LWN.net

Dave Herman reportsthat with Firefox 48, Mozilla will ship its first Rust component to alldesktop platforms. "One of the first groups at Mozilla to make useof Rust was the Media Playback team. Now, it’s certainly easy to see thatmedia is at the heart of the modern Web experience. What may be lessobvious to the non-paranoid is that every time a browser plays a seeminglyinnocuous video (say, a chameleon poppingbubbles), it’s reading data delivered in a complex format and createdby someone you don’t know and don’t trust. And as it turns out, mediaformats are known to have been used to trick decoders into exposing nasty security vulnerabilities that exploit memory management bugs in Web browsers’ implementation code.This makes a memory-safe programming language like Rust a compelling addition to Mozilla’s tool-chest for protecting against potentially malicious media content on the Web."

CentOS has updated thunderbird (C7; C6; C5: code execution).Debian-LTS has updated drupal7(open redirect vulnerability) and graphicsmagick (two vulnerabilities).Fedora has updated expat (F22:multiple vulnerabilities), gnutls (F24:certificate verification vulnerability), gsi-openssh (F24: support GSI authentication),httpd (F24: authentication bypass), krb5 (F22: buffer overflow), mbedtls (F23: three vulnerabilities), pdfbox (F23: XML External Entity (XXE)attacks), pypy3 (F23; F22: two vulnerabilities), python (F22: startTLS stripping attack), python3 (F22: startTLS stripping attack), andsamba (F24: crypto downgrade).Oracle has updated thunderbird (OL7; OL6: multiple vulnerabilities).Ubuntu has updated libgd2(multiple vulnerabilities), nspr (denial ofservice), and nss (denial of service).

On his blog, Martin Gräßlin describes some of the multi-screen problems that users have been running into on KDE Plasma 5.7, what the causes are, and why multi-screen is a difficult problem to solve. "Many users expect that new windows open on the primary screen. Unfortunately primary screen does not imply that, it’s only a hint for the desktop shell where to put it’s panels, but does not have any meaning for normal windows.Of course windows should be placed on a proper location. If a window opens on a turned off external TV something is broken. And KWin wouldn’t do so. KWin places new windows on the “active screen”. The active screen is the one having the active window or the mouse cursor (depending on configuration setting). Unless, unless the window adds a positioning hint. Unfortunately it looks like windows started to position themselves to incorrect values and I started to think about ignoring these hints in future. If applications are not able to place themselves correctly, we might need to do something about it.Of course KWin allows the user to override it. With windowing specific rules one can ignore the requested geometry."

Greg Kroah-Hartman has released stable kernels 4.6.4 and 4.4.15. Both of them contain important fixes.

Arch Linux has updated thunderbird (code execution).Fedora has updated community-mysql (F24: unspecified), davfs2 (F24: unspecified), gimp (F23: use-after-free), krb5 (F23: buffer overflow), and nodejs-ws (F24; F23: denial of service).Gentoo has updated libpcre (multiple vulnerabilities) and squid (multiple vulnerabilities).Mageia has updated drupal (privilege escalation), libreoffice (code execution), libvirt (authentication bypass), mbedtls (three vulnerabilities), spice (two vulnerabilities), struts (two vulnerabilities), and tcpreplay (denial of service).openSUSE has updated glibc(Leap42.1: multiple vulnerabilities), libircclient (13.1: insecure cipher suites),and thunderbird (SPH for SLE12; Leap42.1, 13.2; 13.1: multiple vulnerabilities).Red Hat has updated thunderbird(RHEL5,6,7: code execution).SUSE has updated GraphicsMagick(SSO1.3, SLE11-SP4: multiple vulnerabilities), ImageMagick (SLE12-SP1; SLE11-SP4: many vulnerabilities), kvm (SLES11-SP4: multiple vulnerabilities),and kernel (SLERTE12-SP1: multiple vulnerabilities).

Linus has released the 4.7-rc7 kernelprepatch. "Anyway, there's a couple of regressions still being looked at, butunless anything odd happens, this is going to be the last rc. However,due to my travel schedule, I won't be doing the final 4.7 nextweekend, and people will have two weeks to report (and fix) anyremaining bugs.Yeah, that's the ticket. My travel schedule isn't screwing anythingup, instead think of it as you guys getting a BONUS WEEK! Yay!"See the current list of reportedregressions for the known issues remaining in the 4.7 kernel.

Python applications, like those written in other languages, often need toobtain random data for purposes ranging from cryptographic key generationto initialization of scientific models. For years, the standard way ofgetting that data is via a call to os.urandom(), which is documented to "return astring of n random bytes suitable for cryptographic use." Anenhancement in Python 3.5 caused a subtle change in howos.urandom() behaves on Linux systems, leading to some long,heated discussions about how randomness should be obtained in Python programs. When the dustsettles, Python benevolent dictator for life (BDFL) Guido van Rossum willhave the unenviable task of choosing between two competing proposals.

On his blog, Matthias Clasen announces the availability of some of the infrastructure for Portals, which are a way for Flatpak applications to reach outside of their sandbox."Most of these projects involve some notion of sandboxing: isolating the application from the rest of the system.Snappy does this by setting environment variables like XDG_DATA_DIRS, PATH, etc, to tell apps where to find their ‘stuff’ and using app-armor to not let them access things they shouldn’t.Flatpak takes a somewhat different approach: it uses bind mounts and namespaces to construct a separate view of the world for the app in which it can only see what it is supposed to access.Regardless which approach you take to sandboxing, desktop applications are not very useful without access to the rest of the system. So, clearly, we need to poke some holes in the walls of the sandbox, since we want apps to interact with the rest of the system.The important thing to keep in mind is that we always want to give the user control over these interactions and in particular, control over the data that goes in and out of the sandbox."

Debian-LTS has updated clamav(update to 0.99.2), icu (threevulnerabilities, two from 2015), and tcpreplay (denial of service).openSUSE has updated php5 (13.2:multiple vulnerabilities, one from 2015).Slackware has updated samba(crypto downgrade).

The LWN.net Weekly Edition for July 8, 2016 is available.

Ars Technica reports on the "HummingBad" malware that has infected millions of Android devices: "Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android." The article is based on a report [PDF] from Check Point, though the article notes that "researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices".

Debian has updated horizon (twovulnerabilities, one from 2015).openSUSE has updated ImageMagick(13.2: many vulnerabilities, lots from 2014 and 2015) and qemu (42.1: many vulnerabilities, lots from 2015).Scientific Linux has updated ocaml (SL7: information leak from 2015).Ubuntu has updated tomcat8(16.04: denial of service).In addition, Ubuntu has announced the end oflife for 15.10 on July 28 and the end oflife for 14.04.x hardware-enablement (HWE) stacks on August 4.

The Debian Edu team has announced Debian Edu 8+edu0 "Jessie", the latestDebian Edu / Skolelinux release. Debian Edu, also known as Skolelinux,provides a complete solution for schools. Debian Edu 8 is based on Debian8 "Jessie", update 8.5. "Do you have to administrate a computer labor a whole school network? Would you like to install servers, workstations and laptops which willthen work together? Do you want the stability of Debian with networkservices already preconfigured? Do you wish to have a web-based tool tomanage systems and several hundred or even more user accounts? Have youasked yourself if and how older computers could be used?Then Debian Edu is for you. The teachers themselves or their technicalsupport can roll out a complete multi-user multi-machine studyenvironment within a few days. Debian Edu comes with hundreds ofapplications pre-installed, but you can always add more packages fromDebian."

The digiKam team has announcedthe release of digiKam Software Collection 5.0.0. "This release marks almost complete port of the application to Qt5. All Qt4/KDE4 code has been removed and many parts have been re-written, reviewed, and tested. Porting to Qt5 required a lot of work, as many important APIs had to be changed or replaced by new ones.In addition to code porting, we introduced several changes and optimizations, especially regarding dependencies on the KDE project. Although digiKam is still a KDE desktop application, it now uses many Qt dependencies instead of KDE dependencies. This simplifies the porting job on other operating systems, code maintenance, while reducing the sensitivity of API changes from KDE project."

Those who are anxiously awaiting this week's edition later today (or tomorrow, depending on time zone) will have to wait another day. The US Independence Day holiday fell on Monday, so LWN staff took that day off for barbecues, fireworks, and other festivities. That means the edition will go out sometime in the early morning hours UTC on Friday, July 8. For those who celebrated the holiday, we hope you had a great one; for those who didn't, we certainly hope you had a great day too! We will be back on our normal schedule next week.

Arch Linux has updated libarchive (code execution), libreoffice-fresh (code execution), and xerces-c (denial of service).Debian-LTS has updated sqlite3 (information leak).Fedora has updated mingw-xerces-c (F23; F22:three vulnerabilities) and xerces-c (F23; F22: two vulnerabilities).Mageia has updated gimp (use-after-free), iperf (denial of service), libarchive (multiple vulnerabilities), libgd (multiple vulnerabilities), libtorrent-rasterbar (denial of service), php (multiple vulnerabilities), phpmyadmin (multiple vulnerabilities), pidgin (multiple vulnerabilities), squidguard (cross-site scripting), and xerces-c (denial of service).openSUSE has updated cronic(Leap42.1, 13.2: predictable temporary files), libircclient (Leap42.1; 13.2: insecure cipher suites), and xerces-c (13.2: code execution).SUSE has updated xen (SLE11-SP3:multiple vulnerabilities - some from 2013).Ubuntu has updated gimp (15.10,14.04, 12.04: use-after-free), libimobiledevice (16.04, 15.10, 14.04: socketslistening on INADDR_ANY), libusbmuxd(16.04, 15.10: sockets listening on INADDR_ANY), and tomcat6, tomcat7 (multiple vulnerabilities).

The last time LWN looked at formatted kernel documentationin January, it seemed like the merging of AsciiDoc support for thekernel's structured source-code documentation ("kernel-doc") comments, wasimminent. As Jonathan Corbet, in the capacity of the kernel documentationmaintainer, wrote: "A good-enough solution that exists nowshould not be held up overly long in the hopes that vague ideas forsomething else might turn into real, working code." Sometimes,however, the threat that something not quite perfect might be mergedis enough to motivate people to turn those vague ideas into somethingreal.Subscribers can click below to see the full story by guest author (and the developer behind most of the Sphinx work) Jani Nikula.

KDE Plasma 5.7 has been released.This release features the return of the agenda view in the calendar,improvements to the Volume Control applet allow volume control on aper-application basis, improved Wayland support, and more. "This release brings Plasma closer to the new windowing system Wayland. Wayland is the successor of the decades-old X11 windowing system and brings many improvements, especially when it comes to tear-free and flicker-free rendering as well as security. The development of Plasma 5.7 for Wayland focused on quality in the Wayland compositor KWin. Over 5,000 lines of auto tests were added to KWin and another 5,000 lines were added to KWayland which is now released as part of KDE Frameworks 5."

Debian has updated gimp (use-after-free), kernel (multiple vulnerabilities), libvirt (authentication bypass), tomcat7 (denial of service), and wireshark (multiple vulnerabilities).Debian-LTS has updated pidgin (multiple vulnerabilities).Fedora has updated gimp (F24:use-after-free), kernel (F23: multiplevulnerabilities), libreoffice (F23: codeexecution), mbedtls (F24: threevulnerabilities), mediawiki (F24; F23: multiple vulnerabilities), mingw-xerces-c (F24: three vulnerabilities),ntp (F23; F22: multiple vulnerabilities), php (F24; F23; F22: multiple vulnerabilities),php-pecl-zip (F24; F23; F22: twovulnerabilities), phpMyAdmin (F23;F22: multiple vulnerabilities), pypy(F24; F23:startTLS stripping attack), pypy3 (F24: twovulnerabilities), python3 (F23: twovulnerabilities), qemu (F23; F22: multiple vulnerabilities), setroubleshoot-plugins (F23: commandinjection), and xerces-c (F24: two vulnerabilities).openSUSE has updated gimp(Leap42.1, 13.2: use-after-free), GraphicsMagick (13.2: multiplevulnerabilities), kinit (Leap42.1, 13.2: privilege escalation), and spice (Leap42.1; 13.2: two vulnerabilities).Red Hat has updated nodejs010-node-gyp and nodejs010-nodejs-qs(RHSCL: denial of service) and openstack-ironic (RHOSP7 for RHEL7; RHOSP8: authentication bypass).Slackware has updated thunderbird (multiple vulnerabilities).

The 4.7-rc6 kernel prepatch is out, righton schedule. "I'd love to tell you that things are calming down, andwe're shrinking, but that would be a lie. It's not like this is a huge rc,but it's definitely bigger than the previous rc's were. I don't thinkthat's necessarily a big problem, it seems to be mostly timing."

Slackware Linux Project has announced the releaseof Slackware version 14.2. "Slackware 14.2 brings many updates and enhancements, among which you'll find two of the most advanced desktop environments available today: Xfce 4.12.1, a fast and lightweight but visually appealing and easy to use desktop environment, and KDE 4.14.21 (KDE 4.14.3 withkdelibs-4.14.21) a stable release of the 4.14.x series of the award-winning KDE desktop environment. These desktops utilize eudev, udisks,and udisks2, and many of the specifications from freedesktop.org whichallow the system administrator to grant use of various hardware devicesaccording to users' group membership so that they will be able to useitems such as USB flash sticks, USB cameras that appear like USB storage,portable hard drives, CD and DVD media, MP3 players, and more, allwithout requiring sudo, the mount or umount command. Just plug and play.Slackware's desktop should be suitable for any level of Linuxexperience." See the release notes formore details.

Rails 5.0 has been released.The announcement highlights two new features, the ActionCable framework for handling WebSockets and an "API mode" forinterfacing with client-side JavaScript. Development of the latterfeature is ongoing; progress can be tracked in the JSONAPI::Resourcesrepository. There are quite a few other new features to be found inthe update as well; the release announcement provides links todetailed ChangeLogs for various subprojects.

Debian-LTS has updated libvirt (authentication bypass), qemu (multiple vulnerabilities), qemu-kvm (multiple vulnerabilities), roundcube (cross-site scripting), wget (code execution), and wireshark (multiple vulnerabilities).Fedora has updated kernel(F24: multiple vulnerabilities), python-django-horizon (F23: cross-site scripting), python3 (F24: StartTLS stripping), squidGuard (F22; F23; F24: cross-site scripting), struts (F23; F24: multiple vulnerabilities),and wordpress (F22; F23; F24: multiple vulnerabilities).SUSE has updated kernel (SLE11; SLE12; SLE12 GA: multiple vulnerabilities).Ubuntu has updated oxide-qt(14.04, 15.10, 16.04: multiple vulnerabilities).

Linux Mint 18 has been released with Cinnamon and MATE editions. "Linux Mint 18 is a long term support release which will be supported until 2021. It comes with updated software and brings refinements and many new features to make your desktop even more comfortable to use." The MATE edition has MATE 1.14 along with many other updates listed on the What's New page. The Cinnamon edition has Cinnamon 3.0 (which we recently reviewed) and lots of other new packages described on its What's New page. The release notes pages (MATE, Cinnamon) also have important information on the releases.

The "Bits Please" blog has adetailed description of how one breaks full-disk encryption on anAndroid phone. Included therein is a lot of information on how full-diskencryption works on Android devices and its inherent limitations."Instead of creating a scheme which directly uses the hardware keywithout ever divulging it to software or firmware, the code above performsthe encryption and validation of the key blobs using keys which aredirectly available to the TrustZone software! Note that the keys are alsoconstant - they are directly derived from the SHK (which is fused into thehardware) and from two 'hard-coded' strings. Let's take a moment to explore some of the implications of thisfinding."

CoreOS has announced theavailability of version 3.0 of the etcd distributed key-value store."etcd 3.0 marks the first stable release of the etcd3 API and datamodel. Upgrades are simple, because the same etcd2 JSON endpoints andinternal cluster protocol are still provided in etcd3. Nevertheless, etcd3is a wholesale API redesign based on feedback from etcd2 users andexperience with scaling etcd2 in practice. This post highlights somenotable etcd3 improvements in efficiency, reliability, and concurrencycontrol."

Debian has updated libcommons-fileupload-java (denial ofservice), libreoffice (code execution), tomcat8 (multiple vulnerabilities, some from2015), and xerces-c (denial of service).Debian-LTS has updated libgd2(denial of service), php5 (multiplevulnerabilities), and xerces-c (denial of service).Fedora has updated setroubleshoot (F23; F22: codeexecution) and xguest (F23: insecurepassword creation).Ubuntu has updated libreoffice(16.04, 15.10, 12.04: code execution).

The LWN.net Weekly Edition for June 30, 2016 is available.

At last year's PyConin Montréal, Josh Triplett introduced thework he and others have done to port Python to run in the GRUB boot loader. At thisyear's PyCon in Portland, Oregon, he updated attendees on progress that hasbeen made in the BIOS Implementation Test Suite (BITS) toadd networking support. True to form, his presentation came with aneye-opening demonstration of the networking implemented in BITS.

Fedora has updated haproxy (F24:denial of service) and xguest (F24: insecure password creation).openSUSE has updated phpMyAdmin (Leap42.1, 13.2; 13.1: multiple vulnerabilities).SUSE has updated kvm (SLES11-SP3:multiple vulnerabilities) and qemu(SLE12-SP1: multiple vulnerabilities).

The PulseAudio 9.0 release is out. Changes include improvements toautomatic routing, beamforming support, use of the Linux memfd mechanism for transport, highersample-rate support, and more; see therelease notes for details.See also: thisarticle from Arun Raghavan on how the beamforming feature works."The basic idea is that if you have a number of microphones (a micarray) in some known arrangement, it is possible to 'point' or steer thearray in a particular direction, so sounds coming from that direction aremade louder, while sounds from other directions are rendered softer(attenuated)."

The -stable kernel release process faces a contradictory set of constraints.Developers naturally want to get as many fixes into -stable as possiblebut, at the same time, there is a strong desire to avoid introducing newregressions there. Each -stable release is, after all, intended to be morestable than its predecessor. At times there have been complaints that-stable is too accepting and too prone to regressions, but not manyspecifics. But, it turns out, this is an area where at least a little bitof objective research can be done.

GitHub has publishedits 2015 transparency report. "This 2015 report details the types ofrequests we receive for user accounts, user content, information about ourusers, and other such information, and how we process thoserequests. Transparency and trust are essential to GitHub and to the opensource community, and giving you access to information about these requestscan protect you, protect us, and help you feel safe as you work onGitHub." The report notes that a significant number of requests forremoval of content are notices submitted under the Digital MillenniumCopyright Act, or the DMCA.

Debian has updated kernel (multiple vulnerabilities).Debian-LTS has updated movabletype-opensource (SQL injection) and spice (information disclosure).Fedora has updated drupal7 (F23; F22:privilege escalation), gd (F24: threevulnerabilities), krb5 (F24: bufferoverflow), nodejs (F24: unspecified), andphpMyAdmin (F24: multiple vulnerabilities).Gentoo has updated icedtea-bin (multiple vulnerabilities) and kwalletd (misuse of crypto).openSUSE has updated rsync (13.2:unsafe destination path).SUSE has updated firefox, nss,nspr (SLE12-SP1: multiple vulnerabilities) and kernel (SLE12-SP1; SLE12: multiple vulnerabilities).Ubuntu has updated kernel (16.04; 15.10;14.04; 12.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiplevulnerabilities), linux-lts-utopic (14.04:multiple vulnerabilities), linux-lts-vivid(14.04: multiple vulnerabilities), linux-lts-wily (14.04: multiplevulnerabilities), linux-lts-xenial (14.04:multiple vulnerabilities), linux-raspi2 (16.04; 15.10:multiple vulnerabilities), linux-snapdragon(16.04: multiple vulnerabilities), and linux-ti-omap4 (12.04: multiple vulnerabilities).

Thierry Reding looksat Tegra support in Linux 4.7. "The XUSB driver has beenunder development for a ridiculously long time. One of the reasons is thatit relies on the XUSB pad controller to configure its pins as required bythe board design. The XUSB pad controller is very likely one of theleast-intuitive pieces of hardware I've ever encountered, and the attemptsto come up with a device tree binding to describe it have been verynumerous. We did finally settle on something earlier this year and afterthe existing code was updated for the new binding, we're finally able tosupport super-speed USB on Tegra124 and later." (Thanks to Martin Michlmayr)

The developers of "Project Triforce," an effort to run the "american fuzzylop" fuzz-testing tool in a system-wide manner, have posted adetailed description of what they are up to."AFL is an awesome tool. The power of an easy to use, feedback-drivenfuzzer has produced an absolutely staggering number of bugs. Still, atfirst AFL required being able to build the executable, something sadly notavailable on a lot of targets. With the addition of AFL's qemu_mode, itbecame possible to fuzz binaries without source, exposing a whole new worldof targets to AFL. I'd been on a number of Linux container engagementsrecently where we'd managed to escape through kernel exploits. I fellasleep one night to several AFL screens running, and I awoke suddenly witha crazy idea: 'Run AFL on the Linux Kernel.'"

The Mozilla blog has announcedthe first recipients of its Mozilla Open Source Support (MOSS) “MissionPartners” awards. "For many years people with visual impairments andthe legally blind have paid a steep price to access the Web onWindows-based computers. The market-leading software for screen readerscosts well over $1,000. The high price is a considerable obstacle tokeeping the Web open and accessible to all. The NVDA Project has developed an opensource screen reader that is free to download and to use, and which workswell with Firefox. NVDA aligns with one of the MozillaManifesto’s principles: “The Internet is a global public resource thatmust remain open and accessible.”" The NVDA project received $15,000. Other award recipients include Tor, Tails, Caddy, Mio, DNSSEC/DANE Chain Stapling, Godot Engine, and PeARS. (Thanks to Paul Wise)

Arch Linux has updated chromium (multiple vulnerabilities), libdwarf (multiple vulnerabilities), libpurple (multiple vulnerabilities), phpmyadmin (multiple vulnerabilities), vlc (code execution), and xerces-c (code execution).Debian has updated libpdfbox-java (XML External Entity (XXE) attacks).Debian-LTS has updated gimp(use-after-free), java-common (OpenJDK 6 nolonger supported), libcommons-fileupload-java (denial of service), mysql-connector-java (information disclosure), nss (denial of service), and tomcat7 (denial of service).Fedora has updated drupal7 (F24:privilege escalation), mirrormanager (F24; F23; F22: unspecified), optipng (F23: code execution), python (F23: man-in-the-middle attack), and qemu (F24: multiple vulnerabilities).Gentoo has updated claws-mail(multiple vulnerabilities), freexl(multiple vulnerabilities), hostapd(multiple vulnerabilities), imagemagick(multiple vulnerabilities), libssh(multiple vulnerabilities), plib (codeexecution from 2011), and sudo (privilege escalation).openSUSE has updated libarchive(13.2: denial of service), libav (Leap42.1:two vulnerabilities), libtasn1 (Leap42.1:denial of service), libtorrent-rasterbar(13.1: denial of service), mariadb(Leap42.1: multiple vulnerabilities), p7zip(Leap42.1: code execution), php5 (Leap42.1:multiple vulnerabilities), and rsync(Leap42.1: unsafe destination path).Oracle has updated kernel 2.6.32 (OL6; OL5:privilege escalation).Red Hat has updated kernel-rt(RHEMRG2.5: multiple vulnerabilities).Scientific Linux has updated kernel (SL7: two vulnerabilities).Slackware has updated php (multiple vulnerabilities).

The 4.7-rc5 kernel prepatch is out."I think things are calming down, although with almost two thirdsof the commits coming in since Friday morning, it doesn't feel thatway - my Fridays end up feeling very busy. But looking at the numbers,we're pretty much where we normally are at this time of the rcseries."

The just-released 4.6.3, 4.4.14, and 3.14.73 stable kernels contain a setof netfilter fixes that, it has just been disclosed, fix a couple of severelocal privilege-escalation vulnerabilities. Anybody who is running a sitewith user and network namespaces enabled will want to update their kernelsin short order. The fixes were originally committed into 4.6-rc2 in Aprilwith no comment regarding their implications.

Greg Kroah-Hartman has released stable kernel updates 4.6.3, 4.4.14, and 3.14.73. Each contains important fixesthroughout the tree.

CentOS has updated kernel(C7: multiple vulnerabilities), libxml2 (C6; C7: multiple vulnerabilities), ocaml (C7: information leak), setroubleshoot (C7: multiple vulnerabilities), and setroubleshoot-plugins (C7: multiple vulnerabilities).Fedora has updated python(F24: startTLS stripping), setroubleshoot (F24: code execution), and setroubleshoot-plugins (F24: code execution).Oracle has updated kernel(O7: multiple vulnerabilities), libxml2 (O6; O7: multiple vulnerabilities), ocaml (O7: information leak), and setroubleshoot and setroubleshoot-plugins(O7: multiple vulnerabilities).Red Hat has updated kernel(RHEL7: multiple vulnerabilities), kernel-rt (RHEL7: multiple vulnerabilities), and ocaml (RHEL7: information leak).Scientific Linux has updated libxml2 (SL 6,7: multiple vulnerabilities) and setroubleshoot andsetroubleshoot-plugins (SL7; SL6: multiple vulnerabilities).SUSE has updated kernel(SLE11: multiple vulnerabilities).

It seems that the Comodo TLS certificate authority (CA) has filed for three trademarks using variations of "Let's Encrypt". As might be guessed, the Let's Encrypt project is less than pleased by Comodo trying to coopt its name. "Since March of 2016 we have repeatedly asked Comodo to abandon their “Let’s Encrypt” applications, directly and through our attorneys, but they have refused to do so. We are clearly the first and senior user of “Let’s Encrypt” in relation to Internet security, including SSL/TLS certificates – both in terms of length of use and in terms of the widespread public association of that brand with our organization.If necessary, we will vigorously defend the Let’s Encrypt brand we’ve worked so hard to build. That said, our organization has limited resources and a protracted dispute with Comodo regarding its improper registration of our trademarks would significantly and unnecessarily distract both organizations from the core mission they should share: creating a more secure and privacy-respecting Web. We urge Comodo to do the right thing and abandon its “Let’s Encrypt” trademark applications so we can focus all of our energy on improving the Web."[Thanks to Paul Wise.]

Version 4.7 of the Xen hypervisor has been released. "With dozens ofmajor improvements, many more bug fixes and small improvements, andsignificant improvements to Drivers and Devices, Xen Project 4.7 reflects athriving community around the Xen Project Hypervisor." Some of thenew features include live patching, better dom0 robustness, bettermigration support between non-identical hosts, scheduler improvements, andmore. See therelease notes for more information.

Debian-LTS has updated squidguard(cross-site scripting).Fedora has updated php-symfony-security-acl (F24: unspecified). Also, Fedorahas sent out a reminder that Fedora 22will reach its end of life on July 19.Mageia has updated chromium-browser-stable (multiple vulnerabilities), kernel-linus (multiple vulnerabilities, one from 2013), kernel-tmb (multiple vulnerabilities, one from 2013), libimobiledevice (socket listening on allnetwork interfaces), and python (three vulnerabilities).openSUSE has updated libarchive(42.1: code execution), mariadb (13.2: manyunspecified vulnerabilities), and obs-service-source_validator (42.1; 13.2:code execution).Red Hat has updated libxml2(RHEL6&7: multiple vulnerabilities) and setroubleshoot andsetroubleshoot-plugins (RHEL7: three vulnerabilities).

The LWN.net Weekly Edition for June 23, 2016 is available.

Back in 2009, Sony removed the "install otherOS" option from its PS3 game consoles, removing the ability to installLinux on those machines. It then went after developers who figured out howto jailbreak the device. Ars technica reportsthat Sony has now settled a class-action lawsuit over those actions."Under the terms of the accord, which has not been approved bya California federal judge yet, gamers are eligible to receive $55 if theyused Linux on the console. The proposed settlement, which will be vetted bya judge next month, also provides $9 to each console owner that bought aPS3 based on Sony's claims about 'Other OS' functionality." Thelawyers, instead, get over $2 million.

CentOS has updated setroubleshoot(C6: multiple vulnerabilities) and setroubleshoot-plugins (C6: multiple vulnerabilities).Debian-LTS has updated icedove(multiple vulnerabilities) and python2.7 (three vulnerabilities).Fedora has updated expat (F24:multiple vulnerabilities), php-zendframework-zendxml (F23; F22:insecure ciphertexts), php-ZendFramework2 (F23; F22:insecure ciphertexts), and xen (F22: two vulnerabilities).openSUSE has updated Chromium(13.1: multiple vulnerabilities), ImageMagick (Leap42.1: command execution), and vlc (Leap42.1; 13.2: multiple vulnerabilities).Oracle has updated openssl (OL5:multiple vulnerabilities) and setroubleshootand setroubleshoot-plugins (OL6: multiple vulnerabilities).Red Hat has updated python-django-horizon (RHOSP8.0; RHELOSP7 for RHEL7; RHELOSP6 for RHEL7; RHELOSP5 for RHEL7; RHELOSP5 for RHEL6: cross-sitescripting) and setroubleshoot andsetroubleshoot-plugins (RHEL6: multiple vulnerabilities).

Version 1.3 of the Elixir programming language has been released. "Elixir v1.3 brings many improvements to the language, the compiler and its tooling, specially Mix (Elixir’s build tool) and ExUnit (Elixir’s test framework). The most notable additions are the new Calendar types, the new cross-reference checker in Mix, and the assertion diffing in ExUnit."

Not to be left behind by a certain competing project, the developers of theFlatpak packaging system have put out a pressrelease proclaiming its virtues. "The Linux desktop has longbeen held back by platform fragmentation. This has been a burden ondevelopers, and creates a high barrier to entry for third party applicationdevelopers. Flatpak aims to change all that. From the very start itsprimary goal has been to allow the same application to run across a myriadof Linux distributions and operating systems. In doing so, it greatlyincreases the number of users that application developers can easilyreach."