Story

Comments

The Mozilla blog has disclosedthat the official Mozilla instance of Bugzilla was recentlycompromised by an attacker who stole "security-sensitiveinformation" related to unannounced vulnerabilities inFirefox—in particular, the PDFViewer exploit discovered on August 5. The blog post explains thatMozilla has now taken several steps to reduce the risk of futureattacks using Bugzilla as a stepping stone. "As an immediatefirst step, all users with access to security-sensitive informationhave been required to change their passwords and use two-factorauthentication. We are reducing the number of users with privilegedaccess and limiting what each privileged user can do. In other words,we are making it harder for an attacker to break in, providing feweropportunities to break in, and reducing the amount of information anattacker can get by breaking in."

CentOS has updated spice(C7: code execution) and spice-server(C6: code execution).Debian has updated chromium-browser (multiple vulnerabilities) and screen (denial of service).Fedora has updated mediawiki (F21; F22:multiple vulnerabilities)and struts (F22: input validation bypass).openSUSE has updated firefox(13.1, 13.2: multiple vulnerabilities).Oracle has updated bind (O7; O6; O5: denial of service), bind97 (O5: multiple vulnerabilities), libXfont (O7; O6:multiple vulnerabilities),spice (O7: code execution), and spice-server (O6: code execution).Red Hat has updated chromium-browser (RHEL6: multiple vulnerabilities), openshift (RHOSE3: denial of service), openstack-nova (RHELOSP7: denial of service), qemu-kvm-rhev (RHELOSP7: information leak), spice (RHEL7: code execution), and spice-server (RHEL6: code execution).Scientific Linux has updated spice-server (SL7; SL6:code execution).Slackware has updated seamonkey (multiple vulnerabilities).SUSE has updated kernel (SLELP12 3.12.43; 3.12.39; 3.12.38; 3.12.36; 3.12.32: multiple vulnerabilities).Ubuntu has updated kernel (12.04: information leak; 14.04: code execution),libvdpau (12.04, 14.04, 15.04:multiple vulnerabilities), linux-lts-trusty (12.04: code execution), linux-ti-omap4 (12.04: information leak), and openslp-dfsg (12.04, 14.04, 15.04: denialof service).

Governing Board officers serve two-year terms and ensure adherence to annual plans and budgets.

Comments

Like I said, it's Android week in the technology world right now, but I'm not going to write a new post for every Android phone being thrown onto the world stage to be forgotten in a week. Instead, I'm going to focus on a few that I think are particularly interesting, and I'm going to start with Sony. The company has unveiled its Xperia Z5 line and it has to be said - the Z5 Compact, the Z5, and the Z5 Premium are absolutely gorgeous.In terms of essential specs, the three Z5s are pretty similar. (The main differences are size, materials, and screen resolution.) Thereâs the same Snapdragon 810 64-bit processor powering each of them, with both the Z5 and Z5 Premium sporting 3GB of RAM while the smaller Compact gets 2GB. All three devices are dust-tight and waterproof with capless micro USB ports, offer up to 32GB of internal memory (expandable up to 200GB with microSD cards), and have enough battery to last for up two days' use, says Sony.The Z5 Premium is a monster of a phone - it has a 4K display, which equates to 3840x2160 pixels and a ppi of 806. Pure insanity. Sony claims all three phones - even the Premium - get 2 days of use on a single charge. They look fantastic, but for some reason, nobody seems to buy Sony smartphones.Moving on, Lenovo unveiled a bunch of smartphones, and I think one of them might be of interest to many of you.The Vibe P1 and P1m slot in underneath the S1 just slightly, and they're all about simple features and battery life. The Vibe P1 is an all-metal affair, with a 5.5-inch 1080p display, Snapdragon 615 processor, 2GB of RAM, 32GB of storage, 13MP rear camera and an absolutely huge 5000 mAh battery. That battery enables reverse charging of other devices over USB, and sports quick charging capabilities.That's a positively huge battery, and should enable some major battery life.Lastly, there's a new company - lead by former Apple CEO John Sculley - who also unveiled two brand new Android smartphones. The company's called Obi, and their first two phones are the SF1 and SJ1.5. I'll be honest here - I want these phones' babies. They look fun, quirky, and different, and represent a welcome change from the boring, metallic, cold, hospital-esque stuff we get from other phone makers. They got decent specs, too.That being said, it's a startup - big name co-founder or no - and there's no information on availability and pricing yet, so for all I know, they're never going to be heard from again. Also, as with all the phones mentioned in this post, they're not running stock Android, so don't expect timely updates.Still, these are some interesting phones.

Arch Linux has updated bind (twodenial of service flaws).CentOS has updated bind (C7; C6; C5: denial of service), bind97 (C5: denial of service), andlibXfont (C7; C6: three privilege escalation flaws).Debian has updated bind9 (denialof service), qemu (multiplevulnerabilities), and qemu-kvm (two vulnerabilities).Debian-LTS has updated openslp-dfsg (three vulnerabilities, one from2010, another from 2012).Red Hat has updated bind (RHEL6,7; RHEL5: denial of service), bind97 (RHEL5: denial of service), and libXfont (RHEL6,7: three privilege escalation flaws).Scientific Linux has updated bind (SL6,7; SL5:denial of service), bind97 (SL5: denial ofservice), and libXfont (SL6,7: threeprivilege escalation flaws).Slackware has updated bind (twodenial of service flaws).SUSE has updated bind (SLE12; SLE11SP2,3,4: denial of service), kernel (SLE11SP2: multiple vulnerabilities,three from 2014), and xen (SLE11SP3;SLED11SP3: multiple vulnerabilities).Ubuntu has updated bind9 (denialof service).

Printing biz to get new bosses in shakeup HP is apparently hoping to sell off its TippingPoint security branch – and has reshuffled execs at the top of its printer and PCs biz – as the looming corporate breakup closes in.…

Asus has crafted the follow-up to its ZenWatch, the ZenWatch 2, and it comes in two face sizes: 1.63" and 1.45". The company not-so-subtly indicates that the bigger version is meant "for him," while the more petite one is "for her." There's no accounting for taste, but both watches look stylish enough to my eyes:...Read more...

Comments

Arch Linux has updated chromium (multiple vulnerabilities).CentOS has updated gdk-pixbuf2 (C7; C6: code execution), jakarta-taglibs-standard (C7; C6: code execution), nss-softokn (C7; C6: signature forgery), and pcs (C7; C6: privilege escalation).Debian has updated pdns (denial of service).Scientific Linux has updated nss-softokn (SL6,7: signature forgery) and pcs (SL6,7: privilege escalation).Slackware has updated gdk (code execution).SUSE has updated kvm (SLE11SP3:code execution) and firefox, nss (SLE12: multiple vulnerabilities).

New version of EDSA and SSA certification requirements to become effective 1 February 2016.