LWN.net

Arch Linux has updated kscreenlocker (restriction bypass).CentOS has updated sos (C6: information leak).Fedora has updated claws-mail(F22: stack-based buffer overflow), imlib2(F22: denial of service), python-pillow(F23: denial of service), and webkitgtk4(F22: multiple vulnerabilities).Mageia has updated ffmpeg(multiple vulnerabilities), flash-player-plugin (multiple vulnerabilities), jasper (denial of service), and nettle (improper cryptographic calculations).openSUSE has updated jasper(13.2: denial of service), krb5 (13.2:three vulnerabilities), and tiff (13.2: three vulnerabilities).Oracle has updated sos (OL6:information leak).Red Hat has updated openstack-swift (RHELOSP7: denial of service) and python-django (RHELOSP7; RHELOSP5 for RHEL7; RHELOSP5 for RHEL6: information disclosure).Scientific Linux has updated sos(SL6: information leak).SUSE has updated flash-player (SLE12-SP1; SLE11-SP4: multiple vulnerabilities) and java-1_7_1-ibm (SLE12-SP1; SLE11-SP4: multiple vulnerabilities).Ubuntu has updated nginx (15.10,14.04: denial of service).

The SourceForge hosting site has announcedthat it has a new owner (BIZX, LLC, along with Slashdot) and that it willbe getting rid of the controversial DevShare program, which was covered here in 2013. "As of last week,the DevShare program was completely eliminated. The DevShare programdelivered installer bundles as part of the download for participatingprojects. We want to restore our reputation as a trusted home for opensource software, and this was a clear first step towards that. We’re moreinterested in doing the right thing than making extra short-termprofit."

<img class="photo" src="http://lwn.net/images/2016/lca-oven.jpg" alt="[Prototype]">

The LibreOffice 5.1 release is available. "LibreOffice 5.1's user interface has been completelyreorganized, to provide faster and more convenient access to its most usedfeatures. A new menu has been added to each of the applications: Style(Writer), Sheet (Calc) and Slide (Impress and Draw). In addition, severalicons and menu commands have been repositioned based on userpreferences." See thispage for (a little) more information and some videos.

The Obama administration has put out aplan for how it would like to make the net a safer place. There are alot of topics covered here; toward the end it also mentions that "theGovernment will work with organizations such as the Linux Foundation’s CoreInfrastructure Initiative to fund and secure commonly used internet'utilities' such as open-source software, protocols, and standards. Justas our roads and bridges need regular repair and upkeep, so do thetechnical linkages that allow the information superhighway to flow."

"TPM," said Matthew Garrett in his linux.conf.au 2016 talk, stands for "trusted platform module"; it is a tool that is meant to allow a system'sowner to decide which software to trust. Some years ago, there was a lot offear that the TPM would be used, instead, to take that decision away, to allow othersto decide which software would be trusted to run on our systems; for that reason,some called "trusted computing" by the rather less complimentary name"treacherous computing." That scenario didn't come about, though, for anumber of reasons, both technical and social. But we can still use the TPM forits original purpose; Matthew was there to talk about his work to bringabout computing that we can trust.Click below (subscribers only) for the full report from LCA 2016.

Debian has updated qemu (multiplevulnerabilities), qemu (more vulnerabilities), qemu-kvm (multiple vulnerabilities), and wordpress (two vulnerabilities).Debian-LTS has updated gajim (man-in-the-middle).Mageia has updated mbedtls/hiawatha/belle-sip/linphone/pdns (codeexecution), openssl (man-in-the-middle), php (multiple vulnerabilities), privoxy (denial of service), and radicale (authentication bypass).Red Hat has updated sos (RHEL6:information leak).Slackware has updated curl (authentication bypass) and flac (multiple vulnerabilities).SUSE has updated java-1_8_0-ibm(SLE12-SP1: multiple vulnerabilities) and rubygem-rails-html-sanitizer (SES2.1: multiple vulnerabilities).Ubuntu has updated firefox(regression in previous update).

Wired talkswith John Perry Barlow on the 20th anniversary of his Declaration ofIndependence of Cyberspace. "In the modern era of global NSA surveillance, China’s Great Firewall, and FBI agents trawling the dark Web, it’s easy to write off Barlow’s declaration as early dotcom-era hubris. But on his document’s 20th anniversary, Barlow himself wants to be clear: He stands by his words just as much today as he did when he clicked “send” in 1996."

Arch Linux has updated lib32-libsndfile (multiple vulnerabilities) and libsndfile (multiple vulnerabilities).Debian has updated polarssl (code execution) and tiff (multiple vulnerabilities).Debian-LTS has updated eglibc (multiple vulnerabilities) and linux-2.6 (multiple vulnerabilities).Fedora has updated claws-mail(F23: stack-based buffer overflow), nginx(F22: denial of service), and prosody (F23:insecure handling of dialback keys).Mageia has updated cakephp (denial of service), cgit (three vulnerabilities), curl (authentication bypass), cyrus-imapd (two vulnerabilities), docker/golang (two vulnerabilities), gajim (man-in-the-middle), imlib2 (denial of service), java-1.8.0-openjdk/copy-jdk-configs/lua-lunit/lua-posix (multiple vulnerabilities), krb5 (three vulnerabilities), phpmyadmin/phpseclib (multiple vulnerabilities), and socat (man-in-the-middle).openSUSE has updated curl (Leap42.1; 13.2; 13.1:authentication bypass), mariadb (Leap42.1; 13.2: multiple vulnerabilities), mysql(Leap42.1, 13.2; 13.1: multiple vulnerabilities), nginx (Leap42.1: denial of service), openssl (13.2: man-in-the-middle), php5 (Leap42.1: two vulnerabilities), phpMyAdmin (Leap42.1, 13.2: multiplevulnerabilities), rubygem-actionpack-3_2(13.2: multiple vulnerabilities), rubygem-actionpack-4_2 (Leap42.1: multiplevulnerabilities), rubygem-rails-html-sanitizer (Leap42.1:multiple vulnerabilities), and phpmyadmin(13.1: multiple vulnerabilities).Red Hat has updated openstack-swift (RHELOSP5 for RHEL6; RHELOSP5 for RHEL7; RHELOSP6 for RHEL7: denial ofservice) and python-django(RHELOSP6 for RHEL7: information disclosure).SUSE has updated kernel(SLE11-SP3: multiple vulnerabilities).

The 4.5-rc3 kernel prepatch is out."It's slightly bigger than I'd like, but not excessively so (and notunusually so). Most of the patches are pretty small, although the diff isutterly dominated by the (big) removal a couple of staging rdma driversthat just weren't going anywhere. Those removal patches are 90% of the bulkof the diff."

The CoreOS project has announced version1.0 of its rkt container manager.As part of the release, rkt's command-line interface and on-diskformat have been declared stable. The announcement also highlights anumber of new security features, including "KVM-based containerisolation, SELinux support, TPM integration, image signaturevalidation, and privilege separation" and notes that rkt willrun Docker images.

Arch Linux has updated libbsd (denial of service).Debian has updated krb5(multiple vulnerabilities).Fedora has updated nettle(F23: improper cryptographic calculations), salt (F22: information leak), and webkitgtk4 (F23: multiple vulnerabilities).SUSE has updated MozillaFirefox,MozillaFirefox-branding-SLE, mozilla-nss (SLE12: multiple vulnerabilities) and MozillaFirefox,MozillaFirefox-branding-SLED, mozilla-nss (SLE11: multiple vulnerabilities).

Over at Linux.com, Eric Brown looks at the newly announced Ubuntu Touch tablet. The hardware: "The Aquaris M10 is equipped with a 64-bit, quad-core, Cortex-A53 MediaTek MT8163A system-on-chip clocked to 1.5GHz, along with a high-powered ARM Mali-T720 MP2 GPU. The tablet ships with 2GB of RAM, 16GB flash, and a microSD slot." It is said to have 1920x1200 resolution and an 8 megapixel camera capable of HD recording. The interface will change to take advantage of larger displays and additional input devices (e.g. keyboard, mouse)."It appears that the upcoming Ubuntu 16.04 “Xenial Xerus” LTS release due in April will be the first true convergence release. According to PC World, it will still be optional, however, with a traditional Unity 7 build with X.org available alongside the newly converged Unity 8 with the new Mir display server. The new tablet, and Unity 8, will feature Ubuntu Touch’s Scopes interface, which presents frequently used content and services as an alternative to traditional apps.In addition to automatically changing the interface in response to new screens and input devices, Ubuntu is also providing convergence on the application development level. Developers are already developing single apps that can automatically morph into desktop, phone, and tablet formats."

Debian-LTS has updated openjdk-6 (multiple vulnerabilities).Fedora has updated nodejs-is-my-json-valid (F23: denial ofservice), phpmyadmin (F23: multiple vulnerabilities), and prosody (F22: insecure key handling).Gentoo has updated qemu (multiple vulnerabilities).Slackware has updated mozilla(unspecified), mplayer (file contentsleak), openssl (cipher downgrade), and php (three vulnerabilities).

The LWN.net Weekly Edition for February 4, 2016 is available.

Arch Linux has updated lib32-nettle (improper cryptographic calculations) and nettle (improper cryptographic calculations).Debian has updated openjdk-6 (multiple vulnerabilities).Fedora has updated openstack-heat(F23: denial of service) and openstack-swift (F23: denial of service).openSUSE has updated kernel(13.2: multiple vulnerabilities).Red Hat has updated kernel(RHEL7.1: multiple vulnerabilities).Ubuntu has updated qemu, qemu-kvm(15.10, 14.04, 12.04: multiple vulnerabilities).

Michael Catanzaro describesthe sad state of WebKit security on Linux distributions and thechallenges of security support for such a complex package in general."We regularly receive bug reports from users with very old versionsof WebKit, who trust their distributors to handle security for them andmight not even realize they are running ancient, unsafe versions ofWebKit. I strongly recommend using a distribution that releases WebKitGTK+updates shortly after they’re released upstream. That is currently onlyArch and Fedora. (You can also safely use WebKitGTK+ in Debian testing —except during its long freeze periods — and Debian unstable, and maybe alsoin openSUSE Tumbleweed. Just be aware that the stable releases of thesedistributions are currently not receiving our security updates.)"Lots of information here, worth a read for anybody interested in the topic.

Arch Linux has updated curl (authentication bypass), lib32-curl (authentication bypass), python-django (permission bypass), and python2-django: permission bypass).Fedora has updated bind (F22: twodenial of service flaws), chrony (F22:packet modification), curl (F22:authentication bypass), firefox (F22:multiple vulnerabilities), and qemu (F22: multiple vulnerabilities).openSUSE has updated firefox(13.1: multiple vulnerabilities), privoxy (Leap42.1, 13.2; 13.1: two denial of service flaws),seamonkey (Leap42.1, 13.2; 13.1: multiple vulnerabilities), firefox (Leap42.1, 13.2: multiplevulnerabilities), and xulrunner (Leap42.1:code execution).Red Hat has updated java-1.6.0-ibm (RHEL5,6: multiplevulnerabilities), java-1.7.0-ibm (RHEL5:multiple vulnerabilities), java-1.7.1-ibm(RHEL6,7: multiple vulnerabilities), java-1.8.0-ibm (RHEL7: multiple vulnerabilities), and redis (RHELOSP7-OT; RHELOSP7; RHELOSP6: denial of service).Ubuntu has updated kernel (15.10; 15.04;14.04; 12.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiplevulnerabilities), linux-lts-utopic (14.04:multiple vulnerabilities), linux-lts-vivid(14.04: multiple vulnerabilities), linux-lts-wily (14.04: multiplevulnerabilities), linux-raspi2 (15.10:multiple vulnerabilities), linux-ti-omap4(12.04: multiple vulnerabilities), openjdk-6 (12.04: multiple vulnerabilities),and openjdk-7 (15.10, 15.04, 14.04: multiple vulnerabilities).

The Black Forestfire destroyed over 500 Colorado houses in June 2013; one of thosebelonged to longtime Debian developer Bdale Garbee. As he reported duringhis talk at the 2016 linux.conf.au Multimedia and Musicminiconf, the house has been redesigned and rebuilt and life is generally better now. Part of the rebuildingprocess included the incorporation of a whole-house audio system;naturally, Bdale took a unique approach to that task. His talk showed whatcan be done when one starts from scratch — and doesn't mind designing acircuit board along the way.

ThisRed Hat blog post celebrates the fifteenth anniversary of the firstSELinux release. "With the question of open source security longbehind us, we are now focused on providing an even more flexible securitymodel through SELinux. With the rise of composite, distributed applicationsthat can span hundreds of physical and virtual machines as well asdisparate cloud instances and Linux container deployments, one-off usage ofSELinux is not enough. Instead, we are focused on providing “defense indepth” for modern computing scenarios, effectively building and deployingSELinux policies at each level of the datacenter."

CentOS has updated qemu-kvm (C7; C6: code execution).Debian has updated freetype (denial of service), privoxy (two denial of service flaws), prosody (insecure handling of dialback keys), radicale (two vulnerabilities), and rails (multiple vulnerabilities).Debian-LTS has updated gosa (code injection), mysql-5.5 (multiple vulnerabilities), phpmyadmin (two vulnerabilities), prosody (two vulnerabilities), and tiff (multiple vulnerabilities).Fedora has updated curl (F23:authentication bypass), firefox (F23:multiple vulnerabilities), gsi-openssh(F22: multiple vulnerabilities), imlib2(F23: denial of service), kernel (F23; F22:multiple vulnerabilities), krb5 (F23: threevulnerabilities), moodle (F23; F22: two vulnerabilities), nginx (F23: multiple vulnerabilities), ntp (F23: multiple vulnerabilities), openssl (F23: two vulnerabilities), phpMyAdmin (F22: multiple vulnerabilities),privoxy (F23; F22: two denial of service flaws), webkitgtk4 (F22: multiple vulnerabilities),and xen (F22: multiple vulnerabilities).Gentoo has updated openssl (multiple vulnerabilities).openSUSE has updated ecryptfs-utils (Leap42.1; 13.1: two vulnerabilities), giflib (Leap42.1: heap-based buffer overflow),and kernel (13.1: multiple vulnerabilities).

The 4.5-rc2 kernel prepatch is out. Linussays things aren't going so slowly anymore: "As late as Friday, I was planning on talking about how nice it is tosee this new trend of tiny rc2 releases, because there really hadn'tbeen very many pull requests at all.But it turns out the pull requests were just heavily skewed to the endof the week, and 4.5-rc2 isn't particularly small after all. It prettymuch doubled over the weekend." Still, he seems to think thatthings are working well enough.

The 4.4.1,4.3.5, and4.1.17 stable kernel updates are out.These contain a relatively large number of changes as Greg Kroah-Hartmancontinues to work through the patch backlog.

The KDE neon project — which arguablycould be seen as a replacement for the Kubuntu distribution — has been announcedat FOSDEM. "More than ever people expect a stable desktop with cutting-edge features, all in a package which is easy to use and ready to make their own.KDE Neon is the intersection of these needs using a stable Ubuntu long-term release as its core, packaging the hottest software fresh from the KDE Community ovens. Compute knowing you have a solid foundation and enjoy the features you experience in the world's most customisable desktop."

Greg Kroah-Hartman has released stable kernels 3.14.60 and 3.10.96, each containing importantupdates throughout the tree.

Arch Linux has updated lib32-openssl (multiple vulnerabilities) and openssl (multiple vulnerabilities).Debian has updated mysql-5.5(multiple vulnerabilities).Fedora has updated gsi-openssh (F23: multiple vulnerabilities), krb5 (F23: information leak), and xen (F23: multiple vulnerabilities).Mageia has updated chromium-browser-stable (M5: multiple vulnerabilities), chrony (M5: packet modification), firefox (M5: code execution), lxc (M5: directory traversal), ntp (M5: multiple vulnerabilities), owncloud (M5: multiple vulnerabilities), and srtp (M5: denial of service).openSUSE has updated java-1_7_0-openjdk (Leap 42.1: multiple vulnerabilities) and kernel (Leap 42.1: multiple vulnerabilities).Oracle has updated qemu-kvm (O7; O6:code execution).Red Hat has updated qemu-kvm (RHEL6; RHEL7:code execution)and qemu-kvm-rhev (RHEL7 OSP5; RHEL6 OSP5; RHEL7 OSP7; RHEL7 OSP6: multiple vulnerabilities).Scientific Linux has updated qemu-kvm (SL6; SL7:code execution).Ubuntu has updated openssl(15.10: information leak).

Wired reports on a talk at the USENIX Enigma conference by Rob Joyce of the US National Security Agency (NSA). Joyce is the head of the NSA's Tailored Access Operations, which is tasked with breaking into the systems of adversaries and sometimes allies. He spoke about ways to thwart the NSA and other nation-state-level attackers. "'We put the time in …to know [that network] better than the people who designed it and the people who are securing it,' he said. 'You know the technologies you intended to use in that network. We know the technologies that are actually in use in that network. Subtle difference. You'd be surprised about the things that are running on a network vs. the things that you think are supposed to be there.'"

Arch Linux has updated nginx(three denial of service flaws).Debian has updated iceweasel(three vulnerabilities) and openjdk-7(multiple vulnerabilities).openSUSE has updated chromium(13.1: multiple vulnerabilities), java-1_7_0-openjdk (13.2: multiple vulnerabilities),java-1_8_0-openjdk (42.1; 13.2: multiple vulnerabilities), java7 (13.1: multiple vulnerabilities), and openldap2 (42.1: two vulnerabilities).Oracle has updated bind (OL7; OL6; OL5: denial of service), bind97 (OL5: denial of service), andfirefox (OL7; OL6; OL5: twocode execution flaws).Red Hat has updated bind (RHEL6.4, 6.5: four denial of serviceflaws, including one from 2014) and bind(RHEL6.6: three denial of service flaws).Scientific Linux has updated bind(denial of service), bind97 (SL5: denial ofservice), and firefox (two code execution flaws).SUSE has updated java-1_7_0-openjdk (SLE12; SLE11:multiple vulnerabilities) and openldap2 (Studio Onsite 1.3: two vulnerabilities).Ubuntu has updated curl(authentication bypass) and oxide-qt(15.10, 15.04, 14.04: multiple vulnerabilities).

The LWN.net Weekly Edition for January 28, 2016 is available.

The Linux Foundation's board ofdirectors is not usually a hotbed of controversy; for the most part it does its work in the background, quietlygoing about the business of directing the non-profit organization. Inmid-January that all changed. The bylaws that governed howsome at-large board seats were allocated were changed, which caused quitean uproar within the Linux world. While there is speculation about the motive forthe change—as well as an official statement of sorts—it certainly seemslike the whole thing could have been handled a lot better.Subscribers can click below for the full story from this week's edition.

CentOS has updated bind (C7; C6; C5: denial of service), bind97 (C5: denial of service), and firefox (C7; C6; C5: code execution).Debian has updated chromium-browser (multiple vulnerabilities), curl (authentication bypass), and virtualbox (multiple vulnerabilities).Debian-LTS has updated nginx (denial of service), radicale (multiple vulnerabilities), and tiff (code execution).Fedora has updated cgit (F23:three vulnerabilities), kernel (F23:multiple vulnerabilities), and perl-PathTools (F22: returns untainted strings).Gentoo has updated adobe-flash (multiple vulnerabilities), opensmtpd (multiple vulnerabilities), and webkit-gtk (multiple vulnerabilities).openSUSE has updated Chromium (SPH SLE12; Leap42.1, 13.2: multiple vulnerabilities), openldap (13.1: two vulnerabilities), php5 (13.2: three vulnerabilities), and tiff (Leap42.1: denial of service).Oracle has updated java-1.6.0-openjdk (OL7; OL6; OL5: multiple vulnerabilities).Red Hat has updated bind(RHEL5,6,7: denial of service), bind97(RHEL5: denial of service), chromium-browser (RHEL6: multiplevulnerabilities), firefox (RHEL5,6,7: code execution), and RHOSE (multiple vulnerabilities).Scientific Linux has updated java-1.6.0-openjdk (SL5,6,7: multiple vulnerabilities).SUSE has updated java-1_8_0-openjdk (SLE12-SP1: multiple vulnerabilities).Ubuntu has updated firefox (multiple vulnerabilities).

Firefox 44.0 has been released. With this version Firefox can getpush notifications from your favorite sites. This release alsofeatures improved warning pages for certificate errors and untrustedconnections, H.264 is enabled if the system decoder is available, ifMP4/H.264 are not supported WebM/VP9 video support is enabled, the brotlicompression format via HTTPS content-encoding is supported, and more. Seethe release notes fordetails.

The Linux Test Project test suite stable release for January 2016 isavailable. There were 191 patches by 29 authors merged since the previousrelease. Some notable changes include rewritten and new cgroup tests forcpuacct and pids controllers, rewritten basic cgroup functional and stresstests, new userns07 test for user namespaces, new syscall tests, and more.

AMD has launched"gpuopen.com" to support open graphics development (on AMD GPUs,naturally). "The second is a commitment to open source software. Thegame and graphics development community is an active hub of enthusiasticindividuals who believe in the value of sharing knowledge. Full andflexible access to the source of tools, libraries and effects is a keypillar of the GPUOpen philosophy. Only through open source access aredevelopers able to modify, optimize, fix, port and learn from software. Thegoal? Encouraging innovation and the development of amazing graphicstechniques and optimizations in PC games."

Arch Linux has updated blueman (privilege escalation), chromium (multiple vulnerabilities), and mbedtls (signature forgery).CentOS has updated java-1.6.0-openjdk (C7; C6; C5: multiple vulnerabilities) and kernel (C7: privilege escalation).Debian has updated mariadb-10.0 (multiple vulnerabilities).Fedora has updated cgit (F22:three vulnerabilities), golang (F22:information disclosure), and java-1.8.0-openjdk (F22: unspecified).openSUSE has updated ecryptfs-utils (13.2: privilege escalation),ffmpeg (Leap42.1: cross-origin attacks),and python-requests (13.1: information disclosure).Oracle has updated kernel (OL7:privilege escalation) and ntp (OL6: missing check for zero originate timestamp).Red Hat has updated java-1.6.0-openjdk (RHEL5,6,7: multiplevulnerabilities), kernel (RHEL7: privilege escalation), and kernel-rt (RHEL7; RHE MRG2: privilege escalation).Scientific Linux has updated kernel (SL7: privilege escalation).Ubuntu has updated mysql-5.5, mysql-5.6 (multiple vulnerabilities).

As expected, Linus released the 4.5-rc1development kernel and closed the merge window for this cycle on January 24. Less than 2,000changes were pulled since last week'ssummary, but there were some significant changes to be found amongthem. Click below (subscribers only) for the final part of LWN's 4.5 mergewindow coverage.

Arch Linux has updated ecryptfs-utils (privilege escalation), linux-lts (privilege escalation), privoxy (two denial of service flaws), python-rsa (signature forgery), and python2-rsa (signature forgery).CentOS has updated ntp (C7; C6: missing check for zero originate timestamp).Debian has updated claws-mail (code execution).Debian-LTS has updated foomatic-filters (buffer overflows), imlib2 (denial of service), pound (multiple vulnerabilities, one from 2009), and privoxy (two denial of service flaws).Fedora has updated bind (F23: twodenial of service flaws), bind99 (F23:denial of service), chrony (F23: packetmodification), dhcp (F22: denial ofservice), java-1.8.0-openjdk (F23:unspecified), mod_nss (F22: enablesinsecure ciphersuites), owncloud (F23; F22:multiple vulnerabilities), python-rsa (F22:signature forgery), and qemu (F23: multiple vulnerabilities).Mageia has updated virtualbox (unspecified vulnerabilities).openSUSE has updated bind (13.1:denial of service), cgit (13.1: threevulnerabilities), giflib (13.1: heap-basedbuffer overflow), jasper (13.2; 13.1: denial of service), libvirt (Leap42.1, 13.2; 13.1: path traversal), openldap2 (13.2: two vulnerabilities), roundcubemail (Leap42.1; 13.2; 13.1: code execution), and tiff (13.2; 13.1: denial of service).Oracle has updated ntp (OL7: missing check for zero originate timestamp).Red Hat has updated ntp (RHEL6,7:missing check for zero originate timestamp).Scientific Linux has updated ntp(SL6,7: missing check for zero originate timestamp).SUSE has updated bind(SLES10-SP4: four denial of service vulnerabilities), openldap2 (SLE12-SP1: two vulnerabilities),and kernel (SLE12: privilege escalation).

Matt Mackall, the creator of the Mercurial source-code management system,has announced thathe is ready to move on to a new project. "So over the course of thisyear, I'm going to gradually remove myself from daily involvement in theproject. As lots of people and companies have a lot invested in Mercurial,I'm doing this over a long period of time to make sure it goessmoothly."

Linus has released the 4.5-rc1 prepatch andclosed the merge window for this development cycle. "It's a fairlynormal release - neither unusually big or unusually small. The statisticslook fairly normal too, with drivers being a bit over 70% of the bulk (thebig driver areas being gpu, networking, sound, staging, fbdev, but its allover)."

The4.3.4,4.1.16,3.14.59, and3.10.95 stable kernel updates have beenreleased. They are the first in just over one month, and they contain afair number of important fixes.

On his blog, Peter Hutterer answers the perennial "is Wayland ready yet?" question by pointing out that it really is not the right question. "The protocol is stable and has been for a while. But not every compositor and/or toolkit/application speak Wayland yet, so it may not be sufficient for your use-case. So rather than asking 'Is Wayland ready yet', you should be asking: 'Can I run GNOME/KDE/Enlightenment/etc. under Wayland?' That is the right question to ask, and the answer is generally 'It depends what you expect to work flawlessly.' This also means 'people working on Wayland' is often better stated as 'people working on Wayland support in ....'. "

CentOS has updated java-1.7.0-openjdk (C7; C6; C5: multiple vulnerabilities) and java-1.8.0-openjdk (C7; C6: multiple vulnerabilities).Debian has updated fuse(privilege escalation).Fedora has updated libsndfile(F22: two vulnerabilities), python-rsa (F23: signatureforgery), and rsync (F22: file overwritefrom 2014).Mageia has updated dhcpcd (denialof service).openSUSE has updated bind (42.1; 13.2:denial of service), cgit (42.1, 13.2: threevulnerabilities), giflib (13.2: code execution), and libxml2 (42.1: denial of service).Oracle has updated java-1.7.0-openjdk (OL7; OL6; OL5: multiple vulnerabilities) and java-1.8.0-openjdk (OL6: multiple vulnerabilities).Scientific Linux has updated java-1.7.0-openjdk (SL6; SL5&7: multiple vulnerabilities) and java-1.8.0-openjdk (SL7: multiple vulnerabilities).Ubuntu has updated perl (15.10,15.04: taint botch) and rsync (fileoverwrite from 2014).

Just a quick note to point out that the very first LWN Weekly Edition came out onJanuary 22, 1998. So we have now been at it for eighteen years. Tosay we would have been surprised by that idea in 1998 is a seriousunderstatement. Many thanks to LWN's reader community for keeping us goingfor all this time!

Linux Foundation leader Jim Zemlin explainsthe recent changes in the organization's by-laws. "First, TheLinux Foundation Board structure has not changed. The same individualsremain as directors, and the same ratio of corporate to community directorscontinues as well. What we did do was to act on a long-discussed perceptionthat the value we provide to individual supporters could be improved, forthe first time in a decade. And that the process for recruiting communitydirectors should be changed to be in line with other leading organizationsin our community and industry." He also speaks out against thepersonal attacks that have appeared in conversations about this change.

Version1.6 of the Rust programming language has been released. "The largest new feature in 1.6 is that libcore is now stable! Rust’s standard library is two-tiered: there’s a small core library, libcore, and the full standard library, libstd, that builds on top of it. libcore is completely platform agnostic, and requires only a handful of external symbols to be defined. Rust’s libstd builds on top of libcore, adding support for memory allocation, I/O, and concurrency. Applications using Rust in the embedded space, as well as those writing operating systems, often eschew libstd, using only libcore.libcore being stabilized is a major step towards being able to write the lowest levels of software using stable Rust."

Arch Linux has updated bind (twovulnerabilities) and libdwarf (informationleak).Fedora has updated kernel (F23:two vulnerabilities) and prosody (F23; F22: two vulnerabilities).Mageia has updated bind (two vulnerabilities),cacti (three vulnerabilities), dhcp (denial of service), encfs (code execution from 2014), kernel (privilege escalation), kernel-linus (privilege escalation), kernel-tmb (privilege escalation), moodle (two vulnerabilities), and perl, perl-PathTools (taint botch).Oracle has updated java-1.8.0-openjdk (OL7: multiple vulnerabilities), kernel (OL5: unspecified), kernel3.8.13 (OL7; OL6: privilege escalation), and kernel 4.1.12 (OL7; OL6: privilege escalation).Red Hat has updated java-1.6.0-sun (multiple vulnerabilities), java-1.7.0-openjdk(RHEL6; RHEL5&7: multiple vulnerabilities), java-1.7.0-oracle (multiple vulnerabilities),java-1.8.0-openjdk (RHEL7; RHEL6: multiple vulnerabilities), and java-1.8.0-oracle (RHEL6&7: multiple vulnerabilities).Scientific Linux has updated java-1.8.0-openjdk (SL6: multiple vulnerabilities).SUSE has updated bind (SLE12:denial of service) and kernel (SLE12SP1: privilege escalation).

The LWN.net Weekly Edition for January 21, 2016 is available.

On his blog, Matthew Garrett has noted that the Linux Foundation (LF) has dropped the community representatives to its board that were elected by the individual LF members. "The by-laws were amended to drop the clause that permitted individual members to elect any directors. Section 3.3(a) now says that no affiliate members may be involved in the election of directors, and section 5.3(d) still permits at-large directors but does not require them[2]. The old version of the bylaws are here - the only non-whitespace differences are in sections 3.3(a) and 5.3(d).These changes all happened shortly after Karen Sandler [executive director of the Software Freedom Conservancy] announced that she planned to stand for the Linux Foundation board during a presentation last September [YouTube link]. A short time later, the "Individual membership" program was quietly renamed to the "Individual supporter" program and the promised benefit of being allowed to stand for and participate in board elections was dropped (compare the old page to the new one)." Garrett speculates that the GPL enforcement suit that the Software Freedom Conservancy is funding against VMware, which is an LF member, is ultimately behind the move.He also notes (the [2] above) that there is still a community representative from the Technical Advisory Board (TAB) that sits on the LF board.

OSNews reportsthat the Dutch consumer protection advocacy agency Consumentenbond hassued Samsung, demanding updates for its Android phones. "The Consumentenbond had been in talks with Samsung about this issue for a while now, but no positive outcome was reached, and as such, they saw no other option but to file suit.The Consumentenbond is demanding that Samsung provides two years of updatesfor all its Android devices, with the two-year period starting not at thedate of market introduction of the device, but at the date of sale. Thismeans that devices introduced one or even more years ago that are stillbeing sold should still get two years' worth of updates startingtoday." (Thanks to Paolo Bonzini)

Unused code is untested code, which probably means that it harborsbugs—sometimes significant security bugs. That lesson has been reinforced by the recent OpenSSH"roaming" vulnerability. Leaving a half-finished feature only in the clientside of the equation might seem harmless on a cursory glance but, ofcourse, is not. Those who mean harm can run servers that "implement" thefeature to tickle the unused code. Given that the OpenSSH project has astrong security focus (and track record), it is truly surprising that ablunder like this could slip through—and keep slipping through for roughly six years.Subscribers can click below to read the full story from the week's edition.