-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJV5IseAAoJEGVp2FWnRL6T9d0P/itDrO790Skfr4EAnzmfYLgB
d5KNhxqFUj+zYOOH2VQk7mc84GMEPVA7sQiwzUQO4ZnYESF4gjld5ZCTBsjtiDg3
rUtWQZyLKbOe0tVhJIOgRe/+B2i7KSmgBx4Yn4xU27H2qLmWPZDYobIPt+VBsI7T
U1cIGuJLQ0aFF/xogs5HbNoVjdki957Y8ROMfc4dkqNI1y7rbb7Czk88MzBWVAcV
R/NhA1QYExlpDOnQESX3VOA53qS/aqNHu+f7vnaQTGKCoromGeu0+N3cnbnjhrNM
u+59xwiGE6x3/gkaYhmgGJYq0+1+6WlY7PO9cR3YXM7xXfZsPV/H5IUOvn/FWugV
VIEO2OvguVqsRaA1wiqOplhUZ8E4tf2HIfO0yd8ZgVAIeB+jBqlN2uofKPcpFh5O
ZzC+YAB/HIr6r64WJn4hrEktCKWG+GB88ix3uOWKGVNMsEjNJUovU5CQWM+fzLIi
R18aXXYFCWDekiWKiK+lfyRWMcwpO6TkDRRY12YMTUYhkbo2S0u4Q8gf8XGHRARt
xiPHcVctmM8ojjKxQYe21R9Rbk88xm7LACyIC03TZv5z9AFJOH2KwKkme87omoGp
HxPEXtTYR9WWEZLY1fxLS4+intKNyCZvVUihN/yoWQIAj7C/5p1Ah4l7mF/5qbVo
+Oa+5XRC8A1MyreNKScB
=GzQQ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2726-1
August 31, 2015
expat vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Expat could be made to crash or run programs as your login if it opened a
specially crafted file.
Software Description:
- expat: XML parsing C library
Details:
It was discovered that Expat incorrectly handled malformed XML data. If a
user or application linked against Expat were tricked into opening a
crafted XML file, an attacker could cause a denial of service, or possibly
execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
lib64expat1 2.1.0-6ubuntu1.1
libexpat1 2.1.0-6ubuntu1.1
Ubuntu 14.04 LTS:
lib64expat1 2.1.0-4ubuntu1.1
libexpat1 2.1.0-4ubuntu1.1
Ubuntu 12.04 LTS:
lib64expat1 2.0.1-7.2ubuntu1.2
libexpat1 2.0.1-7.2ubuntu1.2
After a standard system upgrade you need to restart any applications linked
against Expat to effect the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2726-1
CVE-2015-1283
Package Information:
https://launchpad.net/ubuntu/+source/expat/2.1.0-6ubuntu1.1
https://launchpad.net/ubuntu/+source/expat/2.1.0-4ubuntu1.1
https://launchpad.net/ubuntu/+source/expat/2.0.1-7.2ubuntu1.2
Monday, August 31, 2015
[CentOS-announce] CESA-2015:1694 Moderate CentOS 6 gdk-pixbuf2 Security Update
CentOS Errata and Security Advisory 2015:1694 Moderate
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1694.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
07b16ceca0ae64ba2f21b9fb2e87ecd4aeecec4fc603ef8294f89afc66480bcd gdk-pixbuf2-2.24.1-6.el6_7.i686.rpm
4c6e2434f5f74a7e3ea88790d33caa61dbbd2e3cfbf54936ed18d221c0e2876e gdk-pixbuf2-devel-2.24.1-6.el6_7.i686.rpm
x86_64:
07b16ceca0ae64ba2f21b9fb2e87ecd4aeecec4fc603ef8294f89afc66480bcd gdk-pixbuf2-2.24.1-6.el6_7.i686.rpm
248633f4471b62666822d4c5da72f8995d36e6cf2e9e61b6eff73993709b793f gdk-pixbuf2-2.24.1-6.el6_7.x86_64.rpm
4c6e2434f5f74a7e3ea88790d33caa61dbbd2e3cfbf54936ed18d221c0e2876e gdk-pixbuf2-devel-2.24.1-6.el6_7.i686.rpm
f6dcd9fee4829caf414074fd45e577a9f4334747b6b429462ab4d64e7ab51b5c gdk-pixbuf2-devel-2.24.1-6.el6_7.x86_64.rpm
Source:
56cb617816f942b83c1693e0dce4572fb432b9f8d1433fda187e39e7b764bce9 gdk-pixbuf2-2.24.1-6.el6_7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1694.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
07b16ceca0ae64ba2f21b9fb2e87ecd4aeecec4fc603ef8294f89afc66480bcd gdk-pixbuf2-2.24.1-6.el6_7.i686.rpm
4c6e2434f5f74a7e3ea88790d33caa61dbbd2e3cfbf54936ed18d221c0e2876e gdk-pixbuf2-devel-2.24.1-6.el6_7.i686.rpm
x86_64:
07b16ceca0ae64ba2f21b9fb2e87ecd4aeecec4fc603ef8294f89afc66480bcd gdk-pixbuf2-2.24.1-6.el6_7.i686.rpm
248633f4471b62666822d4c5da72f8995d36e6cf2e9e61b6eff73993709b793f gdk-pixbuf2-2.24.1-6.el6_7.x86_64.rpm
4c6e2434f5f74a7e3ea88790d33caa61dbbd2e3cfbf54936ed18d221c0e2876e gdk-pixbuf2-devel-2.24.1-6.el6_7.i686.rpm
f6dcd9fee4829caf414074fd45e577a9f4334747b6b429462ab4d64e7ab51b5c gdk-pixbuf2-devel-2.24.1-6.el6_7.x86_64.rpm
Source:
56cb617816f942b83c1693e0dce4572fb432b9f8d1433fda187e39e7b764bce9 gdk-pixbuf2-2.24.1-6.el6_7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
reallost1.fbsd2233449 行政人员如何自我提升
行 政 管 理 实 操 训 练
【参加对象】 行政总监、行政经理、办公室主任、董事长秘书、总经理秘书、行政助理、行政主管等其它行政管理人员。
【时间地点】 2015年9月12-13日上海 9月19-20日北京、10月17-18日深圳
【授课方式】 案例分享、实务分析、互动讨论、专题研讨、培训游戏等
【学习费用】 3800/人（含课程讲义、午餐、茶点等）
垂询热线：上海：021-31006787、北京：010-5129-9910，深圳：0755-6128-0006
在·线·QQ：320588808 值班手机：189-189-56595 许先生
注：如不需此类信件信息，请转发送"删除"至wytuixin@163.com,我们会及时处理，谢谢您的理解。
课程赠送资料：行政管理部门全套岗位说明书
行政管理部门全套制度、全套流程
行政管理部门必须掌握的管理知识
PPT精美（400多个胚）模板
彼得德鲁克、稻盛和夫、杰克.韦尔奇等经典管理著作
【培训特点】 500强企业的工作背景、对不同企业的深入咨询经验，系统缜密的思维体系给学员专业的提升
【认证费用】 中级600/人;高级800/人(参加认证考试的学员须交纳此费用，不参加认证考试的学员无
须交纳)
备注：
1. 凡参加认证的学员，在培训结束参加考试合格者由《国际职业认证标准联合会》颁发《行政管理师》国际国内中英文版双职业资格证书，（国际国内认证/全球通行/社会认可/官方网上查询）；
2. 凡参加认证的学员须课前准备大一寸红底或蓝底数码照片；
3．课程结束后20个工作日内将证书快递寄给学员；
4．可申请中国国家人才网入库备案。
课程背景：
随着企业管理水平的不断提升，对行政管理的专业素质要求也越来越高，他们在工作中常遇到以下问题，不清楚行政管理在企业中的价值，不明晰自己的工作职责与角色定位，或者不知道如何去管理团队。诸如此类的问题，都是每个行政管理人员都要面对的，如何把握正确思路和方向、找到最适当方法，迅速提升自身职业素养、有效控制行政成本，更好的达成企业管理的目的。
培训目的：
本课程专门为行政总监、行政经理、董事会或总经办秘书、行政部门工作人员、部门经理助理、其他行政人员设计提升专业能力，成为上司在工作中的得力助手而设计的，目的是要使学员能够帮助上司提升工作效率与品质，维护商业形象，取得事业更大成功，成为老板的"管家"， 做好办公室的上传下达、做好领导的左膀右臂和参谋助手。
课程大纲：
第一讲 行政管理的使命与价值——稳定、高效、辅助
行政管理的定位
行政管理的困惑？
——杂、烦、琐碎、做得好大家没有感觉，做得不好大家都看得见
行政管理的定义与三重境界
一、如何让行政部工作出彩——第一个关键词：稳定
1. 每个接触点都是白金点
2. 行政管理的服务理念——有礼热情，有理服务
3. 工作分析的5个步骤
信件管理工作分析与最佳实践
卫生管理工作分析与最佳实践
食堂管理工作分析与最佳实践
司机接待工作分析与最佳实践
保安管理工作分析与最佳实践
督导督办工作分析与最佳实践
内部服务质量与服务利润链
行政团队建设的八个要素
行政团队建设的五个阶段
案例讨论：如何让行政部出彩
二、如何成为老板得力的管家人——第二个关键词：高效
1. 五个方面打造高效的行政团队
2. 预算管理
3. 行政采购体系搭建与战略采购
4. 打造高效型的行政组织机构
案例讨论：如何打造高效的行政团队？
三、成为老板的左右手和眼镜——第三个关键词：辅助
1. 差旅管理
2. 会议管理
会务分类－组织思路
组织阶段：会前准备、会中协助、会后整理
如何担任会议主持人
如何当好会议秘书？如何组织开会
如何避免陷于会议忙碌之中？
3. 时间管理
时间管理的四象限法则
时间管理的三个重要步骤
谋杀时间的四个凶手
4. 接待管理
商务礼仪的三个核心要素
商务接待
行政人员的着装、仪表、语言
行政接待安排与点菜
行政接待的无缝连接
案例讨论：如何接待考察公司的客户？
第二讲、 行政的使命、目的和价值——如何做一名出色的当家人
一、行政管理是一个专业的工作要有自己的方法、工具和技巧
1. 做好办公室工作的三要素——脑勤、嘴勤、腿勤；
2. 行政管理就是管人（包括管自己）、管事、管时间
二、卓越绩效模型——第四个关键词：管人
1. 意愿——什么是职业化的心态？
案例分享：野田圣子，追求卓越，成功自然相随
2. 职责
职业生涯中的劳伦斯定律
工作中的角色与ARCPI模型
行政管理人员如何跟其它部门人员打交道
行政管理人员如何跟上级打交道——管理者与信息
行政管理人员如何跟下属打交道——下属获得成就感的管理三要素
能力——提升能力的三种途径
案例讨论：行政主管职业生涯成功之道
三、行政管理人员的能力素质——管事
1. 能力素质模型基本概念与行政管理人员的能力素质模型的特点
行政管理人员的能力发展路径与岗位图谱
行政管理人员能力素质开发
案例分享：行政主管能力的素质模型
总裁秘书的能力素质模型
档案管理人员的能力素质模型
2. 行政管理人员沟通能力建设——行政人员必备技能
沟通的模型
语言与非语言沟通
成功沟通的四个步骤
沟通的三大法则
如何布置任务、批评和表扬下属
案例实战：如何批评司机王罡
3. 公文写作
公文写作技巧——公文写作的5个关键步骤
金字塔写作原则---公文写作的最佳写作法则
案例：高级秘书何芬的烦恼
实操演练：年终总结
4. PPT写作法则与技巧
PPT吸引人的关键法则——伟大的思想与广告式表达
PPT的3R原则
实战案例：8步铸就世界级ppt演讲
5. 行政管理人员解决问题能力建设——行政管理人员理性思维突破
界定问题——成功的出发点
分解问题——理性思维突破
优先排序——行动指南
分析议题——具体问题指引
关键性分析——具体问题具体分析
归纳建议---解决方案汇总
交流沟通—贯穿始终
案例实操：公司10周年庆典
6. 行政管理人员绩效管理能力建设——行政管理人员的核心工作
绩效管理成功的核心要素之一 —— 先人后事
绩效管理成功的核心要素之二 —— 两个勤劳的人（主管与人力资源绩效管理员）
绩效管理行政管理人员绩效管理指标库建设的两个工具——平衡积分卡与CQQT模型
绩效辅导与检查计划
绩效考核
绩效反馈面谈与改进计划
案例实操：如何考核公司秘书
7. 行政管理人员制度管理能力建设——行政管理人员必须掌握的核心技能
制度的制定——制度制定的7个要素
制度的管理——火炭效应与破窗户理论
案例实操：如何拟定管理制度
8. 行政管理人员流程管理能力建设——行政管理人员必备技能
流程的价值
流程的规范与标准格式
流程的三个关键成功要素
案例实操：会议管理流程
9. 行为规范建设
案例分享：某电力公司行为规范手册
总结：分享收获与行动计划
讲师介绍：【欧阳少波】
* 咨询培训经验：10年
* 专注于的业务领域
* 行政管理
* 战略管理
* 组织结构设计
* HCM全面解决方案
* 流程与制度管理
* 欧阳少波先生毕业于北京大学，拥有工商管理硕士学位
曾在微软、艾默生电气、伊顿、IBM工作，担任过接待专员、总经理、办事处主任、合伙人等职位。
他具有多年丰富的管理咨询和培训经验，为不同行业的国内外客户提供卓有成效的培训和咨询服务，所服务过的客户包括上市公司、国有独资企业、外商独资企业、民营企业及合资企业，行业涉及金融、能源、制造业、快速消费品、电信运营商等多个行业
授课风格：
案例分析 模拟演练 游戏导入
理论讲解 短片播放 故事调节
擅长课程：
《行政统筹管理实操训练》
《企业关键人才的招募、留用及管理实战解析》
《行政统筹管理》
《流程与制度管理》
《管理者与绩效管理》
《企业文化与品牌塑造》
《解决问题的能力塑造》
《金字塔公文写作》
《商务接待》
咨询项目：
2011 敏华控股组织人力项目 新奥燃气能力素质模型 人力资源专家
2010 格力电器绩效管理项目 项目经理
2010 中国电信运营中心人力资源战略规划 项目总监
2010 内蒙古锋威硅业流程、组织、制度、薪酬、绩效项目 项目经理
2010 江西煤炭集团战略规划 项目总监
2009 乌鲁木齐电信人力资源提升项目 项目经理
2009 长沙烟草服务品牌项目 项目经理
2009 江西蓝天驾校连锁项目一、项目二 项目经理
2008 宁波日升电器流程与制度、组织结构设计、薪酬与绩效管理项目 项目经理
2008 红松风力发电有限公司战略、组织与流程、薪酬与绩效项目 项目经理
2008 山东万丰集团组织、流程与制度、薪酬与绩效、股权激励项目 项目经理
2007上海豫园商城母子公司管控、子公司层激励、组织设计 项目经理
2007 用友移动商务有限公司组织、流程、薪酬与绩效、预算管理体系 项目经理
2007 中国石油西南销售公司绩效管理项目 项目经理
2006 中国电子信息产业集团公司战略项目 项目经理
培训特色：
授课层次清晰，条理性和逻辑性强。在培训过程中，活跃流畅，充分调动学员的积极性、参与性。注重启发式教学，充分运用案例和体验式教学方法，将理论与实际有效结合，在与大家分享心得的同时，使学员思考方式发生改变。此外欧阳老师亲和力非常强，亦很受客户领导、学员的喜爱。
曾培训或咨询过的企业有：
华润啤酒、山东电力、建亨集团、中国电信乌鲁木齐分公司、中国电信增值运营中心、中国移动网络管理中心、中石油华北油田钢管公司、中国石油西南销售公司、中国电子信息产业集团、中国南方电网、上海豫园、宁波日升电器有限公司等
客户评价：
行政统筹管理是杂烦乱的，但是培训老师能够使学员不觉得枯燥，气氛很活跃，学习到了平时工作中很理论知识 ，以及实操方法。
————上海英提尔交运汽车零部件有限公司 黄伟祥
行政人事工作杂乱、烦锁，通过华为，微软等案例，学习行政管理正确方法，行政管理正确思维和行政管理正确工具。
————江苏新亚房地产开发有限公司 曹丽华
课程精彩部份挺多的，但有一点，回去要实践的就是高效中的节约奖惩制度，做任何事，一定要"早一点，好一点，多一点"从事行政工作5年多，第一次参加有关行政管理类培训，让我把平常所做的事汇总，检讨。感觉很棒！！
————东莞万好 黄玉婵
老师的举例说明让人记忆深刻，能把学的内容用到实际的工作中去，把以往觉得难以处理的事务能有新方法更好的理顺，有信心在以后带领好自己的团队，课程时间有点短，能用三天来安排也许会更加理解深刻。
————明治(青岛)橡塑制品有限公司 彭大珍
课程非常有实操性，针对一件事情从最细节的地主出发分析，对我个人而言，课程让我更多关注到的就是行政管理方面的细节（会议接待，待人接物等）在行政基础如何做到出彩！
————宁波朗生医药有限公司 施佩佩
课程每一章都会有小组讨论，倾听同学的想法并进行点评，加深了课程的印象，对行政管理有了一个系统的理解。
————铿腾（上海）有限公司 陈朔涓
案例多，老师很幽默，课程气氛很好。认识到，一个人不是做越多越好，而且把重要的事做好。
————福建安健致远国际贸易有限公司 林聪
通过此次培训，对行政工作的定位作用，具体工作方法及领导者的能力有了全面的了解，同时也认识了各行各业的行政精英，正所谓"三人行，必有我师"，这将是一笔丰富的资源。
————湛江国联水产开发股份有限公司 唐岸莲
课程老师与学员互动，老师讲课非常的风趣，鼓励学员自己总结，根据老师的培训内容及案例，联系到自己的工作，有了很多新的想法和思路。
————耐驰（兰州）泵业有限公司 徐东
Saturday, August 29, 2015
LibreSSL 2.2.3 Released
We have released LibreSSL 2.2.3, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release is based on the stable OpenBSD 5.8 branch, fixing a bug
that affects interoperability with some SSL clients.
* LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not
include TLS extensions, resulting in such handshakes being aborted.
This release corrects the handling of such messages. Thanks to
Ligushka from github for reporting the issue.
* Added install target for cmake builds. Thanks to TheNietsnie from
github.
* Updated pkgconfig files to correctly report the release version
number, not the individual library ABI version numbers. Thanks to
Jan Engelhardt for reporting the issue.
The LibreSSL project continues improvement of the codebase to reflect
modern, safe programming practices. We welcome feedback and improvements
from the broader community. Thanks to all of the contributors who helped
make this release possible.
LibreSSL directory of your local OpenBSD mirror soon.
This release is based on the stable OpenBSD 5.8 branch, fixing a bug
that affects interoperability with some SSL clients.
* LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not
include TLS extensions, resulting in such handshakes being aborted.
This release corrects the handling of such messages. Thanks to
Ligushka from github for reporting the issue.
* Added install target for cmake builds. Thanks to TheNietsnie from
github.
* Updated pkgconfig files to correctly report the release version
number, not the individual library ABI version numbers. Thanks to
Jan Engelhardt for reporting the issue.
The LibreSSL project continues improvement of the codebase to reflect
modern, safe programming practices. We welcome feedback and improvements
from the broader community. Thanks to all of the contributors who helped
make this release possible.
Friday, August 28, 2015
[CentOS-announce] Infra : TLS redirection for lists.centos.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
As we announced it already (see
https://lists.centos.org/pipermail/centos-announce/2015-August/021341.html)
, the CentOS Project infra tream decided to implement/enforce TLS on a
maximum of websites/web services.
We have so implemented it for the mailman website :
https://lists.centos.org
Should you encounter an issue, feel free to either report it on
https://bugs.centos.org, or in #centos-devel on irc.freenode.net.
on behalf of the Infra team,
- --
Fabian Arrotin
The CentOS Project | http://www.centos.org
gpg key: 56BEC54E | twitter: @arrfab
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iEYEARECAAYFAlXgJF4ACgkQnVkHo1a+xU7mMQCgjbMs2oNQ9WZaKjf4qkbLJ2xD
TVgAn3eTiW8VOyyUHWbLOqVFEpmQo3rS
=B5lj
-----END PGP SIGNATURE-----
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Hash: SHA1
As we announced it already (see
https://lists.centos.org/pipermail/centos-announce/2015-August/021341.html)
, the CentOS Project infra tream decided to implement/enforce TLS on a
maximum of websites/web services.
We have so implemented it for the mailman website :
https://lists.centos.org
Should you encounter an issue, feel free to either report it on
https://bugs.centos.org, or in #centos-devel on irc.freenode.net.
on behalf of the Infra team,
- --
Fabian Arrotin
The CentOS Project | http://www.centos.org
gpg key: 56BEC54E | twitter: @arrfab
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iEYEARECAAYFAlXgJF4ACgkQnVkHo1a+xU7mMQCgjbMs2oNQ9WZaKjf4qkbLJ2xD
TVgAn3eTiW8VOyyUHWbLOqVFEpmQo3rS
=B5lj
-----END PGP SIGNATURE-----
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Thursday, August 27, 2015
[CentOS-announce] CESA-2015:1693 Critical CentOS 5 firefox Security Update
CentOS Errata and Security Advisory 2015:1693 Critical
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
4accd0ef78beb2cffe7de1eb2cb077d3260d2be1254241b94dcabd5429668ffa firefox-38.2.1-1.el5.centos.i386.rpm
x86_64:
4accd0ef78beb2cffe7de1eb2cb077d3260d2be1254241b94dcabd5429668ffa firefox-38.2.1-1.el5.centos.i386.rpm
ee12a3a8a5ef058838bb608ec2f7bedb4033c0a4494b14e562d0567f98b8fad6 firefox-38.2.1-1.el5.centos.x86_64.rpm
Source:
c90518b13fdd40682ddfed92ebff461d50ba1b4504e553119caf965de91e5892 firefox-38.2.1-1.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
4accd0ef78beb2cffe7de1eb2cb077d3260d2be1254241b94dcabd5429668ffa firefox-38.2.1-1.el5.centos.i386.rpm
x86_64:
4accd0ef78beb2cffe7de1eb2cb077d3260d2be1254241b94dcabd5429668ffa firefox-38.2.1-1.el5.centos.i386.rpm
ee12a3a8a5ef058838bb608ec2f7bedb4033c0a4494b14e562d0567f98b8fad6 firefox-38.2.1-1.el5.centos.x86_64.rpm
Source:
c90518b13fdd40682ddfed92ebff461d50ba1b4504e553119caf965de91e5892 firefox-38.2.1-1.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2015:1693 Critical CentOS 6 firefox Security Update
CentOS Errata and Security Advisory 2015:1693 Critical
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
1de25353a5da5a88b766f833b08fd919232f64d8c4bd22c21dc7a2a942a5882f firefox-38.2.1-1.el6.centos.i686.rpm
x86_64:
1de25353a5da5a88b766f833b08fd919232f64d8c4bd22c21dc7a2a942a5882f firefox-38.2.1-1.el6.centos.i686.rpm
cde86c052706e5e98ab2fd10657d9e538e0f30ba96765f2f31986a60e1f49c5e firefox-38.2.1-1.el6.centos.x86_64.rpm
Source:
e798d96ab134c3116832be3e7245e144d2a4929fc413114e7e501303ac7e6d89 firefox-38.2.1-1.el6.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
1de25353a5da5a88b766f833b08fd919232f64d8c4bd22c21dc7a2a942a5882f firefox-38.2.1-1.el6.centos.i686.rpm
x86_64:
1de25353a5da5a88b766f833b08fd919232f64d8c4bd22c21dc7a2a942a5882f firefox-38.2.1-1.el6.centos.i686.rpm
cde86c052706e5e98ab2fd10657d9e538e0f30ba96765f2f31986a60e1f49c5e firefox-38.2.1-1.el6.centos.x86_64.rpm
Source:
e798d96ab134c3116832be3e7245e144d2a4929fc413114e7e501303ac7e6d89 firefox-38.2.1-1.el6.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2015:1693 Critical CentOS 7 firefox Security Update
CentOS Errata and Security Advisory 2015:1693 Critical
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
ccd6daae6b5970ffd6d52ea9ef5b7fe86f7fe70433769e107da8e6e120f5cdda firefox-38.2.1-1.el7.centos.i686.rpm
8f0427d72b51874513dcff75cea91a9ad9c6df842274fa10962599793f07cb0e firefox-38.2.1-1.el7.centos.x86_64.rpm
Source:
39557ff01ea4da417e94adec1aa984713f4228164e660abec3fbb8357cff126d firefox-38.2.1-1.el7.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1693.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
ccd6daae6b5970ffd6d52ea9ef5b7fe86f7fe70433769e107da8e6e120f5cdda firefox-38.2.1-1.el7.centos.i686.rpm
8f0427d72b51874513dcff75cea91a9ad9c6df842274fa10962599793f07cb0e firefox-38.2.1-1.el7.centos.x86_64.rpm
Source:
39557ff01ea4da417e94adec1aa984713f4228164e660abec3fbb8357cff126d firefox-38.2.1-1.el7.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEBA-2015:1690 CentOS 7 kross-interpreters FASTTRACK BugFix Update
CentOS Errata and Bugfix Advisory 2015:1690
Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-1690.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
bff85d28d1892ca118dbd646a6f8c8b6e5bf954c282f8bcd424ce55c33cad0bd kross-interpreters-4.10.5-8.el7.x86_64.rpm
0dccd9630de7c99e87a7ed2b8e1a8bccfe2c34542fc79c4039a8e46db7016e1f kross-python-4.10.5-8.el7.x86_64.rpm
688aa654e71c511661bfefe293930102d1080373c8f10f1a6f0756bf6b55d2b6 kross-ruby-4.10.5-8.el7.x86_64.rpm
Source:
490537dc16654bc6615642fe1694036e8782092789392d8d359529463585916f kross-interpreters-4.10.5-8.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-1690.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
bff85d28d1892ca118dbd646a6f8c8b6e5bf954c282f8bcd424ce55c33cad0bd kross-interpreters-4.10.5-8.el7.x86_64.rpm
0dccd9630de7c99e87a7ed2b8e1a8bccfe2c34542fc79c4039a8e46db7016e1f kross-python-4.10.5-8.el7.x86_64.rpm
688aa654e71c511661bfefe293930102d1080373c8f10f1a6f0756bf6b55d2b6 kross-ruby-4.10.5-8.el7.x86_64.rpm
Source:
490537dc16654bc6615642fe1694036e8782092789392d8d359529463585916f kross-interpreters-4.10.5-8.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[USN-2723-1] Firefox vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEbBAEBCAAGBQJV31dIAAoJEGEfvezVlG4Pxm0H+Omc08b5HiiKxRkkNKFj0eoG
kKboT8glP3ikHjhDdhUmzI4J9X1aqZj8BX1r/zlb2vIPnqdgSTbahyR2g6zpnjYG
qrYA6cS6/AgXO+1JkbLwRePeAyfdBofcKX8ExGG4iR2Z+zwtCOJfHiIUhHZfGf+P
/skqw4LJKGya742RHnZBWBDZ2fcWuFq8BqXCmbEtVZNDVu5xg6EOaCY1xNjFXSrO
d++MgU99gba4oVhUxXy20en7IeOHW96sJksguxNlycvsH7kwy8KLo+M3FHrQUWVT
ICD2wMtzMJs8Rynwc99F+dRzAcWDG+4WzRXzxw9/9swg3I/BvfMwSkNtZv5gaw==
=gbaF
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2723-1
August 27, 2015
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
A use-after-free was discovered when resizing a canvas element during
restyling in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Firefox. (CVE-2015-4497)
Bas Venis discovered that the addon install permission prompt could be
bypassed using data: URLs in some circumstances. It was also discovered
that the installation notification could be made to appear over another
site. If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to install a malicious addon.
(CVE-2015-4498)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
firefox 40.0.3+build1-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
firefox 40.0.3+build1-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
firefox 40.0.3+build1-0ubuntu0.12.04.1
After a standard system update you need to restart Firefox to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2723-1
CVE-2015-4497, CVE-2015-4498
Package Information:
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.12.04.1
Version: GnuPG v2
iQEbBAEBCAAGBQJV31dIAAoJEGEfvezVlG4Pxm0H+Omc08b5HiiKxRkkNKFj0eoG
kKboT8glP3ikHjhDdhUmzI4J9X1aqZj8BX1r/zlb2vIPnqdgSTbahyR2g6zpnjYG
qrYA6cS6/AgXO+1JkbLwRePeAyfdBofcKX8ExGG4iR2Z+zwtCOJfHiIUhHZfGf+P
/skqw4LJKGya742RHnZBWBDZ2fcWuFq8BqXCmbEtVZNDVu5xg6EOaCY1xNjFXSrO
d++MgU99gba4oVhUxXy20en7IeOHW96sJksguxNlycvsH7kwy8KLo+M3FHrQUWVT
ICD2wMtzMJs8Rynwc99F+dRzAcWDG+4WzRXzxw9/9swg3I/BvfMwSkNtZv5gaw==
=gbaF
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2723-1
August 27, 2015
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
A use-after-free was discovered when resizing a canvas element during
restyling in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Firefox. (CVE-2015-4497)
Bas Venis discovered that the addon install permission prompt could be
bypassed using data: URLs in some circumstances. It was also discovered
that the installation notification could be made to appear over another
site. If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to install a malicious addon.
(CVE-2015-4498)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
firefox 40.0.3+build1-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
firefox 40.0.3+build1-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
firefox 40.0.3+build1-0ubuntu0.12.04.1
After a standard system update you need to restart Firefox to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2723-1
CVE-2015-4497, CVE-2015-4498
Package Information:
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/firefox/40.0.3+build1-0ubuntu0.12.04.1
Flock 2015 videos available
All recorded keynotes and sessions from the Flock 2015 conference in
Rochester, NY, USA are now available on YouTube via the following
playlist:
Rochester, NY, USA are now available on YouTube via the following
playlist:
<https://www.youtube.com/playlist?list=PL0x39xti0_64fA6uRtcfoJPkHfZdeVTRC>
Due to camera limitations, many of the slide presentations are not
easily visible on screen during the video. The Flock 2015 organizers
have asked all speakers to provide online versions for easier viewing.
The following wiki page is being updated to include content as the
speakers provide it:
<https://fedoraproject.org/wiki/Flock_2015_Talks>
If you find a session without slides listed, feel free to contact the
speaker directly to request an update to this wiki page.
--
Paul W. Frields http://paul.frields.org/
gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717
http://redhat.com/ - - - - http://pfrields.fedorapeople.org/
The open source story continues to grow: http://opensource.com
--
announce mailing list
announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/announce
[USN-2725-1] cups-filters vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV30R3AAoJEGVp2FWnRL6TZsoP/2eiUTFes06SvA+4Qh+wVjJk
MCYx86/mQ1xCG2G1Yd+POp/s8ERoxuDP2Mjow1aU1x8WvC5Wm46rtX8uSCfMrSND
OPMqMQW1Q5LbH/EXqTih6zbEzBdhSsYK93AAUa/uhvJjP8khKjqLARKgaozMBioQ
WzBqJtjUZdR+Ccr2db3iNeouogDgr9aRlhko8esV2qjfKtCW8ePqgqzfmtlEiQRM
AVmkE3t3JZxrlFnCOTGru+enME6fE0VWEsnfZQ2JtqGYKADPJBeeSX8Xy+IUBw+A
pj1ASwoBM4QKU6Ue8Aqfw+BfZDCCCYmUNx80c0qFW2abaqd5Gef/NXjg36jdMDaf
kEqy+N9OcR1mRr1/+saSD5vwOR0h5++30jduAir+syrm7RO27gTUdYB8IQvfP+QL
5tkzW3JOblrlrt23gIwuyXyW8XEA1C0xay8ZNjS/IncNSMLsnsr5IJWGwKUBsk7G
bAMCmh1wBs6gX3pCcWrkWLssVAS5f2iAFN7v/kSouPr9S0WV7GlmvJucvn9EPdLD
Ezl5r8U5NYIw2vUM9dcPDqx8BeurpC/oLssbif1N97zWYL5/6ESR0y+G6iLDYEfk
kJDxmfqUDxVQy5zewwBjDsWuUCPDuq2nfWZpzk3DcGM2O8sKL4OliBAASiAsWIza
NeMV0wg69sdqWxkUt+Gh
=Opao
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2725-1
August 27, 2015
cups-filters vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
Summary:
cups-filters would allow unintended access to printers over the network.
Software Description:
- cups-filters: OpenPrinting CUPS Filters
Details:
Seth Arnold discovered that ippusbxd in the cups-filters package would
incorrectly listen to all configured network interfaces. A remote attacker
could use this issue to possibly access locally-connected printers.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
cups-filters-ippusbxd 1.0.67-0ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2725-1
CVE-2015-6520
Package Information:
https://launchpad.net/ubuntu/+source/cups-filters/1.0.67-0ubuntu2.4
Version: GnuPG v1
iQIcBAEBCgAGBQJV30R3AAoJEGVp2FWnRL6TZsoP/2eiUTFes06SvA+4Qh+wVjJk
MCYx86/mQ1xCG2G1Yd+POp/s8ERoxuDP2Mjow1aU1x8WvC5Wm46rtX8uSCfMrSND
OPMqMQW1Q5LbH/EXqTih6zbEzBdhSsYK93AAUa/uhvJjP8khKjqLARKgaozMBioQ
WzBqJtjUZdR+Ccr2db3iNeouogDgr9aRlhko8esV2qjfKtCW8ePqgqzfmtlEiQRM
AVmkE3t3JZxrlFnCOTGru+enME6fE0VWEsnfZQ2JtqGYKADPJBeeSX8Xy+IUBw+A
pj1ASwoBM4QKU6Ue8Aqfw+BfZDCCCYmUNx80c0qFW2abaqd5Gef/NXjg36jdMDaf
kEqy+N9OcR1mRr1/+saSD5vwOR0h5++30jduAir+syrm7RO27gTUdYB8IQvfP+QL
5tkzW3JOblrlrt23gIwuyXyW8XEA1C0xay8ZNjS/IncNSMLsnsr5IJWGwKUBsk7G
bAMCmh1wBs6gX3pCcWrkWLssVAS5f2iAFN7v/kSouPr9S0WV7GlmvJucvn9EPdLD
Ezl5r8U5NYIw2vUM9dcPDqx8BeurpC/oLssbif1N97zWYL5/6ESR0y+G6iLDYEfk
kJDxmfqUDxVQy5zewwBjDsWuUCPDuq2nfWZpzk3DcGM2O8sKL4OliBAASiAsWIza
NeMV0wg69sdqWxkUt+Gh
=Opao
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2725-1
August 27, 2015
cups-filters vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
Summary:
cups-filters would allow unintended access to printers over the network.
Software Description:
- cups-filters: OpenPrinting CUPS Filters
Details:
Seth Arnold discovered that ippusbxd in the cups-filters package would
incorrectly listen to all configured network interfaces. A remote attacker
could use this issue to possibly access locally-connected printers.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
cups-filters-ippusbxd 1.0.67-0ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2725-1
CVE-2015-6520
Package Information:
https://launchpad.net/ubuntu/+source/cups-filters/1.0.67-0ubuntu2.4
reallost1.fbsd2233449 ezyom
销售精英2天强化训练
【时间地点】2015年8月29-30深圳、9月5-6上海、10月17-18北京、10月24-25深圳【参加对象】总经理、销售总监、区域经理、销售经理、业务代表、销售培训专员等。
【授课方式】理念+方法+工具，小组互动、案例分析、游戏分享、角色演练
【学习费用】 2800元2天/1人（含课程讲义、午餐、茶点等）
垂询热线：上海：021-31006787 ，深圳：0755-6128-0006，北京：010-5129-9910
QQ：320588808 值·班·手·机：18918956595 许先生
注：如不需此类课程信息，请发送删除至wytuixin@163.com"我们会及时为您处理，谢谢您的理解
课·程·背·景：
1. 为什么销售人员见到客户后总是找不到话说？
2. 为什么一听到客户提出异议，销售人员就轻易放弃？
3. 都知道要多听少说，但为什么遇到客户后连说都不会说呢？
4. 为什么针对不同的客户，销售人员说词却千篇一律？
5. 为什么销售人员经常向公司申请政策支持，但业绩却很不理想？
6. 为什么销售人员轻易给客户亮出自己的"底牌"？
7. 为什么有些销售人员嘴巴很能说，头脑也很聪明，但为什么业绩总是不理想？
8. 为什么有些人总是喜欢卖一些低价的、低,利润的产品，新产品却很难卖？
9. 为什么销售人员报销的费用越来越高，但业绩却越来越不理想？
10. 连续三个月没有业绩，有些人就坚持不住想跳槽了，怎么办？
讲·师·介·绍：[ 王越 ]
中国销售精英疯狂训练创始人；
销售团队管理咨询师、销售培训讲师；
曾任可口可乐（中国）公司业务经理；
阿里巴巴（中国）网络技术有限公司业务经理
清华大学.中山大学.南京大学EMBA特邀培训讲师；
2000年至今一直从事销售与销售人员激励与训练工作，曾任可口可乐的业务经理，全球知名企业阿里巴巴公司的业务经理，曾每月疯狂上门拜访100家以上的客户,半军事化的销售职业生涯，高强度的工作压力,全面系统的受训经历，积累了丰富的客户收集、销售谈判、客户跟进、客户服务、自我激励的经验，在公司曾获"悍将杯"榜眼。
主讲课程：
《销售精英疯狂训练营》 《销售主管巅峰训练》
《电话销售精英提升训练》 《店面销售技巧》
《礼仪与职业素养》 《销售中的考核与高压线》
《销售心理学》
课·程·特·色：
1.完成45次案例讨论,分组讨论，训练为主，互动式教学；2次现场考试;
2.真实案例分析，大量课后作业题，既有抢答，又有辩论，还有现场演练，热烈的课堂氛围；
3.将销售管理融入培训现场：
不仅关注个人学习表现，而且重视团队合作；
不仅关注2天以内的学习，而且营造2天以后的培训学习氛围；
不仅考核个人得分，而且考核团队得分；不仅考核学员的学习成绩，而且考核学员学习的参与度；
课·程·大·纲：
第一部份：角色认知篇
第一节、帮助客户赚钱,而永远不要去赚客户的钱;
一、帮助客户买产品，而不仅仅是卖产品给客户；
1.世界上没有百分之百让客户满意的产品,客户采购追求的 "5R"原则;
2.客户并不清楚自己的需求是如何满足;
3.客户提出的满足需求的条件不一定是合理的;
4.如何帮助客户建立一个排它性的采购标准?
案例分析:
A 为什么满足客户提出的要求,客户还是不愿意合作?
B 价格取决于什么?如何报价,才能让客户很难提出异议?
C 我公司品牌处于弱势的情况下,如何才能让客户对我们有信心?
二、销售就是把客户的事当作自己的事；
1.案例:成为"采购专家",而不仅仅是 "使用专家";
2.案例:为什么我们质量比对方的更好,居然没有选择我们?
3.案例:我们价格已经非常低了,客户此时还是一味地压价,怎么办?
三、销售就是把自己的事"不当回事"
不要暴露自己的功利心, 钓大鱼,应不动声色;
案例:第二、三次回访时到底应该聊些什么?
四、销售就是随时想着为别人提供哪些服务,
1.永远不要做一锤子买卖,宁可一位客户买100次,也不希望100位客户每人只买一次;
2.销售工作永远是有钱的捧个"钱场",没钱的捧个"人场"
第二节、给客户想买的,而不要卖我们想卖的;
1.客户是 "上帝"吗?你把客户看作什么?
2.为什么销售顾问见到客户之后总是找不到话说?
3.如何才能做到拜访多次之后,都能与客户愉快的沟通?
4.客户会选择性关注和记忆自己有兴趣的内容;
5.如何做到多听少说?如何应该让客户开口说呢?
6.哪些话应该说?哪些永远不要说呢?
7.如何控制与客户谈话的节奏?
第三节、成为别人信任的人,而不仅仅是有道理的人;
一、多一点认同,少一点辩驳;
1.为什么有些销售说得非常有道理,但客户还是不选择他?
2.推销产品之前如何做到先推销自己?
案例:当客户不认可你时,怎么做?
二、说客户喜欢听的,听客户喜欢说的;
1.客户最终选择的是自己最喜欢的人的产品;
2.谈判的成功往往并不是取决于谈判桌上,而是在谈判桌以外;
3.让别人快乐,自己更快乐,取悦心!
三、销售的成功取决于双赢,只有客户成功了,我们才能成功;
第四节 摆正自己的位置
1.任志强,潘石屹合影时主动下蹲给我们什么启示?
2.强势是体现在公司以及产品本身而不是表现在销售人员本人；
3.要有专家的知识，不要有专家的姿态
案例: 客户只有大小之分，没有贵贱之分；
4.客户提出的异议,有时候是针对事,更多的是针对人;
案例:客户异议方式不同的方式,反应客户不同的心态:笼统拒绝、贬低来源、歪曲事实、论点辩驳;
5.说什么,不重要,重要的是你当时是怎么说的?
案例:如何让客户即使不接受产品,也愿意跟你这个人交朋友?
6.人低为王，地低为海；示弱有时候更能获得别人的认同,案例:负荆请罪
第二部份：突破篇
第一节 不要对客户有偏见
1.为什么有些销售人员跟客户沟通时会紧张?
2.销售工作不是从客户的拒绝开始;
3.你看到的,不一定会相信,你相信的,一定会看到;
案例：有些客户明明不给我们合作的机会，但他们为什么还会热情地见我们？
第二节 保持空杯的心态
案例:三个月都没有业绩,是谁之过?
1.好工作是"做"出来的，而不是"找"出来的；
2.不要把自己 "托付"给公司,像女人托付给男人;
3.不要"拔苗助长",把自己当作"天才";
4.不要成为"高潜质,低绩效"的人;
5.不当 "猎手"当 "农夫";
6.不要期望通过重复以往相同的方式在新的工作岗位上得到不同的结果;
第三节、正确看待客户的拒绝；
1.二次见面,客户为什么对你发脾气？
2.不要轻易地告诉对方,我是一位"新人"
3.销售人员要有"要性",要合同,要时间,要人,要钱,要协助;
4.销售人员要有 "血性",进门之前有目的,出门之后有结果;
5.永远不相信没有结果的话:过一段时间、改天、月底、下周、晚几天、下个月、回头、到时候…
这样的话
6.当客户明确拒绝你时,你认为此时做的最重要的事是什么?
第四节、如何处理客户提出的 "异议"?
1. 没谈之前的设想的异议是无意义的；
案例:老科长被调走了,新科长还会来吗?
2. 客户把自己想法告诉我们的过程,是我们获得客户信任的过程;
3. 谈判需要筹码,有些筹码是无中生有; 客户给出的条件,有时候仅仅是一个诱惑;
案例:客户提出多种假设条件,是否应该给对方降价?
4. 谈判要双赢,而不是双输;
5. 当客户提出任何一个异议的时候,你应该马上反问他哪4个问题?
第五节：诚信是销售之本
1. 真诚和信誉一样,是客户对我们的评价;
案例:为什么我们很难跟夸夸其谈时的人成为朋友?客户也是;
2. 守时,守信,守约,及时传递信息;
3. 做回真实的自己,不要伪装自己;
为什么有些销售人员在客户面前的形象和生活中的他截然不一样,哪怕是与同事进行演练?
当销售人员在客户面前 "装",客户也一定会在销售人员面前 "装"礼仪,是因心内心尊重别人,
而不是包装自己;
案例:为什么服务员非常客气,但我们对他们却视而不见?
4. 客户的异议要提前处理;
为什么报完价格之后,客户就再也没有音讯了?
报价之前应该确认客户哪4个问题,减少客户提出的异议?
第六节：团队合作,无往不胜
一、再优秀的销售人员,同样有客户不喜欢;
二、客户拒绝你,就一定会拒绝你的同事吗?
三、四种常见的团队合作模式:
1、店面/展厅销售的团队合作模式
2、大客户销售的团队合作模式
3、客户信息量大的团队合作模式
4、新员工团队合作模式建议
四、有哪些因素影响客户是否接受销售人员?
1、销售人员形象与举止,以貌取人是人的天性;
2、是否具备相似的背景,门当户对;
3、是否具备相同的态度,道不同,不相为盟
4、是否具备相同的性格特征;
5、销售人员是否喜欢自己
眼睛是心灵的窗户,眼神可以杀死人,眼神同样可以迷死人
6、是否对销售人员熟悉,熟悉导致信任
销售人员是受雇于公司,但在客户的办公室里工作
8631+30的拜访计划
7、销售人员是否具备亲和力
8、销售人员是否值得信赖
如何才能让客户相信我说的意思是真的?
一个成功客户的案例应该包含哪12项?
第三部份 提升篇
第一节 客户购买决策的依据的是什么?
1、客户有兴趣就一定会购买吗？没有意向就一定不会买吗？
我们永远没办法去说服一个人,客户永远是被自己所说服;
案例:为什么花了大量的时间比对,最后购买的居然不是自己想要的产品?当初是因为什么下的决定?
2、我们都喜欢为自己的行为找一个理由
3、如何通过改变客户的行为导致改变他的想法？
4、关注客户做了什么,而不是说了什么;
测试:签订完合同后,如何让客户在以后合作过程中本能地拒绝竞品的推销?提高第二次购买机率?
案例:
客户是否付钱和付了多少钱一样同样重要;
客户约销售人员的时间和销售人员约客户的时间是两种意义;
客户到我们公司谈和我们到客户公司面谈是两种意义;
第二节 见什么人,说什么话;
时间、能力、精力、兴趣、文化水平、不同的职位等的影响因素
1. 什么情况下偏重于理性说服,打动别人的脑?
强调产品与服务的细节,公司的优势,产品的品质,列数字,合作专业用词
2. 什么情况下偏重于情感说服,打动别人的心?
让客户想象和联想,举例子,讲名气,讲行业的地位;
3. 何种情况下只讲优势不讲劣势？
不可"王婆卖瓜"
4. 何种情况下即讲优势又讲劣势？
不可 "画蛇添足"
[USN-2724-1] QEMU vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV3vw7AAoJEGVp2FWnRL6TI0cP/A6uH73aHw7Kn/HcKWYqvHJa
oTa3im8MFn6D51LSTvBONIwuAwp6Gp9oaqa0SCbtCPkmfL300WMHWOxW5XGPaz84
2SvmHBmDbPS2f3KovVYp3S1U3a5JnKQQzkSBj59ZgTlN3qjcnBRVOG3OzseD2s/W
5biQDVyOVEuNQqIj+4q2EsvvuvziT0s9tJFjIv9SbOsjuODBBupvLsaJW6G1cW0Q
//NfeXpuGp/WMnTbK5LpkMPUd+w1Y8l3u83IifyWZ8p/NpzPbkLJs79nYWs9WgUM
Yw0am96u6XzS6Zk8L49QCLLlp3Dv2GvumW305GJ6dYsTVY7nLXva9eo9BvgVrOGI
VHp78fOpzBtyfIijWdqxPttfv3NZSa2khSS53VBzCQ+3MiiPIIQ3suUUT7yCIS9h
1FVUafG9FAecFcHu29gCCTgFGoZ+/MhGYladBz3Oz4XF9PCWJIk/ypbJvj/k2bVa
nKVg63rPmJ8o3ukutsKqXm+s3KN7RloQxkjAmywDXPsMLs1p5rpdDoLkepdU/RV/
RdEdrTsbKEtkeGnwuV8Cj3u5yT6IsZStUYVWNXvdcRD/1g05fCZuKUgTsJxlxmfv
BAc/NVj+UxPS8x4bAXXuljzep//z86flK9QcP5Z6XTFqEHnunINu3gu2OaQXM5D5
9k37PKxdQJMr47DUjhap
=YAWA
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2724-1
August 27, 2015
qemu, qemu-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in QEMU.
Software Description:
- qemu: Machine emulator and virtualizer
- qemu-kvm: Machine emulator and virtualizer
Details:
It was discovered that QEMU incorrectly handled a PRDT with zero complete
sectors in the IDE functionality. A malicious guest could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9718)
Donghai Zhu discovered that QEMU incorrectly handled the RTL8139 driver.
A malicious guest could possibly use this issue to read sensitive
information from arbitrary host memory. (CVE-2015-5165)
Donghai Zhu discovered that QEMU incorrectly handled unplugging emulated
block devices. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile. This
issue only affected Ubuntu 15.04. (CVE-2015-5166)
Qinghao Tang and Mr. Zuozhi discovered that QEMU incorrectly handled memory
in the VNC display driver. A malicious guest could use this issue to cause
a denial of service, or possibly execute arbitrary code on the host as the
user running the QEMU process. In the default installation, when QEMU is
used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. This issue only affected Ubuntu 15.04. (CVE-2015-5225)
It was discovered that QEMU incorrectly handled the virtio-serial device.
A malicious guest could use this issue to cause a denial of service, or
possibly execute arbitrary code on the host as the user running the QEMU
process. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile. This issue
only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-5745)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
qemu-system 1:2.2+dfsg-5expubuntu9.4
qemu-system-aarch64 1:2.2+dfsg-5expubuntu9.4
qemu-system-arm 1:2.2+dfsg-5expubuntu9.4
qemu-system-mips 1:2.2+dfsg-5expubuntu9.4
qemu-system-misc 1:2.2+dfsg-5expubuntu9.4
qemu-system-ppc 1:2.2+dfsg-5expubuntu9.4
qemu-system-sparc 1:2.2+dfsg-5expubuntu9.4
qemu-system-x86 1:2.2+dfsg-5expubuntu9.4
Ubuntu 14.04 LTS:
qemu-system 2.0.0+dfsg-2ubuntu1.17
qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.17
qemu-system-arm 2.0.0+dfsg-2ubuntu1.17
qemu-system-mips 2.0.0+dfsg-2ubuntu1.17
qemu-system-misc 2.0.0+dfsg-2ubuntu1.17
qemu-system-ppc 2.0.0+dfsg-2ubuntu1.17
qemu-system-sparc 2.0.0+dfsg-2ubuntu1.17
qemu-system-x86 2.0.0+dfsg-2ubuntu1.17
Ubuntu 12.04 LTS:
qemu-kvm 1.0+noroms-0ubuntu14.24
After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2724-1
CVE-2014-9718, CVE-2015-5165, CVE-2015-5166, CVE-2015-5225,
CVE-2015-5745
Package Information:
https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.4
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.17
https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.24
Version: GnuPG v1
iQIcBAEBCgAGBQJV3vw7AAoJEGVp2FWnRL6TI0cP/A6uH73aHw7Kn/HcKWYqvHJa
oTa3im8MFn6D51LSTvBONIwuAwp6Gp9oaqa0SCbtCPkmfL300WMHWOxW5XGPaz84
2SvmHBmDbPS2f3KovVYp3S1U3a5JnKQQzkSBj59ZgTlN3qjcnBRVOG3OzseD2s/W
5biQDVyOVEuNQqIj+4q2EsvvuvziT0s9tJFjIv9SbOsjuODBBupvLsaJW6G1cW0Q
//NfeXpuGp/WMnTbK5LpkMPUd+w1Y8l3u83IifyWZ8p/NpzPbkLJs79nYWs9WgUM
Yw0am96u6XzS6Zk8L49QCLLlp3Dv2GvumW305GJ6dYsTVY7nLXva9eo9BvgVrOGI
VHp78fOpzBtyfIijWdqxPttfv3NZSa2khSS53VBzCQ+3MiiPIIQ3suUUT7yCIS9h
1FVUafG9FAecFcHu29gCCTgFGoZ+/MhGYladBz3Oz4XF9PCWJIk/ypbJvj/k2bVa
nKVg63rPmJ8o3ukutsKqXm+s3KN7RloQxkjAmywDXPsMLs1p5rpdDoLkepdU/RV/
RdEdrTsbKEtkeGnwuV8Cj3u5yT6IsZStUYVWNXvdcRD/1g05fCZuKUgTsJxlxmfv
BAc/NVj+UxPS8x4bAXXuljzep//z86flK9QcP5Z6XTFqEHnunINu3gu2OaQXM5D5
9k37PKxdQJMr47DUjhap
=YAWA
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2724-1
August 27, 2015
qemu, qemu-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in QEMU.
Software Description:
- qemu: Machine emulator and virtualizer
- qemu-kvm: Machine emulator and virtualizer
Details:
It was discovered that QEMU incorrectly handled a PRDT with zero complete
sectors in the IDE functionality. A malicious guest could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9718)
Donghai Zhu discovered that QEMU incorrectly handled the RTL8139 driver.
A malicious guest could possibly use this issue to read sensitive
information from arbitrary host memory. (CVE-2015-5165)
Donghai Zhu discovered that QEMU incorrectly handled unplugging emulated
block devices. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile. This
issue only affected Ubuntu 15.04. (CVE-2015-5166)
Qinghao Tang and Mr. Zuozhi discovered that QEMU incorrectly handled memory
in the VNC display driver. A malicious guest could use this issue to cause
a denial of service, or possibly execute arbitrary code on the host as the
user running the QEMU process. In the default installation, when QEMU is
used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. This issue only affected Ubuntu 15.04. (CVE-2015-5225)
It was discovered that QEMU incorrectly handled the virtio-serial device.
A malicious guest could use this issue to cause a denial of service, or
possibly execute arbitrary code on the host as the user running the QEMU
process. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile. This issue
only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-5745)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
qemu-system 1:2.2+dfsg-5expubuntu9.4
qemu-system-aarch64 1:2.2+dfsg-5expubuntu9.4
qemu-system-arm 1:2.2+dfsg-5expubuntu9.4
qemu-system-mips 1:2.2+dfsg-5expubuntu9.4
qemu-system-misc 1:2.2+dfsg-5expubuntu9.4
qemu-system-ppc 1:2.2+dfsg-5expubuntu9.4
qemu-system-sparc 1:2.2+dfsg-5expubuntu9.4
qemu-system-x86 1:2.2+dfsg-5expubuntu9.4
Ubuntu 14.04 LTS:
qemu-system 2.0.0+dfsg-2ubuntu1.17
qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.17
qemu-system-arm 2.0.0+dfsg-2ubuntu1.17
qemu-system-mips 2.0.0+dfsg-2ubuntu1.17
qemu-system-misc 2.0.0+dfsg-2ubuntu1.17
qemu-system-ppc 2.0.0+dfsg-2ubuntu1.17
qemu-system-sparc 2.0.0+dfsg-2ubuntu1.17
qemu-system-x86 2.0.0+dfsg-2ubuntu1.17
Ubuntu 12.04 LTS:
qemu-kvm 1.0+noroms-0ubuntu14.24
After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2724-1
CVE-2014-9718, CVE-2015-5165, CVE-2015-5166, CVE-2015-5225,
CVE-2015-5745
Package Information:
https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.4
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.17
https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.24
Wednesday, August 26, 2015
reallost1.fbsd2233449 您 好
客户关系管理与关键客户分析
——大客户成交方法和策略
【时间地点】 2015年8月29-30上海
【参加对象】 销售经理和总监、市场营销经理、全国范围和区域销售经理、业务发展经理、产品经理以及其他领域的管理人员。
【授课方式】 讲师讲授 + 视频演绎 + 案例研讨 +角色扮演 + 讲师点评
【学习费用】 3800元/1人，（含课程讲义、午餐、茶点等）
【垂询热线】 021-31006787、18918958501 许先生
【电子邮箱】 jsqyxuxin@vip.163.com 【QQ/微信】：320588808
注：如不需此类信件信息，请转发送"退订"至wytuixin@163.com,我们会及时处理，打扰之处，请您的理解。
课·程·背·景：
1、市场竞争高度激烈，成功的关键是与关键客户建立并保持密切、牢固的关系。
2、公司战略目标清楚，大多数管理人员却不懂得如何通过赢得关键客户来实现。
3、同质化时代，客户更加挑剔、理性，赢得关键客户必须打造系统的竞争优势。
4、要做到可持续性地赢得关键客户，销售人员必须实现从个人到团队，从野战到正规的转变。
培·训·目·的：
评估：系统的自我评估关键客户的驾驭能力，并且给予科学关键客户评估工具
执行：训练销售人员掌握一套关键客户销售的路径图与实现路径图的关键点
定义：让销售人员快速读取客户对公司价值的期望
探索：训练销售人员探索客户外部压力、业务目标和内部挑战，实现比客户还懂客户
联盟：内部联盟：整合公司资源，组成项目销售团队分配角色一致对外；
联盟：外部联盟：化解客户的外部驱动，实现业务目标和解决内部挑战，实现与客户内部联
盟定位：影响并获得客户对我们积极的评价，从而占领客户的心智
价值呈现：训练销售人员运用解决方案式的演讲模式来获得关键决策人的支持和承诺
差异化：独特的客户业务价值结合客户的外部驱动、业务目标和内部挑战，实现绝对竞争优势
培·训·收·益：
* 通过本课程你将能够：
* 从全局的角度系统地洞察关键客户管理
* 为公司制定一个成功的关键客户管理方案
* 全面地深度剖析关键客户的外部和内部要素
* 更加准确地在客户的内部建立关键人员联盟
* 在公司内部建立赢得关键客户的联盟
* 区别竞争对手并获得有利的竞争优势
* 影响采购决策团队的偏好来实现销售
* 进行关键决策人价值演讲来获得关键的支持和承诺
课·程·大·纲：
第一讲：关键理念——关键客户的定义和价值 Customer Expected Value
普通客户、大客户、关键客户的区别
关键客户的核心价值
如何赢得关键客户的最佳实践
关键客户期望的价值与公司能力的匹配
实现关键客户期望价值的思路与流程
小组讨论：聆听关键客户的声音
客户与供应商之间的博弈
自我检测：客户眼中的"你"和公司
关键客户销售艺术的演变趋势
客户管理和销售有何变化？
关键客户销售的艺术与科学
成功关键客户管理的三个维度（知识+技能+特质）42条胜任要求
第二讲：关键路线——赢得商机的路径，关键节点 Critical Roadmap & Milestones
关键客户的购买起因、流程与变化分析
关键客户的购买流程与销售的切入
优秀关键客户经理的最佳实践如何？
最佳销售路径图和阶段业务目标与里程碑
实现阶段业务目标必须完成的26个关键节点
通过关键节点的自我省查来实现销售行为的改变
自我诊断：你的关键客户现在处在哪个关键节点
行动计划：使用销售流程路线图，推动你的关键客户管理和销售效果
第三讲：关键技巧——技巧与流程交融，管理成交流程 Core Skills
技巧一：探索
探索客户的关键业务领域，充分理解客户的业务
案例分析：洞察客户的具体业务与内外部挑战
训练教导：以价值为导向的提问技巧
达到洞察客户的探索所需要完成的关键里程碑
自我诊断：如何与客户一起评估我们的探索水平
行动计划：使用探索技巧来改进客户管理水平
技巧二：联盟
内部联盟的积极结果和消极结果对比
关键客户管理内部联盟的组织和结构
关键客户管理外部联盟的高中低层的联盟区别
内部团队联盟如何对接外部客户团队联盟
达到内外联盟的所需要完成的关键里程碑
自我诊断：如何与客户一起评估我们的联盟水平
行动计划：使用联盟技巧来改进客户管理水平
技巧三：定位
关键客户定位的重要原则和要素
我们应该如何前瞻性定位我们自己
关键客户管理高中低层的定位区别
我们的优势和价值的前后期定位的侧重点
达到客户积极认可所需要完成的关键里程碑
自我诊断：如何与客户一起评估我们的定位水平
综合诊断：结合联盟和定位来判断我们现在所处的位置和问题
行动计划：使用联盟技巧来改进客户管理水平
技巧四：差异化
差异化最重要的三大成功要素
获得差异化的竞争优势所需要的关键里程碑
自我诊断：如何与客户一起评估我们的竞争优势
行动计划：使用差异化技巧来改进客户管理水平
技巧五：融会贯通，四技合一
四个技巧的时间循环和相互的转化
灵活修改关键里程碑柔性转化四个技巧，做到四技合一
第四讲：客户关系——关键客户的正确关系 Customer Relationship
四种客户关系（普通、优先、伙伴和战略）
诊断当前的关键客户关系和问题
正确定位关键客户的关系和预期结果
制定目标和计划来修正关键客户关系
关系重塑，做到"层高、面广、关系深"
小组讨论：赢得关键客户的正确关系
第五讲：独特方案——人无我有，人有我优 Unique Value Proposition
独特方案必须满足的六个维度
独特价值方案的框架和内容
独特价值方案的内在逻辑
实践操作：客户定制化的独特方案（结合现实客户）
现场指导：学员方案的反馈、点评和指导
第六讲：关键演讲——呈现说服，画龙点睛 Critical Presentation
剖析传统销售演讲的问题
关键演讲对象的驱动和需求分析
关键演讲的结构和逻辑和重点
演讲的时机选择和铺垫设置
关键信息的传递，预期目标的达成
实践操作：学员关键演讲（结合现实客户）
现场指导：学员演讲的反馈、点评和指导
讲·师·介·绍：[ 王·成 ]
关键客户管理教授
教·育·背·景:
* 世界500强汉高（中国）投资有限公司亚太区首席大客户销售总教练
* 原赫比（中国）有限公司销售教练
* 中国销售培训界既有实战销售管理经验又可中英双语授课的实战派讲师；
* 曾多次成功主导机械、无纺布、木工、无溶剂等行业高峰论坛，12年的上市公司大客户销售经验，10年的
世界500强企业，大客户销售教练经历，培训过的大客户销售人员超3000人。
实·战·经·验:
毕业后就职于瀚业（中国）信息技术有限公司（中美合资企业），短短的3个月时间，从一名普通的销
售员成长为公司的销售冠军并晋升为公司最年轻的销售主管，在领导销售团队的过程中，为了传递他的销售
经验，帮助销售员提升服务意识、进行客户分析、建立服务沟通模式、处理困难客户等，王成老师开发了《
电话销售》和《服务沟通》课程。至此，团队销售业绩连续三个月位居全公司第一名，并荣获2003年度冠军
团队奖。
2003-2005年就职于赫比（中国）有限公司（新加坡独资的上市公司），担任销售培训师、销售教练，
负责开发和培养团队主管以及销售技能培训，主讲的课程有《专业销售技巧》、《销售演讲技巧》、《有效
的沟通》、《会议管理》、《团队建设》、《时间和区域管理》，受到公司高层的一致赞誉。
2005至今任职于世界五百强汉高公司，先后担任大中华区首席销售培训师、中国区战略销售经理、中国
区销售人才发展经理、销售教练等职位。2007年公司的产品价格上调，导致销售人员业绩和信心急剧下滑，
王成老师迅速组织销售精英共同开发出《谈判技巧》和《涨价策略》两门课程，为汉高全球销售人员开展轮
训。经过轮训，不仅重振了销售人员的信心，更使业绩腾飞，远远超过了涨价前，为公司带来了近3亿元的
利润。
王成老师以专业和务实的态度开发并创新了公司业务模式，与国际和国内的多家行业领导者签订了战略
合作联盟，极大地增强了公司的竞争优势；发起并主持多个行业的高峰论坛，极大地增强了公司行业影响力
，并带来了业绩上的突破近亿元；参与建设汉高全球专业学院，负责销售课程的开发和优化、国外销售课程
的引进和本地化，课程有：《大客户管理系列》、《高级销售模式》、《价格诊断》、《涨价技巧》、《销
售演讲》、《销售管理》等。
主·讲·课·程:
版权销售管理课程系列：
《关键客户管理I—价值开发》、《关键客户管理II—商机规划和掌控》、《高级销售模式》
策略课程系列：
《谈判技巧》、《价格诊断》、《涨价策略》
授·课·风·格:
* 以多年上市公司和世界500强公司的实战销售经验为基础，
* 结合国外版权销售管理的新思路为核心，
* 注重培训理论化、实战化和工具化的结合，
* 课程观点新颖、语言幽默、案例贴切、气氛活跃，深入浅出，特别容易引起学员互动和共鸣。
* 将体验式、激励式、互动式、启发式等培训方式整合运用，透过互动启发式研讨交流，引导
* 学员突破旧有思维，注重实际操作。
课·程·特·点:
* 中、英双语授课
* 聚焦于学员实际问题，分析问题总结经验，帮助学员突破销售瓶颈。
* 注重实战与案例教学，对学员案例进行现场分解和重构，课堂中穿插实时的角色扮演和实战点评。
* 擅长抓住学员个体特点进行顺势辅导，对问题本质进行针对性解决。
* 课程效果反馈极佳。无论学员来自大陆，香港，台湾，日本、韩国、印度、马来西亚还是其
* 他国家和地区，大部分学有所得，成为行业销售精英。
* 主打课程《关键客户管理系列》深受客户好评。
Scientific Linux 6.7 Officially Released i386/x86_64
Scientific Linux 6.7 i386/x86_64 Aug 26, 2015
----------------------------------------------------------------------------
DOWNLOAD INFO
----------------------------------------------------------------------------
Network Install Images:
http://ftp.scientificlinux.org/linux/scientific/6.7/i386/os/images/boot.iso
http://ftp.scientificlinux.org/linux/scientific/6.7/x86_64/os/images/boot.iso
DVD Install Images:
http://ftp.scientificlinux.org/linux/scientific/6.7/i386/iso/
http://ftp.scientificlinux.org/linux/scientific/6.7/x86_64/iso/
Existing 6x systems should run:
yum clean expire-cache
----------------------------------------------------------------------------
Major Differences from SL6.6
----------------------------------------------------------------------------
* OpenAFS
- OpenAFS has been updated to the latest bugfix release (1.6.14)
* epel-release-6-8
- This RPM has been updated to the latest upstream release.
* glusterfs-server
- Built from the TUV provided sources for the glusterfs client.
----------------------------------------------------------------------------
POSSIBLE UPGRADE PROBLEMS
----------------------------------------------------------------------------
sssd-common is no longer multilib compatible. If you are using
sssd-common.i686 on x86_64 systems you will be unable to update. Please
remove the i686 rpm on your x86_64 systems to resolve this issue.
----------------------------------------------------------------------------
DOWNLOAD INFO
----------------------------------------------------------------------------
Network Install Images:
http://ftp.scientificlinux.org/linux/scientific/6.7/i386/os/images/boot.iso
http://ftp.scientificlinux.org/linux/scientific/6.7/x86_64/os/images/boot.iso
DVD Install Images:
http://ftp.scientificlinux.org/linux/scientific/6.7/i386/iso/
http://ftp.scientificlinux.org/linux/scientific/6.7/x86_64/iso/
Existing 6x systems should run:
yum clean expire-cache
----------------------------------------------------------------------------
Major Differences from SL6.6
----------------------------------------------------------------------------
* OpenAFS
- OpenAFS has been updated to the latest bugfix release (1.6.14)
* epel-release-6-8
- This RPM has been updated to the latest upstream release.
* glusterfs-server
- Built from the TUV provided sources for the glusterfs client.
----------------------------------------------------------------------------
POSSIBLE UPGRADE PROBLEMS
----------------------------------------------------------------------------
sssd-common is no longer multilib compatible. If you are using
sssd-common.i686 on x86_64 systems you will be unable to update. Please
remove the i686 rpm on your x86_64 systems to resolve this issue.
[USN-2722-1] GDK-PixBuf vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV3c/LAAoJEGVp2FWnRL6TY8kQALMvFOiuFOttf9hv7tWEeEIs
kYJ5sLyNMr5NgWncMPwTCzi9eM4kXNE0vfOAyo4uRMRi0ntJd0pCc5Go2DfEgPbM
q0CwNKiGJemdidS3VNIyuqBVqkdKrc2nfqADfhV+E2xZtlMMlpkOYtOSBJuVG+Da
I9eY3S4h64zgLfaDZVF+A+IBpbYxIYmeqPy4fDPacqDG/mK9e9V/ypIGTuqhp5zq
G7uHPpqem759ODIblqjKIkBtMTdC9xWzo2QyEWtLwl0MeomgzOvVGMX98nh5PMo2
9v/JmcPpSGgqxhWiZK4FBMgpI+RZFZirO9tj5NQHWzH6ue0dGiogKHsXjThGwgzl
KnsI0ThK7HBYXFoGu8TgX6BiAKkrjKGlosSgcdf8ofBiSLLP8VC9GJE+wSt1ihqS
E1SQOnPHLCjg/PJv1Tmn8VETW4kTWknB3l+c1yS7ANRWU3WFl7yQVrWbbHtUK5KB
F8hSCvP0VTZU6EhdZlSPXQpzK8dSkwq8assdlrqXCMu1XrLBqPcHNgZy4uLSu57j
LFUa3DeBmFfI7cVlXXYb9DTMoraRfYnETcrdBW2wpNOXXbZGZ1m9mnh/qa5y/Rn2
6bamINHYUUW3CR4nYEOx3Ksex/5HC26/voNQWWzNDdrDETTrt4tELrxbgmHLC6lF
Xq5LoSE2GC8CgwFNWRwz
=sm3a
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2722-1
August 26, 2015
gdk-pixbuf vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
GDK-PixBuf could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- gdk-pixbuf: GDK Pixbuf library
Details:
Gustavo Grieco discovered that GDK-PixBuf incorrectly handled scaling
bitmap images. If a user or automated system were tricked into opening a
BMP image file, a remote attacker could use this flaw to cause GDK-PixBuf
to crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
libgdk-pixbuf2.0-0 2.31.3-1ubuntu0.1
Ubuntu 14.04 LTS:
libgdk-pixbuf2.0-0 2.30.7-0ubuntu1.1
Ubuntu 12.04 LTS:
libgdk-pixbuf2.0-0 2.26.1-1ubuntu1.2
After a standard system update you need to restart your session to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2722-1
CVE-2015-4491
Package Information:
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.31.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.30.7-0ubuntu1.1
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.26.1-1ubuntu1.2
Version: GnuPG v1
iQIcBAEBCgAGBQJV3c/LAAoJEGVp2FWnRL6TY8kQALMvFOiuFOttf9hv7tWEeEIs
kYJ5sLyNMr5NgWncMPwTCzi9eM4kXNE0vfOAyo4uRMRi0ntJd0pCc5Go2DfEgPbM
q0CwNKiGJemdidS3VNIyuqBVqkdKrc2nfqADfhV+E2xZtlMMlpkOYtOSBJuVG+Da
I9eY3S4h64zgLfaDZVF+A+IBpbYxIYmeqPy4fDPacqDG/mK9e9V/ypIGTuqhp5zq
G7uHPpqem759ODIblqjKIkBtMTdC9xWzo2QyEWtLwl0MeomgzOvVGMX98nh5PMo2
9v/JmcPpSGgqxhWiZK4FBMgpI+RZFZirO9tj5NQHWzH6ue0dGiogKHsXjThGwgzl
KnsI0ThK7HBYXFoGu8TgX6BiAKkrjKGlosSgcdf8ofBiSLLP8VC9GJE+wSt1ihqS
E1SQOnPHLCjg/PJv1Tmn8VETW4kTWknB3l+c1yS7ANRWU3WFl7yQVrWbbHtUK5KB
F8hSCvP0VTZU6EhdZlSPXQpzK8dSkwq8assdlrqXCMu1XrLBqPcHNgZy4uLSu57j
LFUa3DeBmFfI7cVlXXYb9DTMoraRfYnETcrdBW2wpNOXXbZGZ1m9mnh/qa5y/Rn2
6bamINHYUUW3CR4nYEOx3Ksex/5HC26/voNQWWzNDdrDETTrt4tELrxbgmHLC6lF
Xq5LoSE2GC8CgwFNWRwz
=sm3a
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2722-1
August 26, 2015
gdk-pixbuf vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
GDK-PixBuf could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- gdk-pixbuf: GDK Pixbuf library
Details:
Gustavo Grieco discovered that GDK-PixBuf incorrectly handled scaling
bitmap images. If a user or automated system were tricked into opening a
BMP image file, a remote attacker could use this flaw to cause GDK-PixBuf
to crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
libgdk-pixbuf2.0-0 2.31.3-1ubuntu0.1
Ubuntu 14.04 LTS:
libgdk-pixbuf2.0-0 2.30.7-0ubuntu1.1
Ubuntu 12.04 LTS:
libgdk-pixbuf2.0-0 2.26.1-1ubuntu1.2
After a standard system update you need to restart your session to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2722-1
CVE-2015-4491
Package Information:
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.31.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.30.7-0ubuntu1.1
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.26.1-1ubuntu1.2
Tuesday, August 25, 2015
[CentOS-announce] CESA-2015:1682 Important CentOS 5 thunderbird Security Update
CentOS Errata and Security Advisory 2015:1682 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
4a3c17746a0f6eb4538da53dedb6ce365d7e26b3922ca2764ad95cb6552985be thunderbird-38.2.0-4.el5.centos.i386.rpm
x86_64:
085dda14f0c68b842c7b691e9ae8797cab53e0d4b9f21d6b739b023f53181e2d thunderbird-38.2.0-4.el5.centos.x86_64.rpm
Source:
caa0713b07db9133ad60279eebf11190f87a1113c9142276756f8cbbe8e1cd50 thunderbird-38.2.0-4.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
4a3c17746a0f6eb4538da53dedb6ce365d7e26b3922ca2764ad95cb6552985be thunderbird-38.2.0-4.el5.centos.i386.rpm
x86_64:
085dda14f0c68b842c7b691e9ae8797cab53e0d4b9f21d6b739b023f53181e2d thunderbird-38.2.0-4.el5.centos.x86_64.rpm
Source:
caa0713b07db9133ad60279eebf11190f87a1113c9142276756f8cbbe8e1cd50 thunderbird-38.2.0-4.el5.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2015:1682 Important CentOS 6 thunderbird Security Update
CentOS Errata and Security Advisory 2015:1682 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
212a3fb8ffd55e5b884a0d3d4a93b9fa329e42ec0d3da2697cd07f4164cab75d thunderbird-38.2.0-4.el6.centos.i686.rpm
x86_64:
2f599516b2700248194b1b0349de15698e6d5834417c78e4d9de1541033bca97 thunderbird-38.2.0-4.el6.centos.x86_64.rpm
Source:
02c890e4584b486f07a69663e905d4658aa623f1bd38f8ff107707324a06962f thunderbird-38.2.0-4.el6.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
212a3fb8ffd55e5b884a0d3d4a93b9fa329e42ec0d3da2697cd07f4164cab75d thunderbird-38.2.0-4.el6.centos.i686.rpm
x86_64:
2f599516b2700248194b1b0349de15698e6d5834417c78e4d9de1541033bca97 thunderbird-38.2.0-4.el6.centos.x86_64.rpm
Source:
02c890e4584b486f07a69663e905d4658aa623f1bd38f8ff107707324a06962f thunderbird-38.2.0-4.el6.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2015:1682 Important CentOS 7 thunderbird Security Update
CentOS Errata and Security Advisory 2015:1682 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
492a01e64a18f0d1800361dfd73d9678a07ce1c1eb75908e1c2c6a77dec9bfd8 thunderbird-38.2.0-1.el7.centos.x86_64.rpm
Source:
2a4b617361ac4ba011498b67672a799e315d1db60db9804a63af67efbe454380 thunderbird-38.2.0-1.el7.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1682.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
492a01e64a18f0d1800361dfd73d9678a07ce1c1eb75908e1c2c6a77dec9bfd8 thunderbird-38.2.0-1.el7.centos.x86_64.rpm
Source:
2a4b617361ac4ba011498b67672a799e315d1db60db9804a63af67efbe454380 thunderbird-38.2.0-1.el7.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:22.openssh
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-15:22.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH multiple vulnerabilities
Category: contrib
Module: openssh
Announced: 2015-08-25
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-25 20:48:44 UTC (stable/10, 10.2-STABLE)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RC3-p2)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RELEASE-p2)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-08-25 20:48:44 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted and authenticated transport for a variety of services,
including remote shell access.
The PAM (Pluggable Authentication Modules) library provides a flexible
framework for user authentication and session setup / teardown.
The default FreeBSD OpenSSH configuration has PAM interactive
authentication enabled.
Privilege separation is a technique in which a program is divided into
multiple cooperating processes, each with a different task, where each
process is limited to the specific privileges required to perform that
specific task, while the privileged parent process acts as an arbiter.
II. Problem Description
A programming error in the privileged monitor process of the sshd(8)
service may allow the username of an already-authenticated user to be
overwritten by the unprivileged child process.
A use-after-free error in the privileged monitor process of he sshd(8)
service may be deterministically triggered by the actions of a
compromised unprivileged child process.
A use-after-free error in the session multiplexing code in the sshd(8)
service may result in unintended termination of the connection.
III. Impact
The first bug may allow a remote attacker who a) has already succeeded
by other means in compromising the unprivileged pre-authentication
child process and b) has valid credentials to one user on the target
system to impersonate a different user.
The second bug may allow a remote attacker who has already succeeded
by other means in compromising the unprivileged pre-authentication
child process to bypass PAM authentication entirely.
The third bug is not exploitable, but can cause premature termination
of a multiplexed ssh connection.
IV. Workaround
No workaround is available, but systems where ssh(1) and sshd(8) are
not used are not vulnerable.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The sshd(8) service has to be restarted after the update. A reboot
is recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The sshd(8) service has to be restarted after the update. A reboot
is recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:22/openssh.patch
# fetch https://security.FreeBSD.org/patches/SA-15:22/openssh.patch.asc
# gpg --verify openssh.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the sshd(8) daemon, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r287144
releng/9.3/ r287147
stable/10/ r287144
releng/10.1/ r287146
releng/10.2/ r287145
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:22.openssh.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3Ne8AAoJEO1n7NZdz2rnxq8P/jW05a6zT9n78wxBuHwRJ9gx
7+CN9AsezavW4HmZF4GmWt6SjnJqpLDMwnhceo7po6ZMIxjyWwxBWWfvUwVqezwa
kT+DS7oHKmeZAwCSFMj9K25NN+x7KAwXXiiANcj4U4iU+q0YrcEGVIBKVqCAn3ly
pJAkMxdTbwlWR7MaPaTMbMenVOs87b6Xx/4gfSBWolFWz9bKfdTYCxK/AnULVIZq
Q7lShezEvgyCb8b6QLvnrY4AwHtVduiYxnvNKv8ysbaatZCarkRS8nh68zGcdTBg
IyzG5OEtUFokVkroJaLWFXL1mUp7tgn9+UNd0/53wFN2DTZKw9oTAkKn8xrbbOSa
xQqYFhsmqsnKlBJMEMaoK9JgGZZ6xOGo3JZ6yrFfYxiZ9xFaR843rOUe0UVrxh+L
+2DmALTyLWSkeqlcg66oKqYKMQuvUyd6VpPL0yHpB0AqBTjKjUmG9RgG8AT5MpqW
P3weyD0n7rOCBfagofx8MIy15REwjcQSUptarWrMwhJPua95RJ/IAVIIThGrMzZ5
PxyWDFU7B/56FRlmX5+6mfi/NC60yIyR6lg0trBtuiiEfNV+HWz6QXOIUMYQvvo9
w8fXSy6MJ12jTFqm0+CXbx2wWEVxAZS/wtLDsa3nf2oGkO3upzFl0/fvsR1dZ/hl
plo/3SMPpFFbfvIhy2V/
=2w70
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-15:22.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH multiple vulnerabilities
Category: contrib
Module: openssh
Announced: 2015-08-25
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-25 20:48:44 UTC (stable/10, 10.2-STABLE)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RC3-p2)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RELEASE-p2)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-08-25 20:48:44 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted and authenticated transport for a variety of services,
including remote shell access.
The PAM (Pluggable Authentication Modules) library provides a flexible
framework for user authentication and session setup / teardown.
The default FreeBSD OpenSSH configuration has PAM interactive
authentication enabled.
Privilege separation is a technique in which a program is divided into
multiple cooperating processes, each with a different task, where each
process is limited to the specific privileges required to perform that
specific task, while the privileged parent process acts as an arbiter.
II. Problem Description
A programming error in the privileged monitor process of the sshd(8)
service may allow the username of an already-authenticated user to be
overwritten by the unprivileged child process.
A use-after-free error in the privileged monitor process of he sshd(8)
service may be deterministically triggered by the actions of a
compromised unprivileged child process.
A use-after-free error in the session multiplexing code in the sshd(8)
service may result in unintended termination of the connection.
III. Impact
The first bug may allow a remote attacker who a) has already succeeded
by other means in compromising the unprivileged pre-authentication
child process and b) has valid credentials to one user on the target
system to impersonate a different user.
The second bug may allow a remote attacker who has already succeeded
by other means in compromising the unprivileged pre-authentication
child process to bypass PAM authentication entirely.
The third bug is not exploitable, but can cause premature termination
of a multiplexed ssh connection.
IV. Workaround
No workaround is available, but systems where ssh(1) and sshd(8) are
not used are not vulnerable.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The sshd(8) service has to be restarted after the update. A reboot
is recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The sshd(8) service has to be restarted after the update. A reboot
is recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:22/openssh.patch
# fetch https://security.FreeBSD.org/patches/SA-15:22/openssh.patch.asc
# gpg --verify openssh.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the sshd(8) daemon, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r287144
releng/9.3/ r287147
stable/10/ r287144
releng/10.1/ r287146
releng/10.2/ r287145
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:22.openssh.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3Ne8AAoJEO1n7NZdz2rnxq8P/jW05a6zT9n78wxBuHwRJ9gx
7+CN9AsezavW4HmZF4GmWt6SjnJqpLDMwnhceo7po6ZMIxjyWwxBWWfvUwVqezwa
kT+DS7oHKmeZAwCSFMj9K25NN+x7KAwXXiiANcj4U4iU+q0YrcEGVIBKVqCAn3ly
pJAkMxdTbwlWR7MaPaTMbMenVOs87b6Xx/4gfSBWolFWz9bKfdTYCxK/AnULVIZq
Q7lShezEvgyCb8b6QLvnrY4AwHtVduiYxnvNKv8ysbaatZCarkRS8nh68zGcdTBg
IyzG5OEtUFokVkroJaLWFXL1mUp7tgn9+UNd0/53wFN2DTZKw9oTAkKn8xrbbOSa
xQqYFhsmqsnKlBJMEMaoK9JgGZZ6xOGo3JZ6yrFfYxiZ9xFaR843rOUe0UVrxh+L
+2DmALTyLWSkeqlcg66oKqYKMQuvUyd6VpPL0yHpB0AqBTjKjUmG9RgG8AT5MpqW
P3weyD0n7rOCBfagofx8MIy15REwjcQSUptarWrMwhJPua95RJ/IAVIIThGrMzZ5
PxyWDFU7B/56FRlmX5+6mfi/NC60yIyR6lg0trBtuiiEfNV+HWz6QXOIUMYQvvo9
w8fXSy6MJ12jTFqm0+CXbx2wWEVxAZS/wtLDsa3nf2oGkO3upzFl0/fvsR1dZ/hl
plo/3SMPpFFbfvIhy2V/
=2w70
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-15:15.pkg
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-15:15.pkg Errata Notice
The FreeBSD Project
Topic: Insufficient check of unsupported pkg(7) signature methods
Category: core
Module: pkg
Announced: 2015-08-25
Credits: Fabian Keil
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-19 18:32:36 UTC (stable/10, 10.2-STABLE)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RC3-p2)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RELEASE-p2)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-08-19 18:33:25 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
CVE Name: CVE-2015-5676
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.freebsd.org/>.
I. Background
The pkg(8) utility is the package management tool for FreeBSD. The base
system includes a pkg(7) bootstrap utility used to install the latest pkg(8)
utility.
II. Problem Description
When signature_type specified in pkg.conf(5) is set to an unsupported method,
the pkg(7) bootstrap utility would behave as if signature_type is set to
"none".
III. Impact
MITM attackers may be able to use this vulnerability and bypass validation,
installing their own version of pkg(8).
IV. Workaround
No workaround is available, but the default FreeBSD configuration is not
affected because it uses "fingerprint" method.
V. Solution
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
2) To update your present system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your present system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-15:15/pkg.patch
# fetch https://security.FreeBSD.org/patches/EN-15:15/pkg.patch.asc
# gpg --verify pkg.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r286936
releng/9.3/ r287147
stable/10/ r286935
releng/10.1/ r287146
releng/10.2/ r287145
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5676>
The latest revision of this Errata Notice is available at
https://security.FreeBSD.org/advisories/FreeBSD-EN-15:15.pkg.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3NfOAAoJEO1n7NZdz2rnzHwP/30xvOZqHSRYMykrkQKcIVH7
Vhp0lp1z7KaDBq7xD0m08i2WSr0/pSaBU+At141iSKwvCPS0Szx307kZBO9a8gxw
j7s6Z15qychKKGukJ5tJtKX4Q3mqAtjBoCC8wmwmJ/YNmr4HrZRL2vFp7nqAiyhl
ntTcSuwEElBoalufeMHWd46eguRO/r9D8uWw+O7a+lLeJO9ThjnNZXOPyMfUE3Yh
QoFpVcVdf+j6gIGUuPwNsfy4e6hBNvD0T47+PTBECTykiC1eoX+VXqf8PxKKWSOJ
50sKgXOtRy55dMtWbXhu5zjq4jzWFWtBPIRHM5SH/7V898S7zMerh81bsczBUqEA
aBu1XJS1fZHlXKlav6/m/G1Wo4QgscBUsV6PhsFNpFmvAdEW2qjnH887FBm7I/Fv
a3wvxMmQX1ABPbavFCUZmfS4khLFITYD77XLo8ciu/fyAz/X9n9p1F2EsbL8djis
TcTuyUVv3YXeq+gJ9OcOH4CFsYSNlKEYiAd86/9DBnsiVrQJqNzqx+roHjL7ZXg6
AA/pqHmOEBq01idYh7PadOf+B5cU5A1CFMhjfpF1qe1yeuFFM30U7ugxjgV4w85O
UFotAbyDlftUzeYYTQv2bK6oXzqtVagkhB/xXfQzPK9E3AnysfHA/bLysop7AMyZ
CHeFaGA84VB1k9Ky5nSv
=a+Ek
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-EN-15:15.pkg Errata Notice
The FreeBSD Project
Topic: Insufficient check of unsupported pkg(7) signature methods
Category: core
Module: pkg
Announced: 2015-08-25
Credits: Fabian Keil
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-19 18:32:36 UTC (stable/10, 10.2-STABLE)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RC3-p2)
2015-08-25 20:48:51 UTC (releng/10.2, 10.2-RELEASE-p2)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-08-19 18:33:25 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
CVE Name: CVE-2015-5676
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.freebsd.org/>.
I. Background
The pkg(8) utility is the package management tool for FreeBSD. The base
system includes a pkg(7) bootstrap utility used to install the latest pkg(8)
utility.
II. Problem Description
When signature_type specified in pkg.conf(5) is set to an unsupported method,
the pkg(7) bootstrap utility would behave as if signature_type is set to
"none".
III. Impact
MITM attackers may be able to use this vulnerability and bypass validation,
installing their own version of pkg(8).
IV. Workaround
No workaround is available, but the default FreeBSD configuration is not
affected because it uses "fingerprint" method.
V. Solution
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
2) To update your present system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your present system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-15:15/pkg.patch
# fetch https://security.FreeBSD.org/patches/EN-15:15/pkg.patch.asc
# gpg --verify pkg.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r286936
releng/9.3/ r287147
stable/10/ r286935
releng/10.1/ r287146
releng/10.2/ r287145
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5676>
The latest revision of this Errata Notice is available at
https://security.FreeBSD.org/advisories/FreeBSD-EN-15:15.pkg.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3NfOAAoJEO1n7NZdz2rnzHwP/30xvOZqHSRYMykrkQKcIVH7
Vhp0lp1z7KaDBq7xD0m08i2WSr0/pSaBU+At141iSKwvCPS0Szx307kZBO9a8gxw
j7s6Z15qychKKGukJ5tJtKX4Q3mqAtjBoCC8wmwmJ/YNmr4HrZRL2vFp7nqAiyhl
ntTcSuwEElBoalufeMHWd46eguRO/r9D8uWw+O7a+lLeJO9ThjnNZXOPyMfUE3Yh
QoFpVcVdf+j6gIGUuPwNsfy4e6hBNvD0T47+PTBECTykiC1eoX+VXqf8PxKKWSOJ
50sKgXOtRy55dMtWbXhu5zjq4jzWFWtBPIRHM5SH/7V898S7zMerh81bsczBUqEA
aBu1XJS1fZHlXKlav6/m/G1Wo4QgscBUsV6PhsFNpFmvAdEW2qjnH887FBm7I/Fv
a3wvxMmQX1ABPbavFCUZmfS4khLFITYD77XLo8ciu/fyAz/X9n9p1F2EsbL8djis
TcTuyUVv3YXeq+gJ9OcOH4CFsYSNlKEYiAd86/9DBnsiVrQJqNzqx+roHjL7ZXg6
AA/pqHmOEBq01idYh7PadOf+B5cU5A1CFMhjfpF1qe1yeuFFM30U7ugxjgV4w85O
UFotAbyDlftUzeYYTQv2bK6oXzqtVagkhB/xXfQzPK9E3AnysfHA/bLysop7AMyZ
CHeFaGA84VB1k9Ky5nSv
=a+Ek
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-15:14.ixgbe
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-15:14.ixgbe Errata Notice
The FreeBSD Project
Topic: Disable ixgbe(4) flow-director support
Category: core
Module: ixgbe
Announced: 2015-08-25
Credits: Marc De La Gueronniere (Verisign, Inc.)
Affects: FreeBSD 10.1
Corrected: 2014-10-11 22:10:39 UTC (stable/10, 10.1-STABLE)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.freebsd.org/>.
I. Background
Flow director is an Intel technology to steer incoming packets in application
aware fashion.
II. Problem Description
Flow director support is not completely/correctly implemented in FreeBSD at
this time.
III. Impact
Enabling flow director support may cause traffic to land on a wrong RX queue
of the NIC, resulting in bad or sub-optimal performance on the receive side.
IV. Workaround
No workaround is available, but systems that do not have Intel(R) 82559
series 10Gb Ethernet Controllers are not affected.
V. Solution
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
2) To update your present system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your present system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-15:14/ixgbe.patch
# fetch https://security.FreeBSD.org/patches/EN-15:14/ixgbe.patch.asc
# gpg --verify ixgbe.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r272967
releng/10.1/ r287146
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this Errata Notice is available at
https://security.FreeBSD.org/advisories/FreeBSD-EN-15:14.ixgbe.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3NfOAAoJEO1n7NZdz2rnImEP/j4kfmZ2XqZ/zbQINCPfybyU
oSIgqyD6u4G/hy3gS4k7eLk6tQdUpnYzcoLLfeq0F2uY3DmWXJDBAKG0Bg7QaSzJ
3wWyZsN6XHkgNNCFGFsmep//8kAAXoAgJ2IoIPLe6eRHimESLtW2xlnow5PFL4Aw
JMj5B/RoxtQZ/phE1zJym7eSpjVUbBrqhj/KkJUZ0W6WOkaT0GPVctvHlc2buZh7
6u17LKgZaMMmmCvBNggkYGfiE51aJ9I0n5FdAHvlcaLCw+K58/Q6M2CRpMIorgh6
uaUHLZdT8VcZ8KVmDdBul0sZ9pkprHZ4J/htEL2mCOpmsRn/lduHAvf921mtX/64
Msg8bdXM48Q5WCv9sfcmMVgMA+6m+MekKc9wKYWw6Ldy0wcQ874jE+nuh3KBq+6X
Te4VbxrwuAnspqrnt4Q4NXnqxyElO0BGo6lCSEUGCRje+hlOWG2WhftEV894cRG+
JCS6YRvX5C7i8+XD+MhvTeAi7pbaZkq6ODxQAOZgbz4JMQFq8ldOgvLdhUndKGlH
xJ9/pK4u5kxXyVx4HPGm0MYlijjHDi/sSAJADutikpNOzlhyZqubA8LgLoBXtyfF
/Kk3GYOJvOMSK8QB7YxFRS+zPi1YxAFPEJb7ZV2ygf6RMZpIFoRLFt1kDszo+TeZ
iKXcFJvlwI49poLiz7Qs
=i/HZ
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-EN-15:14.ixgbe Errata Notice
The FreeBSD Project
Topic: Disable ixgbe(4) flow-director support
Category: core
Module: ixgbe
Announced: 2015-08-25
Credits: Marc De La Gueronniere (Verisign, Inc.)
Affects: FreeBSD 10.1
Corrected: 2014-10-11 22:10:39 UTC (stable/10, 10.1-STABLE)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.freebsd.org/>.
I. Background
Flow director is an Intel technology to steer incoming packets in application
aware fashion.
II. Problem Description
Flow director support is not completely/correctly implemented in FreeBSD at
this time.
III. Impact
Enabling flow director support may cause traffic to land on a wrong RX queue
of the NIC, resulting in bad or sub-optimal performance on the receive side.
IV. Workaround
No workaround is available, but systems that do not have Intel(R) 82559
series 10Gb Ethernet Controllers are not affected.
V. Solution
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
2) To update your present system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
3) To update your present system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-15:14/ixgbe.patch
# fetch https://security.FreeBSD.org/patches/EN-15:14/ixgbe.patch.asc
# gpg --verify ixgbe.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r272967
releng/10.1/ r287146
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this Errata Notice is available at
https://security.FreeBSD.org/advisories/FreeBSD-EN-15:14.ixgbe.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3NfOAAoJEO1n7NZdz2rnImEP/j4kfmZ2XqZ/zbQINCPfybyU
oSIgqyD6u4G/hy3gS4k7eLk6tQdUpnYzcoLLfeq0F2uY3DmWXJDBAKG0Bg7QaSzJ
3wWyZsN6XHkgNNCFGFsmep//8kAAXoAgJ2IoIPLe6eRHimESLtW2xlnow5PFL4Aw
JMj5B/RoxtQZ/phE1zJym7eSpjVUbBrqhj/KkJUZ0W6WOkaT0GPVctvHlc2buZh7
6u17LKgZaMMmmCvBNggkYGfiE51aJ9I0n5FdAHvlcaLCw+K58/Q6M2CRpMIorgh6
uaUHLZdT8VcZ8KVmDdBul0sZ9pkprHZ4J/htEL2mCOpmsRn/lduHAvf921mtX/64
Msg8bdXM48Q5WCv9sfcmMVgMA+6m+MekKc9wKYWw6Ldy0wcQ874jE+nuh3KBq+6X
Te4VbxrwuAnspqrnt4Q4NXnqxyElO0BGo6lCSEUGCRje+hlOWG2WhftEV894cRG+
JCS6YRvX5C7i8+XD+MhvTeAi7pbaZkq6ODxQAOZgbz4JMQFq8ldOgvLdhUndKGlH
xJ9/pK4u5kxXyVx4HPGm0MYlijjHDi/sSAJADutikpNOzlhyZqubA8LgLoBXtyfF
/Kk3GYOJvOMSK8QB7YxFRS+zPi1YxAFPEJb7ZV2ygf6RMZpIFoRLFt1kDszo+TeZ
iKXcFJvlwI49poLiz7Qs
=i/HZ
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:21.amd64
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-15:21.amd64 Security Advisory
The FreeBSD Project
Topic: Local privilege escalation in IRET handler
Category: core
Module: sys_amd64
Announced: 2015-08-25
Credits: Konstantin Belousov, Andrew Lutomirski
Affects: FreeBSD 9.3 and FreeBSD 10.1
Corrected: 2015-03-31 00:59:30 UTC (stable/10, 10.1-STABLE)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-03-31 01:08:51 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
CVE Name: CVE-2015-5675
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD/amd64 is commonly used on 64bit systems with AMD and Intel
CPU's.
The GS segment CPU register is used by both user processes and the
kernel to conveniently access state data: 32-bit user processes use the
register to manage per-thread data, while the kernel uses it to access
per-processor data.
The return from interrupt (IRET) instruction returns program control
from an interrupt handler to the interrupted context.
II. Problem Description
If the kernel-mode IRET instruction generates an #SS or #NP exception,
but the exception handler does not properly ensure that the right GS
register base for kernel is reloaded, the userland GS segment may be
used in the context of the kernel exception handler.
III. Impact
By causing an IRET with #SS or #NP exceptions, a local attacker can
cause the kernel to use an arbitrary GS base, which may allow escalated
privileges or panic the system.
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
And reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:21/amd64.patch
# fetch https://security.FreeBSD.org/patches/SA-15:21/amd64.patch.asc
# gpg --verify amd64.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r280877
releng/9.3/ r287147
stable/10/ r280875
releng/10.1/ r287146
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5675>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:21.amd64.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3Ne8AAoJEO1n7NZdz2rn5ncQANs2pS8xCowX+BM9LmKTUb2Y
eqGCvDetXV51/ljAOS10ubc4U0Zn2D5ACyz/DfiLIXVK8vkvlnJXFh3jSK6KIqPH
ionXa8zMedBoytZL8xIEFSpk9+cYGkGupIYEGu6CCHVZGJ5fVgTlnnazuXd4evbt
U1/7KNWt2H1R1j0YiYZ0MvhrIF35KqFmLOGf2JmZulqruwq91tYeMlv+7IY6vtPD
L8n5kTM7pudB3qznXd1PBMj1Y6YVG1O3WL4Stfyj93qDuMbJ+wfnao1ZKMBG0az8
IJITHrnTI+Xd4i/bbEoSmSN9V80S8uo/6J6JaXjtbrJfEqAMKhLrrcoMA7MHpKJQ
L4dv2HGL1n7xfOIfj5Qo2io/LUSye5lO54LtEKZfjhzqsTtNQl57BDAYZgbQp2/A
RsngIq3VrNcIJQK8F1Ba7SNL2+NVd091Wb+Z52837R5/D47jD2BhDia5eH6R5Opv
6kfzTJujbLi6b9RSn0OT+wAQbQ80qSmD+IwMXwAAg0mukthjTiJpqabpMWvMmfGO
mhfZBGqmf1Hx4lTczSRMLlRCmjOBc+BKioHT2ciE8QMX0WrHhkRuSBqY3euVTCMB
9+iU7eJ23tARTbG5wMmBNRsWJzhOKieM0UEsXxso+z8tMMX1Vh/e9ls2qm+ks876
WYT9/yPSsyU1z/AkHJU7
=nHGY
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-15:21.amd64 Security Advisory
The FreeBSD Project
Topic: Local privilege escalation in IRET handler
Category: core
Module: sys_amd64
Announced: 2015-08-25
Credits: Konstantin Belousov, Andrew Lutomirski
Affects: FreeBSD 9.3 and FreeBSD 10.1
Corrected: 2015-03-31 00:59:30 UTC (stable/10, 10.1-STABLE)
2015-08-25 20:48:58 UTC (releng/10.1, 10.1-RELEASE-p19)
2015-03-31 01:08:51 UTC (stable/9, 9.3-STABLE)
2015-08-25 20:49:05 UTC (releng/9.3, 9.3-RELEASE-p24)
CVE Name: CVE-2015-5675
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD/amd64 is commonly used on 64bit systems with AMD and Intel
CPU's.
The GS segment CPU register is used by both user processes and the
kernel to conveniently access state data: 32-bit user processes use the
register to manage per-thread data, while the kernel uses it to access
per-processor data.
The return from interrupt (IRET) instruction returns program control
from an interrupt handler to the interrupted context.
II. Problem Description
If the kernel-mode IRET instruction generates an #SS or #NP exception,
but the exception handler does not properly ensure that the right GS
register base for kernel is reloaded, the userland GS segment may be
used in the context of the kernel exception handler.
III. Impact
By causing an IRET with #SS or #NP exceptions, a local attacker can
cause the kernel to use an arbitrary GS base, which may allow escalated
privileges or panic the system.
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
And reboot the system.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:21/amd64.patch
# fetch https://security.FreeBSD.org/patches/SA-15:21/amd64.patch.asc
# gpg --verify amd64.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r280877
releng/9.3/ r287147
stable/10/ r280875
releng/10.1/ r287146
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5675>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:21.amd64.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.7 (FreeBSD)
iQIcBAEBCgAGBQJV3Ne8AAoJEO1n7NZdz2rn5ncQANs2pS8xCowX+BM9LmKTUb2Y
eqGCvDetXV51/ljAOS10ubc4U0Zn2D5ACyz/DfiLIXVK8vkvlnJXFh3jSK6KIqPH
ionXa8zMedBoytZL8xIEFSpk9+cYGkGupIYEGu6CCHVZGJ5fVgTlnnazuXd4evbt
U1/7KNWt2H1R1j0YiYZ0MvhrIF35KqFmLOGf2JmZulqruwq91tYeMlv+7IY6vtPD
L8n5kTM7pudB3qznXd1PBMj1Y6YVG1O3WL4Stfyj93qDuMbJ+wfnao1ZKMBG0az8
IJITHrnTI+Xd4i/bbEoSmSN9V80S8uo/6J6JaXjtbrJfEqAMKhLrrcoMA7MHpKJQ
L4dv2HGL1n7xfOIfj5Qo2io/LUSye5lO54LtEKZfjhzqsTtNQl57BDAYZgbQp2/A
RsngIq3VrNcIJQK8F1Ba7SNL2+NVd091Wb+Z52837R5/D47jD2BhDia5eH6R5Opv
6kfzTJujbLi6b9RSn0OT+wAQbQ80qSmD+IwMXwAAg0mukthjTiJpqabpMWvMmfGO
mhfZBGqmf1Hx4lTczSRMLlRCmjOBc+BKioHT2ciE8QMX0WrHhkRuSBqY3euVTCMB
9+iU7eJ23tARTbG5wMmBNRsWJzhOKieM0UEsXxso+z8tMMX1Vh/e9ls2qm+ks876
WYT9/yPSsyU1z/AkHJU7
=nHGY
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Planned Outage: Server updates/reboots - 2015-09-02 21:00 UTC
Planned Outage: Server updates/reboots - 2015-09-02 21:00 UTC
There will be an outage starting at 2015-09-02 21:00 UTC, which will
last approximately 4 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-09-02 21:00 UTC'
Reason for outage:
We will be applying updates and rebooting servers. Particular services
should only be down for short periods of time during the outage window.
Affected Services:
http://fedoraplanet.org
https://admin.fedoraproject.org/accounts
https://admin.fedoraproject.org/collectd/
https://admin.fedoraproject.org/nagios
https://admin.fedoraproject.org/pkgdb
https://admin.fedoraproject.org/updates
https://admin.fedoraproject.org/voting
https://apps.fedoraproject.org/calendar
https://apps.fedoraproject.org/datagrepper
https://apps.fedoraproject.org/kerneltest
https://apps.fedoraproject.org/notifications
https://apps.fedoraproject.org/nuancier
https://apps.fedoraproject.org/packages
https://apps.fedoraproject.org/releng-dash/
https://apps.fedoraproject.org/tagger
https://ask.fedoraproject.org/
https://badges.fedoraproject.org
https://darkserver.fedoraproject.org
https://docs.fedoraproject.org
https://fedorahosted.org
https://fedorapeople.org
https://fedoraproject.org/easyfix
https://fedoraproject.org/membership-map/ambassadors.html
https://fedoraproject.org/PackageReviewStatus/
https://fedoraproject.org/wiki
https://lists.fedoraproject.org
https://meetbot.fedoraproject.org
https://paste.fedoraproject.org
https://qa.fedoraproject.org/blockerbugs
https://release-monitoring.org
https://retrace.fedoraproject.org
https://taskotron.fedoraproject.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4873
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
There will be an outage starting at 2015-09-02 21:00 UTC, which will
last approximately 4 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-09-02 21:00 UTC'
Reason for outage:
We will be applying updates and rebooting servers. Particular services
should only be down for short periods of time during the outage window.
Affected Services:
http://fedoraplanet.org
https://admin.fedoraproject.org/accounts
https://admin.fedoraproject.org/collectd/
https://admin.fedoraproject.org/nagios
https://admin.fedoraproject.org/pkgdb
https://admin.fedoraproject.org/updates
https://admin.fedoraproject.org/voting
https://apps.fedoraproject.org/calendar
https://apps.fedoraproject.org/datagrepper
https://apps.fedoraproject.org/kerneltest
https://apps.fedoraproject.org/notifications
https://apps.fedoraproject.org/nuancier
https://apps.fedoraproject.org/packages
https://apps.fedoraproject.org/releng-dash/
https://apps.fedoraproject.org/tagger
https://ask.fedoraproject.org/
https://badges.fedoraproject.org
https://darkserver.fedoraproject.org
https://docs.fedoraproject.org
https://fedorahosted.org
https://fedorapeople.org
https://fedoraproject.org/easyfix
https://fedoraproject.org/membership-map/ambassadors.html
https://fedoraproject.org/PackageReviewStatus/
https://fedoraproject.org/wiki
https://lists.fedoraproject.org
https://meetbot.fedoraproject.org
https://paste.fedoraproject.org
https://qa.fedoraproject.org/blockerbugs
https://release-monitoring.org
https://retrace.fedoraproject.org
https://taskotron.fedoraproject.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4873
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
Planned Outage: Server updates/reboots buildsystem - 2015-09-01 21:00 UTC
Planned Outage: Server updates/reboots buildsystem - 2015-09-01 21:00 UTC
There will be an outage starting at 2015-09-01 21:00 UTC, which will
last approximately 2 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-09-01 21:00 UTC'
Reason for outage:
We will be applying system updates and rebooting servers related to our
buildsystem and related. No one service should be down the entire time,
services will come up or down as we reboot things.
Affected Services:
koji.fedoraproject.org
kojipkgs.fedoraproject.org
bodhi.fedoraproject.org
apps.fedoraproject.org/koschei
pkgs.fedoraproject.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4872
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
There will be an outage starting at 2015-09-01 21:00 UTC, which will
last approximately 2 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-09-01 21:00 UTC'
Reason for outage:
We will be applying system updates and rebooting servers related to our
buildsystem and related. No one service should be down the entire time,
services will come up or down as we reboot things.
Affected Services:
koji.fedoraproject.org
kojipkgs.fedoraproject.org
bodhi.fedoraproject.org
apps.fedoraproject.org/koschei
pkgs.fedoraproject.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4872
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
Planned Outage: Fedora Infrastructure Private Cloud / Copr - 2015-08-31 01:00 UTC
Planned Outage: Fedora Infrastructure Private Cloud / Copr - 2015-08-31 01:00 UTC
There will be an outage starting at 2015-08-31 01:00 UTC, which will
last approximately 6 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-08-31 01:00 UTC'
Reason for outage:
We will be updating and rebooting our private cloud head node and
compute nodes and also upgrading and rebooting instances. This will
result in downtime for copr and other applications hosted in the Fedora
Infrastructure private cloud.
Affected Services:
copr.fedoraproject.org (backend and frontend)
various development instances (fas2/fas3/blockerbugs-dev/docs-dev/etc)
fedoramagazine.org
tagia.fedorainfracloud.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4871
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
There will be an outage starting at 2015-08-31 01:00 UTC, which will
last approximately 6 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2015-08-31 01:00 UTC'
Reason for outage:
We will be updating and rebooting our private cloud head node and
compute nodes and also upgrading and rebooting instances. This will
result in downtime for copr and other applications hosted in the Fedora
Infrastructure private cloud.
Affected Services:
copr.fedoraproject.org (backend and frontend)
various development instances (fas2/fas3/blockerbugs-dev/docs-dev/etc)
fedoramagazine.org
tagia.fedorainfracloud.org
Services not listed are not affected by this outage.
Contact Information:
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/4871
Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
comments to the ticket for this outage above.
Announcing the release of Fedora 23 Alpha for aarch64 and POWER!
Fedora 23 Alpha Release Announcement for aarch64 and POWER
==========================================================
==========================================================
The Fedora 23 Alpha is here, right on schedule for our planned
October final release. Download the prerelease from our Get Fedora
site:
https://dl.fedoraproject.org/pub/fedora-secondary/releases/test/23_Alpha/Server/
What is the Alpha release?
--------------------------
The Alpha release contains all the exciting features of Fedora 23's
editions in a form that anyone can help test. This testing, guided
by the Fedora QA team, helps us target and identify bugs. When
these bugs are fixed, we make a Beta release available. A Beta
release is code-complete and bears a very strong resemblance to the
third and final release. The final release of Fedora 23 is expected
in October.
We need your help to make Fedora 23 the best release yet, so please
take some time to download and try out the Alpha and make sure the
things that are important to you are working. If you find a bug,
please report it – every bug you uncover is a chance to improve the
experience for millions of Fedora users worldwide.
Together, we can make Fedora rock-solid. We have a culture of
coordinating new features and pushing fixes upstream as much as
feasible, and your feedback will help improve not only Fedora but
Linux and free software on the whole.
* https://fedoraproject.org/wiki/Releases/23/Schedule
* https://fedoraproject.org/wiki/How_to_file_a_bug_report
Fedora-Wide Changes
-------------------
Fedora 23 includes a number of changes that will improve all of the
editions. For example, Fedora 23 is making use of compiler flags to
help improve security by "hardening" the binaries against memory
corruption vulnerabilities, buffer overflows, and so on. This is a
"behind the scenes" change that most users won't notice through
normal use of a Fedora edition, but should help provide additional
system security.
Likewise, Fedora 23 has disabled SSL3 and RC4 by default due to
known vulnerabilities in the protocols. This means all applications
that use GNUTLS and OpenSSL libraries have had the SSL3 protocol
and RC4 cipher disabled.
Fedora 23 Alpha also includes support for Unicode 8.0, which
includes new emojis, and improvements in sorting Unicode text and
processing non-ASCII URLs.
Issues and Details
------------------
This is an Alpha release. As such, we expect that you may encounter
bugs or missing features. To report issues encountered during
testing, contact the Fedora QA team via the mailing list or in
#fedora-qa on freenode.
As testing progresses, common issues are tracked on the Common F23
Bugs page. For tips on reporting a bug effectively, read "how to
file a bug report."
* https://fedoraproject.org/wiki/Common_F23_bugs
* https://fedoraproject.org/wiki/How_to_file_a_bug_report
Release Schedule
----------------
The full release schedule is available on the Fedora wiki. The
current schedule calls for a beta release towards the end of
September, and the final release scheduled towards the end of
October.
These dates are subject to change, pending any major bugs or issues
found during the development process.
* https://fedoraproject.org/wiki/Releases/23/Schedule
_______________________________________________
devel-announce mailing list
devel-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
[CentOS-announce] CESA-2015:1667 Moderate CentOS 7 httpd Security Update
CentOS Errata and Security Advisory 2015:1667 Moderate
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1667.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
0cc52437806f38711de857357163ee1d987d7ad90321c9f2ac8244a614e91b3e httpd-2.4.6-31.el7.centos.1.x86_64.rpm
24ccd0e7281e11ff8ad09ad2a9dc0a55e3a2273d367af302134b2fce4a6c55b3 httpd-devel-2.4.6-31.el7.centos.1.x86_64.rpm
f2e62cdba688a9d34aa9d74c72b273b5fd4a77c33244c8443ac0277fa330cd3e httpd-manual-2.4.6-31.el7.centos.1.noarch.rpm
8b73c1f49f7e16ce0a3b65d3d958e879e23f9af6abd54c58226b7a70985f6d4d httpd-tools-2.4.6-31.el7.centos.1.x86_64.rpm
bc49fadadf536c299b2e0cc6729e15e6c43e10a557533f559669831a566f8b71 mod_ldap-2.4.6-31.el7.centos.1.x86_64.rpm
daae3303532c8141739a41aeeca1ad7179a995b60c6516c8403166200807f081 mod_proxy_html-2.4.6-31.el7.centos.1.x86_64.rpm
4cf58aab684a2dd69ce4e1c88dd2a49f93855e362925d123fd96a33cabbaa794 mod_session-2.4.6-31.el7.centos.1.x86_64.rpm
789b023bd48745b2384415f87c87f72793247bce7dddaa4eef0ff4bd7ffef819 mod_ssl-2.4.6-31.el7.centos.1.x86_64.rpm
Source:
4809640272ae8e5c95814886a95f8c8d64da018ef0c0ad21fecd38995a31382b httpd-2.4.6-31.el7.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1667.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
0cc52437806f38711de857357163ee1d987d7ad90321c9f2ac8244a614e91b3e httpd-2.4.6-31.el7.centos.1.x86_64.rpm
24ccd0e7281e11ff8ad09ad2a9dc0a55e3a2273d367af302134b2fce4a6c55b3 httpd-devel-2.4.6-31.el7.centos.1.x86_64.rpm
f2e62cdba688a9d34aa9d74c72b273b5fd4a77c33244c8443ac0277fa330cd3e httpd-manual-2.4.6-31.el7.centos.1.noarch.rpm
8b73c1f49f7e16ce0a3b65d3d958e879e23f9af6abd54c58226b7a70985f6d4d httpd-tools-2.4.6-31.el7.centos.1.x86_64.rpm
bc49fadadf536c299b2e0cc6729e15e6c43e10a557533f559669831a566f8b71 mod_ldap-2.4.6-31.el7.centos.1.x86_64.rpm
daae3303532c8141739a41aeeca1ad7179a995b60c6516c8403166200807f081 mod_proxy_html-2.4.6-31.el7.centos.1.x86_64.rpm
4cf58aab684a2dd69ce4e1c88dd2a49f93855e362925d123fd96a33cabbaa794 mod_session-2.4.6-31.el7.centos.1.x86_64.rpm
789b023bd48745b2384415f87c87f72793247bce7dddaa4eef0ff4bd7ffef819 mod_ssl-2.4.6-31.el7.centos.1.x86_64.rpm
Source:
4809640272ae8e5c95814886a95f8c8d64da018ef0c0ad21fecd38995a31382b httpd-2.4.6-31.el7.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2015:1665 Moderate CentOS 7 mariadb Security Update
CentOS Errata and Security Advisory 2015:1665 Moderate
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1665.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
29554047f0773b0494da521348084df861ed2d72a4e840c4176bfe6c12ea8df4 mariadb-5.5.44-1.el7_1.x86_64.rpm
3bbd3d18a4dcd102feb5fd94fa3468e01218507b99202aa658bbc23e04a8ae4d mariadb-bench-5.5.44-1.el7_1.x86_64.rpm
5eefe9dbe3419bcf90bb02d2bfda07cf9dc3a80912a915f96ffc8d54e8ecf698 mariadb-devel-5.5.44-1.el7_1.i686.rpm
476704fc7950346209ba0b67a3ba9ac070e1cf7e9da93e5d216fb2f179ee40fe mariadb-devel-5.5.44-1.el7_1.x86_64.rpm
b91481ca736c1325d5ef3badffceebd3947e68703d68088a4cd34a56b0b6a688 mariadb-embedded-5.5.44-1.el7_1.i686.rpm
853f6651aca96694b0869f11e95429e231ccc35958fee1b4575729c6964ca920 mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm
ac1d94abc98915dab78283fb9b2d64e8963fba1d3567734a3545e53b119fbfb0 mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm
f213d56f35a7a0df1282be1e91d245addb84cf910b04b3554abb25b99b2fbce5 mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm
214d762de692806084bdf126995cd3131e71bb85859055cd0b39dda9cc04ffe0 mariadb-libs-5.5.44-1.el7_1.i686.rpm
71429a21bc29daed0f86c3c44b02cfdd5b94d151b6a6acc00c83242373e74ac4 mariadb-libs-5.5.44-1.el7_1.x86_64.rpm
6cd54e7aad5c299aca38f8548bf8fd62d0932aec02da09f7726da92ecdb5bd69 mariadb-server-5.5.44-1.el7_1.x86_64.rpm
cb0dce1d11f25dbc6e091f9ff3281377bd2964c308a99f5a9c9c5126e8d3ff9b mariadb-test-5.5.44-1.el7_1.x86_64.rpm
Source:
822fc3a6ab31eae0917713ab6cf913e2ded3f3324bfbeb985522a648efe687f0 mariadb-5.5.44-1.el7_1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1665.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
29554047f0773b0494da521348084df861ed2d72a4e840c4176bfe6c12ea8df4 mariadb-5.5.44-1.el7_1.x86_64.rpm
3bbd3d18a4dcd102feb5fd94fa3468e01218507b99202aa658bbc23e04a8ae4d mariadb-bench-5.5.44-1.el7_1.x86_64.rpm
5eefe9dbe3419bcf90bb02d2bfda07cf9dc3a80912a915f96ffc8d54e8ecf698 mariadb-devel-5.5.44-1.el7_1.i686.rpm
476704fc7950346209ba0b67a3ba9ac070e1cf7e9da93e5d216fb2f179ee40fe mariadb-devel-5.5.44-1.el7_1.x86_64.rpm
b91481ca736c1325d5ef3badffceebd3947e68703d68088a4cd34a56b0b6a688 mariadb-embedded-5.5.44-1.el7_1.i686.rpm
853f6651aca96694b0869f11e95429e231ccc35958fee1b4575729c6964ca920 mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm
ac1d94abc98915dab78283fb9b2d64e8963fba1d3567734a3545e53b119fbfb0 mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm
f213d56f35a7a0df1282be1e91d245addb84cf910b04b3554abb25b99b2fbce5 mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm
214d762de692806084bdf126995cd3131e71bb85859055cd0b39dda9cc04ffe0 mariadb-libs-5.5.44-1.el7_1.i686.rpm
71429a21bc29daed0f86c3c44b02cfdd5b94d151b6a6acc00c83242373e74ac4 mariadb-libs-5.5.44-1.el7_1.x86_64.rpm
6cd54e7aad5c299aca38f8548bf8fd62d0932aec02da09f7726da92ecdb5bd69 mariadb-server-5.5.44-1.el7_1.x86_64.rpm
cb0dce1d11f25dbc6e091f9ff3281377bd2964c308a99f5a9c9c5126e8d3ff9b mariadb-test-5.5.44-1.el7_1.x86_64.rpm
Source:
822fc3a6ab31eae0917713ab6cf913e2ded3f3324bfbeb985522a648efe687f0 mariadb-5.5.44-1.el7_1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
[USN-2712-1] Thunderbird vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBAgAGBQJV3D4nAAoJEGEfvezVlG4PahAIAJeVKQab4kW9adg6saedbaVV
jDEFlQKY9ZF/olHVF7/oQ0ltoisuxl+E2nDWIxMQ9keMYUUVmnFG9fEddo3kU86U
fti9+AcBe251MvG++1AsumBaz8Y/9aK62y8NwEGTq+XM3c0I9Tx4TRXW3pW0cXI2
4g/rxh7mSPP526tQCPAWxb5ZENamLbZY6b0cJtJ1CXLmvx4SpORviILu2g54RlJo
HfxnWSHqV5Wmc4Ydzl8lQuqIin0zT2b/BMYW4ttnxraatMBdanZDojfEkANcUvqM
wiqfbxOsSRkp+WB51a6b37lmimHUzwMr+FXNwLn3hAs/4CASsz36bpw4PoGo/LU=
=Y3J6
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2712-1
August 25, 2015
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Gary Kwong, Christian Holler, and Byron Campen discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges ofthe user invoking Thunderbird. (CVE-2015-4473)
Ronald Crane reported 3 security issues. If a user were tricked in to
opening a specially crafted message, an attacker could potentially
exploit these, in combination with another security vulnerability, to
cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Thunderbird. (CVE-2015-4487,
CVE-2015-4488, CVE-2015-4489)
Gustavo Grieco discovered a heap overflow in gdk-pixbuf. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit this to cause a denial of service via application
crash or execute arbitrary code with the priviliges of the user invoking
Thunderbird. (CVE-2015-4491)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
thunderbird 1:38.2.0+build1-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
thunderbird 1:38.2.0+build1-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
thunderbird 1:38.2.0+build1-0ubuntu0.12.04.2
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2712-1
CVE-2015-4473, CVE-2015-4487, CVE-2015-4488, CVE-2015-4489,
CVE-2015-4491
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.12.04.2
Version: GnuPG v1
iQEcBAEBAgAGBQJV3D4nAAoJEGEfvezVlG4PahAIAJeVKQab4kW9adg6saedbaVV
jDEFlQKY9ZF/olHVF7/oQ0ltoisuxl+E2nDWIxMQ9keMYUUVmnFG9fEddo3kU86U
fti9+AcBe251MvG++1AsumBaz8Y/9aK62y8NwEGTq+XM3c0I9Tx4TRXW3pW0cXI2
4g/rxh7mSPP526tQCPAWxb5ZENamLbZY6b0cJtJ1CXLmvx4SpORviILu2g54RlJo
HfxnWSHqV5Wmc4Ydzl8lQuqIin0zT2b/BMYW4ttnxraatMBdanZDojfEkANcUvqM
wiqfbxOsSRkp+WB51a6b37lmimHUzwMr+FXNwLn3hAs/4CASsz36bpw4PoGo/LU=
=Y3J6
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2712-1
August 25, 2015
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Gary Kwong, Christian Holler, and Byron Campen discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges ofthe user invoking Thunderbird. (CVE-2015-4473)
Ronald Crane reported 3 security issues. If a user were tricked in to
opening a specially crafted message, an attacker could potentially
exploit these, in combination with another security vulnerability, to
cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Thunderbird. (CVE-2015-4487,
CVE-2015-4488, CVE-2015-4489)
Gustavo Grieco discovered a heap overflow in gdk-pixbuf. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit this to cause a denial of service via application
crash or execute arbitrary code with the priviliges of the user invoking
Thunderbird. (CVE-2015-4491)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
thunderbird 1:38.2.0+build1-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
thunderbird 1:38.2.0+build1-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
thunderbird 1:38.2.0+build1-0ubuntu0.12.04.2
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2712-1
CVE-2015-4473, CVE-2015-4487, CVE-2015-4488, CVE-2015-4489,
CVE-2015-4491
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:38.2.0+build1-0ubuntu0.12.04.2
Subscribe to:
Posts (Atom)