Several Russian developers lose kernel maintainership status
Perhaps one of the more surprising changes in the 6.12-rc4 development kernel was the removal of several entries from the kernel's MAINTAINERS file. The patch performing the removal was sent (by Greg Kroah-Hartman) only to the patches@lists.linux.dev mailing list; the change was included in a char-misc drivers pull request with no particular mention. The explanation for the removal is simply "various compliance requirements". Given that the developers involved all appear to be of Russian origin, it is not too hard...
13 minutes ago
Introducing AlmaLinux OS Kitten (AlmaLinux Blog)
The AlmaLinux project has introduced a new edition called "Kitten", which will serve as "the direct upstream for AlmaLinux OS and is the primary point for the AlmaLinux community to engage and influence the future of AlmaLinux OS". Not intended for production use, the first release is based on CentOS Stream 10 source, which will eventually be the basis for Red Hat Enterprise Linux (RHEL) 10: Because we anticipated many changes in 10, we wanted to get a head start on building...
about 7 hours ago
Another five stable kernels
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
about 8 hours ago
OpenSSL 3.4.0 released
Version 3.4.0 of the OpenSSL SSL/TLS library has been released. It adds a number of new encryption algorithms, support for "directly fetched composite signature algorithms such as RSA-SHA2-256", and more. See the release notes for details. From: Matt Caswell <matt-AT-openssl.org> To: "openssl-users-AT-openssl.org" <openssl-users-AT-openssl.org>, "openssl-project-AT-openssl.org" <openssl-project-AT-openssl.org> Subject: OpenSSL version 3.4.0 published Date: Tue, 22 Oct 2024 14:16:19 +0100 Message-ID: <0c3c865a-857f-4620-ab62-b71674b90ad1@openssl.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenSSL version 3.4.0 released ============================== OpenSSL - The Open Source toolkit for SSL/TLS https://www.openssl.org/ The...
about 8 hours ago
Security updates for Tuesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
about 9 hours ago
A new kernel testing tree
Sasha Levin has announced a new tree that is intended to perform continuous-integration tests of pull requests aimed at the mainline. The plan is for this tree to hold more finished work than sometimes ends up in linux-next; in a name that seems destined to create typographical confusion, it is called "linus-next". The linus-next tree aims to provide a more stable and testable integration point compared to linux-next, addressing the runtime issues that make testing linux-next challenging and focusing on...
1 day ago
Bootc 1.1.0 released
Version 1.1.0 of the bootc utility for performing transactional, in-place operating system updates using Open Container Initative (OCI) images, has been released. This release "officially stabilizes all APIs" for bootc and includes a number of bug fixes. LWN covered bootc in June.
1 day ago
Security updates for Monday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
1 day ago
A vulnerability in the Guix build system
The Guix project has disclosed a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a setuid binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue. This exploit requires the ability to start a derivation build and the ability to run arbitrary code...
1 day ago
Kernel prepatch 6.12-rc4
Linus has released 6.12-rc4 for testing. "I'm not happy with how big this is - it's probably far from the biggest rc4 ever, but it _is_ the biggest rc4 we've had in the 6.x series at least in number of commits." Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
2 days ago
Security updates for Friday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
4 days ago
Rust 1.82.0 released
Version 1.82.0 of the Rust language has been released. There are a lot of new features this time, including a cargo info command, tier-1 support for 64-bit Apple Arm systems, a new native syntax (&raw) to create raw pointers, changes to unsafe extern, unsafe attributes, standardized rules around the handling of floating-point not-a-number values, and more. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
5 days ago
Five new stable kernels
Greg Kroah-Hartman has announced the release of the 6.11.4, 6.6.57, 6.1.113, 5.15.168, and 5.10.227 stable kernels. As usual, this set of updates contains a long list of important fixes throughout the kernel tree. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
5 days ago
Security updates for Thursday
Dist. ID Release Package Date Debian DLA-3922-1 LTS python-cryptography 2024-10-17 Fedora FEDORA-2024-4d68c5928c F39 dnsdist 2024-10-17 Fedora FEDORA-2024-4ffc26d8cb F40 dnsdist 2024-10-17 Fedora FEDORA-2024-f7d6b76677 F39 python-virtualenv 2024-10-17 Fedora FEDORA-2024-112e897674 F40 python-virtualenv 2024-10-17 Red Hat RHSA-2024:8117-01 EL8 java-1.8.0-openjdk 2024-10-17 Red Hat RHSA-2024:8121-01 EL8 java-11-openjdk 2024-10-17 Red Hat RHSA-2024:8124-01 EL9.0 java-17-openjdk 2024-10-17 Red Hat RHSA-2024:8127-01 EL8 java-21-openjdk 2024-10-17 Slackware SSA:2024-290-01 libssh2 2024-10-16 Slackware SSA:2024-290-02 mozilla 2024-10-16 SUSE openSUSE-SU-2024:14402-1 TW haproxy 2024-10-16 SUSE SUSE-SU-2024:3658-1 MP4.1 MP4.2 SLE15 keepalived 2024-10-16 SUSE SUSE-SU-2024:3675-1 SLE15 oS15.6 libarchive 2024-10-16...
5 days ago
Forgejo 9.0 released
Version 9.0 of the Forgejo software forge system has been released. Changes include a switch to the GPLv3 license, the beginning of a quota system, the removal of go-git support, and a lot of fixes. (LWN looked at Forgejo in February). Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
6 days ago
Security updates for Wednesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
6 days ago
LibreSSL 4.0.0 released
Version 4.0.0 of the LibreSSL TLS/cryptography stack has been released. Changes include a cleanup of the MD4 and MD5 implementations, removal of unused DSA methods, changes in libtls protocol parsing to ignore unsupported TLSv1.1 and TLSv1.0 protocols, and many more internal changes and bug fixes. From: Brent Cook <busterb-AT-gmail.com> To: announce-AT-openbsd.org Subject: LibreSSL 4.0.0 Released Date: Tue, 15 Oct 2024 01:32:03 -0500 Message-ID: <Zw4MYxowekkMctiF@santo.lan> Archive-link: Article We have released LibreSSL 4.0.0, which will be arriving in the LibreSSL directory of...
7 days ago
Security updates for Tuesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
7 days ago
Inkscape 1.4 released
Version 1.4 of the Inkscape open-source vector-graphics editor has been released. Highlights of this release include a filter gallery, import for Affinity Designer files, internal links in exported PDFs, and more. See the release notes for all of the new features. LWN previewed the 1.4 release in early October.
8 days ago
Security updates for Monday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
8 days ago
Kernel prepatch 6.12-rc3
The 6.12-rc3 kernel prepatch is out for testing. So the diffstat looks a bit odd, because one of the fixes here caused the UTF tables to be regenerated, and an effective one-liner change turned into 6703 lines of diff. But if you ignore that effect, everything looks normal.
9 days ago
Security updates for Friday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
11 days ago
Ubuntu 24.10 released
Version 24.10 of the Ubuntu distribution is out. This release includes GNOME 47, Linux 6.11, security enhancements for managing Personal Package Archives (PPAs), experimental security controls for Snap packages, and more.
12 days ago
Updating Firefox is highly recommended
Mozilla has released Firefox versions 131.0.2, ESR 128.3.1, and ESR 115.16.1. These updates address a severe, remotely exploitable code-execution vulnerability that is evidently already being exploited. Updating to a fixed release seems like a wise thing to do. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
12 days ago
New stable kernels released
Greg Kroah-Hartman has announced the release of the 6.11.3, 6.10.14, 6.6.55, and 6.6.56 stable kernels. The 6.6.56 release fixes a problem with building perf in 6.6.55; "If you do not use the perf tool in the 6.6.y tree, there is no need to upgrade.". Meanwhile, 6.10.14 is the last of the 6.10.y series, so users should now be moving to 6.11.y. Other than 6.6.56, they contain the usual long list of important fixes throughout the kernel tree. Copyright © 2024,...
12 days ago
Security updates for Thursday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
12 days ago
Julia v1.11.0 has been released
The Julia project has released version 1.11.0. A separate blog post covers some of the highlights. The release includes a number of helpful features. In previous Julia versions, there was no "programmatic way" of knowing if an unexported name was considered part of the public API or not. Instead, the guideline was basically that if it was not in the manual then it was not public which was a bit underwhelming. To remedy that, there is now a public keyword...
13 days ago
Security updates for Wednesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
13 days ago
Security updates for Tuesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
14 days ago
OpenBSD 7.6 released
OpenBSD 7.6 has been released. Notable new features include work to improve suspend/resume on modern hardware, support for the arm64 Qualcomm Snapdragon X Elite laptops, as well as many improvements in hardware support and driver bug fixes. With this release all files that existed in the first commit in the OpenBSD source repository have been updated, modified or replaced at some point in time, reaching OpenBSD of Theseus. See the changelog for all changes between OpenBSD 7.5 and 7.6.
15 days ago
Python 3.13 released
Version 3.13 of the Python programming language has been released. The "What's New In Python 3.13" page has a summary of all the new features and changes. Highlights of the release include a basic JIT compiler, experimental support for free-threading, and much more. See the changelog for even more details.
15 days ago
Git 2.47.0 released
Version 2.47.0 of the Git source-code management system has been released. The changes include a long list of incremental improvements; see the announcement and this GitHub blog post for details. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
15 days ago
RPM 4.20 released
Version 4.20 of the RPM Package Manager (RPM) has been released. Major changes in this release include a new plugin to prevent filesystem and network access by scriptlets, the BuildSystem directive for declaring the build system to be used by packaged software, and more. LWN covered the development of RPM 4.20 in September.
15 days ago
Security updates for Monday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
15 days ago
Kernel prepatch 6.12-rc2
Linus has released 6.12-rc2 for testing. Anyway, this isn't one of the small rc2's. But looking at historical trends, being a bigger rc2 isn't _that_ unusual, and nothing in here looks all that odd. Yes, the diffstat may look a bit unusual, in that we had a global header renaming (asm/unaligned.h -> linux/unaligned.h) and we had a couple of reverts that stand out as spikes in the stats, but everything else looks nice and small.
15 days ago
Akamai finds many systems with exposed CUPS vulnerability
Akamai released a report pointing out that the recently-reported CUPS vulnerability (original disclosure) could be used to drive distributed denial-of-service (DDoS) attacks as well. Even if an attacker cannot gain remote control over a computer, they can still cause it to fetch a URL of their choice — potentially getting free DDoS amplification. The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet;...
17 days ago
Three Friday kernel updates
The 6.11.2, 6.10.13, and 6.6.54 stable kernels have been released. They contain important fixes, and upgrading is, as always, recommended.
18 days ago
oath-toolkit: privilege escalation in pam_oath.so (SUSE Security Team Blog)
The SUSE Security Team Blog has a detailed report on its discovery of a privilege escalation in the oath-toolkit, which provides libraries and utilities for managing one-time password (OTP) authentication. Fellow SUSE engineer Fabian Vogt approached our Security Team about the project's PAM module. A couple of years ago, the module gained a feature which allows to place the OTP state file (called usersfile) in the home directory of the to-be-authenticated user. Fabian noticed that the PAM module performs unsafe...
18 days ago
Security updates for Friday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
18 days ago
Security updates for Thursday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
19 days ago
Manjaro 24.1 released
Version 24.1 of the Arch-based Manjaro distribution is now available with the 6.10 Linux kernel, GNOME 46.5, KDE Plasma 6.1 and KDE Gear 24.08: Plasma 6.1 on Wayland now has a feature that "remembers" what you were doing in your last session like it did under X11. Although this is still work in progress, If you log off and shut down your computer with a dozen open windows, Plasma will now open them for you the next time you power up your desktop, making it...
20 days ago
Security updates for Wednesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
20 days ago
FFmpeg 7.1 released
Version 7.1 of the FFmpeg audio/video toolkit has been released. Important changes in this release include the VVC decoder reaching stable status, and inclusion of support for MV-HEVC decoding (which is generated by recent phones and VR headsets), as well as support for Vulkan encoding with H264 and HEVC. See the announcement and changelog for full details.
21 days ago
Firefox 131.0 released
Version 131.0 of the Firefox browser has been released. Changes include the ability to temporarily grant permissions to sites and a preview that pops up when hovering over tabs. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
21 days ago
Security updates for Tuesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
21 days ago
Four new stable kernels
The 6.11.1, 6.10.12, 6.6.53, and 6.1.112 stable kernels have been released. Each contains important fixes and users of those series should upgrade. Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
22 days ago
Tcl/Tk 9.0 released
The most recent major release of the Tcl/Tk language and graphical-user-interface toolkit, Tcl/Tk 9.0, has been released, a mere 27 years after the 8,0 major release in 1997. There have been plenty of releases in the interim, though, as can be seen in the Tcl chronology. The 9.0 release brings 64-bit data values, better Unicode support, the ability to use zip files as filesystems, a switch to use epoll() or kqueue() where they are available, SVG support in Tk, access...
22 days ago
Security updates for Monday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
22 days ago
Arch Linux getting support from Valve
The Arch Linux project has announced that Valve will be helping the distribution with a couple of important initiatives: Valve is generously providing backing for two critical projects that will have a huge impact on our distribution: a build service infrastructure and a secure signing enclave. By supporting work on a freelance basis for these topics, Valve enables us to work on them without being limited solely by the free time of our volunteers. From: Levente Polyak <anthraxx-fd97jBR+K/6hPH1hqNUYSQ-AT-public.gmane.org> To: Public...
23 days ago
Kernel prepatch 6.12-rc1
Linus has released 6.12-rc1 and closed the merge window for this release. Despite conference travel (both for me and several maintainers), things seemed to go mostly fairly normally. There's a couple of notable new features in here: For one thing, PREEMPT_RT is now mainlined and enabled as a config option (you do need to enable "EXPERT" to get the question). For another, sched_ext also got merged.
23 days ago
Górny: The perils of transition to 64-bit time_t
Michał Górny describes the challenges involved in transitioning Gentoo to year-2038-safe time representations: There is a general agreement that the way forward is to change time_t to a 64-bit type. Musl has already switched to that, glibc supports it as an option. A number of other distributions such as Debian have taken the leap and switched. Unfortunately, source-based distributions such as Gentoo don't have it that easy. So we are still debating the issue and experimenting, trying to figure out...
24 days ago
Security updates for Friday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
25 days ago
Remote exploit of CUPS
Security researcher Simone Margaritelli has reported a new vulnerability in CUPS, the software that many Linux systems use to manage printers and print jobs. Margaritelli describes the impact of the attack by saying: A remote unauthenticated attacker can silently replace existing printers' (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer). The vulnerability relies on a few related problems in CUPS libraries...
26 days ago
PostgreSQL 17 released
Version 17 of the PostgreSQL database has been released. This release of PostgreSQL adds significant overall performance gains, including an overhauled memory management implementation for vacuum, optimizations to storage access and improvements for high concurrency workloads, speedups in bulk loading and exports, and query execution improvements for indexes. PostgreSQL 17 has features that benefit brand new workloads and critical systems alike, such as additions to the developer experience with the SQL/JSON JSON_TABLE command, and enhancements to logical replication that simplify...
26 days ago
Uniting for Internet Freedom: Tor Project Tails Join Forces (Tor blog)
The online-privacy-focused Tor project has announced that it has "joined forces and merged operations" with the Tails OS Linux distribution. Countering the threat of global mass surveillance and censorship to a free Internet, Tor and Tails provide essential tools to help people around the world stay safe online. By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital...
26 days ago
Security updates for Thursday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
26 days ago
Eliminating Memory Safety Vulnerabilities at the Source (Google Security Blog)
Here's a post on the Google Security Blog on how switching to a memory-safe language can quickly reduce vulnerabilities in a project, even if a large body of older code persists. This leads to two important takeaways: The problem is overwhelmingly with new code, necessitating a fundamental change in how we develop code. Code matures and gets safer with time, exponentially, making the returns on investments like rewrites diminish over time as code gets older. For example, based on the...
27 days ago
Vanilla OS 2 - future plans, updates, and next release
The Vanilla OS project has published a blog post to answer questions that users have raised since the release of Vanilla OS 2. The post has information about the update strategy for the distribution, an enterprise version with support, and plans for an experimental version called Vanilla OS Vision. We are not planning for a potential Vanilla OS 3 because it is not yet necessary. As previously explained, our focus right now is on bug fixing and making the system...
27 days ago
Security updates for Wednesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
27 days ago
HarfBuzz 10.0.0 released
Version 10.0.0 of the HarfBuzz text-shaping engine has been released. Notable changes in this release include Unicode 16.0.0 support, adding Cairo script as an output format for hb-view, and a number of bug fixes.
28 days ago
Security updates for Tuesday
Copyright © 2024, Eklektix, Inc. Comments and public postings are copyrighted by their creators. Linux is a registered trademark of Linus Torvalds
28 days ago
Hy 1.0.0 released
Version 1.0.0 of Hy, a Lisp dialect that is embedded in Python, has been released after nearly 12 years in development. This is the first stable release of the project: Henceforth, breaking changes to documented parts of the language (other than dropping support for versions of Python that are themselves no longer supported by the CPython developers) will increase the major version number, and my intention is for that not to happen often, if at all. The 1.0.0 release supports...
29 days ago
Security updates for Monday
Dist. ID Release Package Date AlmaLinux ALSA-2024:6754 9 expat 2024-09-20 AlmaLinux ALSA-2024:6726 9 fence-agents 2024-09-20 AlmaLinux ALSA-2024:6682 8 firefox 2024-09-20 AlmaLinux ALSA-2024:6681 9 firefox 2024-09-20 AlmaLinux ALSA-2024:6757 9 libnbd 2024-09-20 AlmaLinux ALSA-2024:6783 9 openssl 2024-09-20 AlmaLinux ALSA-2024:6837 8 pcp 2024-09-20 AlmaLinux ALSA-2024:6848 9 pcp 2024-09-20 AlmaLinux ALSA-2024:6784 8 ruby:3.3 2024-09-20 AlmaLinux ALSA-2024:6785 9 ruby:3.3 2024-09-20 AlmaLinux ALSA-2024:6684 8 thunderbird 2024-09-20 AlmaLinux ALSA-2024:6683 9 thunderbird 2024-09-20 Debian DSA-5774-1 stable ruby-saml 2024-09-20 Fedora FEDORA-2024-0ce77b8571 F39 aardvark-dns 2024-09-21 Fedora FEDORA-2024-3d29b1647b F39 chromium 2024-09-22...
29 days ago