as the reference distribution for AGL. Tizen, of course, is also an LF-hosted project, and it has made in-vehicle infotainment (IVI) one of its high-priority use cases. (Comment on this)
9:14p	Emergency security band-aids with Systemtap Here's an article on the Red Hat security blog on the use of Systemtap to apply emergency security fixes. "With the vulnerability-band-aid approach chosen, we need to express our intent in the systemtap scripting language. The model is simple: for each place where the state change is to be done we place a probe. In each probe handler, we detect whether the context indicates an exploit is in progress and, if so, make changes to the context. We might also need additional probes to detect and capture state from before the vulnerable section of code, for diagnostic purposes." (Comment on this)

<< Previous Day

2015/06/03 [Calendar]

Next Day >>