CentOS Errata and Bugfix Advisory 2015:1530
Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-1530.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
8753e5e7ce19f2df8aad3fa53069e91331531794403a3ceec9b9070154eb8a27 dracut-033-241.el7_1.5.x86_64.rpm
9140c7f19ed3c6391ee88aba25900ab00762a1e3183699912c85d9bef3f25cda dracut-caps-033-241.el7_1.5.x86_64.rpm
eaba45bcb49c1de1dde0d761e1197e53c2e31b33a08c42aa5a6b010619451cd2 dracut-config-generic-033-241.el7_1.5.x86_64.rpm
abf7bb406523443f1b21a7bd3a8a196b6afdcb4d4cb3c65ab1be6acbbd02a3ed dracut-config-rescue-033-241.el7_1.5.x86_64.rpm
9ebf8f3a4abf31476ccca81ff5445fe50f6847765dc4d99a0011cba40fde59d1 dracut-fips-033-241.el7_1.5.x86_64.rpm
aa1a09c317c4576ed0cb6750bd4031b1c8d661bf3abbbe7681b16dabaae86e65 dracut-fips-aesni-033-241.el7_1.5.x86_64.rpm
b4aaecf671ac70e1e22b37ecf25603fb75f3bc309db51a071684c0b47772e54c dracut-network-033-241.el7_1.5.x86_64.rpm
cd00abe771b6baf53f570b6e0c56ede955b9970304c38d6e5229671385ced868 dracut-tools-033-241.el7_1.5.x86_64.rpm
Source:
37a4eec7025411f7f3e591e7d286799a09b0d026f469b72bf302972963f4c30d dracut-033-241.el7_1.5.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
Wednesday, August 5, 2015
[CentOS-announce] CEBA-2015:1542 CentOS 7 unixODBC FASTTRACK BugFix Update
CentOS Errata and Bugfix Advisory 2015:1542
Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-1542.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
5c1f6a42a94fb5b12dcde973990023487aac346d837414dd330153bc24bee85a unixODBC-2.3.1-11.el7.i686.rpm
932850e7a115ce7f35e47ea1bf29da70c28a36bf7ba2f8650554c8bf1fb3985f unixODBC-2.3.1-11.el7.x86_64.rpm
6a03a1740c5b5e6d6a9facddca6a5e86c87e204f6878470df9c0601d1c1cae10 unixODBC-devel-2.3.1-11.el7.i686.rpm
48d78784659d95b2800ffaebd7f43677e5646eb3be16646cc2cf2c1ba9d642d0 unixODBC-devel-2.3.1-11.el7.x86_64.rpm
Source:
70b40153fb4659ec6177b65d5f948d16e0e8342656d18c4c294547eb3acff1d3 unixODBC-2.3.1-11.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-1542.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
5c1f6a42a94fb5b12dcde973990023487aac346d837414dd330153bc24bee85a unixODBC-2.3.1-11.el7.i686.rpm
932850e7a115ce7f35e47ea1bf29da70c28a36bf7ba2f8650554c8bf1fb3985f unixODBC-2.3.1-11.el7.x86_64.rpm
6a03a1740c5b5e6d6a9facddca6a5e86c87e204f6878470df9c0601d1c1cae10 unixODBC-devel-2.3.1-11.el7.i686.rpm
48d78784659d95b2800ffaebd7f43677e5646eb3be16646cc2cf2c1ba9d642d0 unixODBC-devel-2.3.1-11.el7.x86_64.rpm
Source:
70b40153fb4659ec6177b65d5f948d16e0e8342656d18c4c294547eb3acff1d3 unixODBC-2.3.1-11.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
http://lists.centos.org/mailman/listinfo/centos-announce
[USN-2703-1] Cinder vulnerability
==========================================================================
Ubuntu Security Notice USN-2703-1
August 06, 2015
cinder vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
Summary:
Cinder could be made to access unintended files over the network by an
authenticated user.
Software Description:
- cinder: OpenStack storage service
Details:
Bastian Blank discovered that Cinder guessed image formats based on
untrusted data. An attacker could use this to read arbitrary files from
the Cinder host.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
python-cinder 1:2015.1.0-0ubuntu1.1
After a standard system update you need to restart cinder to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-2703-1
CVE-2015-1851
Package Information:
https://launchpad.net/ubuntu/+source/cinder/1:2015.1.0-0ubuntu1.1
Ubuntu Security Notice USN-2703-1
August 06, 2015
cinder vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
Summary:
Cinder could be made to access unintended files over the network by an
authenticated user.
Software Description:
- cinder: OpenStack storage service
Details:
Bastian Blank discovered that Cinder guessed image formats based on
untrusted data. An attacker could use this to read arbitrary files from
the Cinder host.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
python-cinder 1:2015.1.0-0ubuntu1.1
After a standard system update you need to restart cinder to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-2703-1
CVE-2015-1851
Package Information:
https://launchpad.net/ubuntu/+source/cinder/1:2015.1.0-0ubuntu1.1
LibreSSL 2.2.2 released
We have released LibreSSL 2.2.2, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release marks the end of the OpenBSD 5.8 development cycle,
featuring expanded portable build support, code improvements, removal of
obsolete workarounds.
SSLv3 deprecation continues with its removal from openssl(1) and new
linker warnings on supported platforms, indicating if a program is still
using the SSLv3-only methods. We are working with upstream software
providers to update programs that were not ready for SSLv3 support to be
removed entirely yet.
* Switched 'openssl dhparam' default from 512 to 2048 bits
* Reworked openssl(1) option handling
* More CRYPTO ByteString (CBC) packet parsing conversions
* Fixed 'openssl pkeyutl -verify' to exit with a 0 on success
* Fixed dozens of Coverity issues including dead code, memory leaks,
logic errors and more.
* Ensure that openssl(1) restores terminal echo state after reading a
password.
* Incorporated fix for OpenSSL Issue #3683
* LibreSSL version define LIBRESSL_VERSION_NUMBER will now be bumped
for each portable release.
* Removed workarounds for TLS client padding bugs.
* No longer disable ECDHE-ECDSA on OS X
* Removed SSLv3 support from openssl(1)
* Removed IE 6 SSLv3 workarounds.
* Modified tls_write in libtls to allow partial writes, clarified with
examples in the documentation.
* Removed RSAX engine
* Tested SSLv3 removal with the OpenBSD ports tree and found several
applications that were not ready to build without SSLv3 yet. For now,
building a program that intentionally uses SSLv3 will result in a
linker warning.
* Added TLS_method, TLS_client_method and TLS_server_method as a
replacement for the SSLv23_*method calls.
* Added initial cmake build support, including support for building
with Visual Studio, currently working with Visual Studio 2013
Community Edition. There are some issues with earlier versions of
Visual Studio that will be resolved in a future release.
* --with-enginesdir is removed as a configuration parameter
* Default cert.pem, openssl.cnf, and x509v3.cnf files are now installed
under $sysconfdir/ssl or the directory specified by
--with-openssldir. Previous versions of LibreSSL left these empty.
The LibreSSL project continues improvement of the codebase to reflect
modern, safe programming practices. We welcome feedback and improvements
from the broader community. Thanks to all of the contributors who helped
make this release possible.
LibreSSL directory of your local OpenBSD mirror soon.
This release marks the end of the OpenBSD 5.8 development cycle,
featuring expanded portable build support, code improvements, removal of
obsolete workarounds.
SSLv3 deprecation continues with its removal from openssl(1) and new
linker warnings on supported platforms, indicating if a program is still
using the SSLv3-only methods. We are working with upstream software
providers to update programs that were not ready for SSLv3 support to be
removed entirely yet.
* Switched 'openssl dhparam' default from 512 to 2048 bits
* Reworked openssl(1) option handling
* More CRYPTO ByteString (CBC) packet parsing conversions
* Fixed 'openssl pkeyutl -verify' to exit with a 0 on success
* Fixed dozens of Coverity issues including dead code, memory leaks,
logic errors and more.
* Ensure that openssl(1) restores terminal echo state after reading a
password.
* Incorporated fix for OpenSSL Issue #3683
* LibreSSL version define LIBRESSL_VERSION_NUMBER will now be bumped
for each portable release.
* Removed workarounds for TLS client padding bugs.
* No longer disable ECDHE-ECDSA on OS X
* Removed SSLv3 support from openssl(1)
* Removed IE 6 SSLv3 workarounds.
* Modified tls_write in libtls to allow partial writes, clarified with
examples in the documentation.
* Removed RSAX engine
* Tested SSLv3 removal with the OpenBSD ports tree and found several
applications that were not ready to build without SSLv3 yet. For now,
building a program that intentionally uses SSLv3 will result in a
linker warning.
* Added TLS_method, TLS_client_method and TLS_server_method as a
replacement for the SSLv23_*method calls.
* Added initial cmake build support, including support for building
with Visual Studio, currently working with Visual Studio 2013
Community Edition. There are some issues with earlier versions of
Visual Studio that will be resolved in a future release.
* --with-enginesdir is removed as a configuration parameter
* Default cert.pem, openssl.cnf, and x509v3.cnf files are now installed
under $sysconfdir/ssl or the directory specified by
--with-openssldir. Previous versions of LibreSSL left these empty.
The LibreSSL project continues improvement of the codebase to reflect
modern, safe programming practices. We welcome feedback and improvements
from the broader community. Thanks to all of the contributors who helped
make this release possible.
reallost1.fbsd2233449 基于关键指标的分析方法
大数据时代的营销数据分析技能——用数字说话
【时间地点】 2015年8月14-15深圳、8月20-21北京 、8月22-23上海
【参加对象】 市场总监、市场分析人员、销售主管、销售总监及其他对营销数据分析有兴趣的人士
【授课方式】 讲师讲授 + 视频演绎 + 案例研讨 +角色扮演 + 讲师点评 + 落地工具。
【学习费用】 3600元/2天/1人（含资料费、午餐、茶点等）
垂·询·热·线：021-31006787、0755-61280006、010-51299910
QQ/微信：320588808 值·班·手·机：18918958501 许先生
备注: 认证费用： 高级800元/人(参加认证考试的学员须交纳比费用，不参加的学员无须交纳)
1. 凡参加认证的学员，在培训结束参加考试合格者由<<国际职业认证标准联合会>>颁发<<营销管理师>>国
际国内中英文版双职业资格证书，（国际国内认证／全球通行／社会认可／官方网上查询）；
2．凡参加认证的学员须课前准备大一寸红底或蓝底数码照片；
3．课程结束后20个工作日内将证书快递寄给学员；
4．可申请中国国家人才网入库备案。
注：如不需此类信件信息，请转发送"删除"至wytuixin@163.com,我们会及时处理，谢谢您的理解。
课程背景：
"大数据"的概念出现至今已经11年了，然而，为数不少的的市场部、销售部的相关员工由于缺乏营销分析的技能，还在使用原始低效的统计和分析方法，浪费大量的时间不说，老板还经常不满意。
大数据时代要求市场和销售部门对客户响应、营销过程、行业竞争做深入分析，为决策者提供真正的决策支持，特别是为每一个营销动作提供最佳的运作模型。
本课程从大数据的宏观知识背景开始，探讨如何将数据分析的技能应用于企业日常的销售运营当中。学习本课程您将可以掌握以下内容：
* 了解大数据的概念，大数据包含哪些技术框架和工具
* 大数据如何跟企业的营销工作相结合
* 数据挖掘的CRISP循环
* 数据分析的工具介绍：例如指标分析的方法和统计学算法介绍
特别声明：
本课程有若干演练环节，为了保证培训效果，请携带笔记本电脑并安装Office2007以上版本，课堂上不负责为学员安装软件，请预先准备。
陈剑老师课程均赠送BladeOffice工具箱，请注意核对软件日期是否为培训当天日期以防假冒。
课程大纲：
一、大数据时代概述
"大数据"火了，但是大数据的应用已经有十几年的历史了，本节告诉你大数据是什么。
1.大数据的应用历史
2.大数据的全景视图
3.最热门的大数据工具有哪些
4.企业的市场和营销部门应该具备哪些大数据的技能？
5.CRISP方法论
案例演练：空降经理的烦恼，您来亲身体验一下数据分析的过程
二、构建企业的分析体系
本节介绍如何在企业内部实施大数据，利用大数据驱动企业的营销动作
1.大数据如何与企业的营销结合
a)营销动作和大数据的结合
b)岗位的设置和技能要求
2.分析模型的设计、实施工具
a)SPSS Clementine简介
b)SAS简介
c)SQL Analysis简介
d)Excel控件简介
3.数据的收集和准备
a)数据的来源
b)原始数据转换为业务数据
三、基于关键指标的分析方法
指标分析是一种快速的企业绩效分析手段，是衡量企业健康状况的健康指标， 本节介绍如何通过指标构建
数据分析模型。
1.案例思考：从一张报表说起
2.传统的基于绩效考核指标分析的缺陷
3.把KPI指标和管理理念相结合，搭建分析模型分析营销状况
4.案例解析：
a)竞争力分析模型
b)利润分析模型
四、时间序列分析
时间序列分析的目的是掌握销售过程中出现的趋势、规律，优化产品组合和销售管理。
1.时间序列规律的三个方面
2.如何识别周期，认识同比的风险
3.趋势如何分析
4.案例解析
a)数据周期分析
b)库存风险预测
5.一元回归分析
a)案例：行业趋势分析
五、竞争的量化分析方法简介
1.宏观的行业竞争力分析矩阵
2.数据来源：根据市场竞争的四个层次确定
3.竞争的敏感性分析
4.快消品的品牌转换矩阵
5.媒体影响的量化研究
六、常用的统计学分析算法简介
数据分析不是空洞理论，还需要有科学的技术手段和方法，本节演示常见的数据分析算法。
1.协助客户分类：聚类分析
2.识别客户响应
a)类神经网络
b)决策树
c)逻辑斯蒂回归
3.时间序列预测
a)ARIMA
b)指数平滑
七、商业预测技术
预测是企业重要的决策依据，本节演示如何结合统计学算法构造一个成熟的预测模型。
1.预测责任者与支持者
2.预测的组织流程
3.不同的预测模型各自的优缺点
4.水平和趋势模型
5.季节模型
6.如何评估预测的偏差
八、数据挖掘
无差别的大众媒体营销已经无法满足零和的市场环境下的竞争要求。精确营销是现在及未来的发展方向，精确营销的基础是精确的客户定位，本节通过案例演示来说明如何进行客户的响应分析。
1.精确营销与客户细分
2.客户细分的价值
3.基于数据驱动的细分
4.基于决策树的案例解析
5.结果的应用
讲师介绍：【陈剑】
信息化专家、IPMA认证项目经理、MCSE、MCDBA、经济分析师，从业经验丰富，曾主持开发大型政府业务系统、银行办公系统、电信业务系统、工业自动化控制系统等，负责过OA、ERP、BI系统的集成与实施。
历任项目经理，技术总监，副总经理等职务、熟悉整公司营运管理，财务管理、信息化管理、人事行政管理工作。
陈剑老师擅长的课程：
* 《实用企业数据统计和分析技术》
* 《专业幻灯片和图表制作技术》
* 《现代项目管理》
* 《新产品研发和客户需求分析》
* 《Excel、Access和POWERPOINT在管理中的实战运用》
陈剑老师近期内训企业包括：
东方物探麦考林、仪征双环、四季沐歌、健业纺织、中纺粮油、冠捷电子、景兴商务、黛安芬、巴鲁夫、中电广西、维他奶、神州数码、日立电梯、科达、星河地产、凌阳科技、Bacardi、奇瑞汽车、大成集团、泰凯英轮胎、中信银行、复兴医药、虔东稀土、洲明科技、九星印刷、江铃汽车、不二制油、科达、兰州电信、中沙石化、沈鼓集团、立信集团、CTI论坛、渤海国际信托、国药控股(广州、昆明)、麦格昆磁、纷
美、一鸣食品、恒安集团、三一重工、泰凯英、顶新、天威、松雷集团、丹宝利酵母、红蜻蜓、贺利氏古莎、爱施德、博深工具、雅致集成房屋、兴业银行(福州)、中轻南方炼糖纸业、龙头股份、华创证券、派克、大众医药、中海油(大亚湾、天津、上海、惠州)、中国移动(云南、阳江、大庆、东莞、北京、深圳、江苏、佛山、哈尔滨、梅州)、中烟(广州、郴州)、东风汽车(武汉、十堰)、东软、蒙牛(北京、呼和浩特)、东方航空、大连商品交易所、交银施罗德、雅芳、新世界集团、天合光能、哈尔斯、攀岭鞋业、福田医疗、银雁金融、泉林包装、卓志物流、东风置业、金域医疗检验、中钞特种防伪、金茂集团、海烟物流、中国测试技术研究院、贝亲婴儿用品、奇正藏药、深投投资、亿道电子、北京交大、上海交大MBA班等。
部分学员评价：
本身对数据分析有一定的基础，本次培训让我更上一个台阶，并且学习到了一个重要理念就是数据分析需要技能和业务相结合，案例分析让我扩展了思维，认识到了分析前需要先做好业务理解，这样可以分析事半功倍
————汇通百达网络科技有限公司袁小姐
课堂气氛活跃，老师授课思路清晰，语言表达能力强，课程对我在有关业务数据的前期设计思路及需求分析的方法给了很大的帮助
————北京沃尔德起硬工具有限公司孙先生
教会了我如何通过企业的报表数据来判断一个企业的发展现状
————苏州冠城宏翔房地产有限公司纪先生
对表面数据的深入理解与分析，这是一种逻辑思维的启发，这次培训最大的收获是对EXCEL表格分析功能的学习，以及通过现象看本质的逻辑思维的启发。
————博物天下张小姐
综合案例及实践操作利于理解和消化，对数据的理解与分析将更加深入
————福州市勘测院冯小姐
很多是工作中用到的，有一些更是工作中有困惑的，通过陈老师的讲解明白许多
————海曼星电气有限公司钱女士
大部分培训内容利于理解，便于我工作中的实际运用，讲师授课时不乏味、幽默、有效控制课堂氛围
————中石化壳牌（江苏）石油销售有限公司胡小姐
亮点及收获：学习到了做营销分析的思路，通过案例拓宽了思维，了解了协助软件ECEL、SPASS分析数据的一些方法，此外还了解了许多分析模型。
————北京天山新材料技术股份有限公司杨小姐
课程亮点是数据分析，用数字说话，帮我解决了一部分工作中的困扰，让我有了新的思路，用数据分析指导一部分工作。
————焦作市科瑞森机械制造有限公司林小姐
结合管理体制和营销思路，主要从数据分析方面来预测分析业务的情况，并且了解到一些EXCEL方面的操作技巧
————嘉兴朝聚眼科医院江先生
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:19.routed
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-15:19.routed Security Advisory
The FreeBSD Project
Topic: routed(8) remote denial of service vulnerability
Category: core
Module: routed
Announced: 2015-08-05
Credits: Hiroki Sato
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-05 22:05:02 UTC (stable/10, 10.2-PRERELEASE)
2015-08-05 22:05:02 UTC (stable/10, 10.2-BETA2-p3)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC1-p2)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC2-p1)
2015-08-05 22:05:18 UTC (releng/10.1, 10.1-RELEASE-p17)
2015-08-05 22:05:07 UTC (stable/9, 9.3-STABLE)
2015-08-05 22:05:24 UTC (releng/9.3, 9.3-RELEASE-p22)
CVE Name: CVE-2015-5674
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The routing information protocol (RIP) is an older routing protocol
which, while not as capable as more recent protocols such as OSPF and
BGP, is sometimes preferred for its simplicity and therefore still
used as an interior gateway protocol on smaller networks.
Routers in a RIP network periodically broadcast their routing table on
all enabled interfaces. Neighboring routers and hosts receive these
broadcasts and update their routing tables accordingly.
The routed(8) daemon is a RIP implementation for FreeBSD. The
rtquery(8) utility can be used to send a RIP query to a router and
display the result without updating the routing table.
II. Problem Description
The input path in routed(8) will accept queries from any source and
attempt to answer them. However, the output path assumes that the
destination address for the response is on a directly connected
network.
III. Impact
Upon receipt of a query from a source which is not on a directly
connected network, routed(8) will trigger an assertion and terminate.
The affected system's routing table will no longer be updated. If the
affected system is a router, its routes will eventually expire from
other routers' routing tables, and its networks will no longer be
reachable unless they are also connected to another router.
IV. Workaround
Note that this problem does not affect a system on which routed(8)
is not enabled. The routed(8) daemon is not enabled by default.
Use a packet filter such as pf(4) or ipfw(4) to block incoming UDP
packets with destination port 520 that did not originate on the same
subnet as the destination address.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The routed service has to be restarted after the update. A reboot is
recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The routed service has to be restarted after the update. A reboot is
recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch http://security.FreeBSD.org/patches/SA-15:19/routed.patch
# fetch http://security.FreeBSD.org/patches/SA-15:19/routed.patch.asc
# gpg --verify routed.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/routed.patch
c) Recompile routed. Execute the following commands as root:
# cd /usr/src/sbin/routed
# make && make install
Restart the routed daemon, or reboot the system.
To restart the affected service after updating the system, either
reboot the system or execute the following command as root:
# service routed restart
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r286349
releng/9.3/ r286352
stable/10/ r286348
releng/10.1/ r286351
releng/10.2/ r286350
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5674>
The latest revision of this advisory is available at
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-15:19.routed.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.6 (FreeBSD)
iQIcBAEBCgAGBQJVwoplAAoJEO1n7NZdz2rnMFAP/3HWG6FrFxM3jgMcK7a5+nKP
O6BqVXpFdia0UUN5JlcEZXc89957mXdMXCDqNeTj3CeDc0p9GbPX1zV/vlYoOqhM
eIPwgERbMRFnDRaWm2ClG+aatJvdpeDEioNy8b8tmKq94JcpXIJnwX8dhY3WrMwj
Mc3QBGT08XLImHqNw6d6/0wavFeOZ/3g1ZoloAktsgA9KhTUOai6dUhIbIJzk6gh
0oa4NRkhzRNmUKyHOS6HDrghhQ/kZGtE8joVBxLBljK0Thi0mIZtn3UFGsNAgAWw
7WGAiTN2o8c48IUJosmiGsJ7rV1wCFt5zXrZVCcnq6dr60He16Z2Zwif2tugiTvm
5x9lDbTEnYOTxM38Ya5gMtMf733YgAtoRCkf3ROsnwXukJYVsJXms7Ej4NihoKMd
aYOLDItl+AXUGIyQ44GuUm2955wo9Fb5RlkDSCLAvdgnkPk+k0puLp0MR0B2MOAI
tdKNecRNg0fDR5gJbfdzdjVhsGBZXdYlxo4VjXUXDSZJ+8+jkAg2LA9DTRKIfbgX
BX5GiOhkhIivFlgvSePv0LRuIbgt0H1cxiJdk6OqNS5gROuqwo7wwUnaig8KVKOI
887gfpf7PepYD4xWTo3nAoEcGM0rBwUyq1X3pbx9OJADcqRvOhxfMcHFcCv75uxa
OISkQhkWdZUv6ls76rRu
=p5Rl
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-15:19.routed Security Advisory
The FreeBSD Project
Topic: routed(8) remote denial of service vulnerability
Category: core
Module: routed
Announced: 2015-08-05
Credits: Hiroki Sato
Affects: All supported versions of FreeBSD.
Corrected: 2015-08-05 22:05:02 UTC (stable/10, 10.2-PRERELEASE)
2015-08-05 22:05:02 UTC (stable/10, 10.2-BETA2-p3)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC1-p2)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC2-p1)
2015-08-05 22:05:18 UTC (releng/10.1, 10.1-RELEASE-p17)
2015-08-05 22:05:07 UTC (stable/9, 9.3-STABLE)
2015-08-05 22:05:24 UTC (releng/9.3, 9.3-RELEASE-p22)
CVE Name: CVE-2015-5674
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The routing information protocol (RIP) is an older routing protocol
which, while not as capable as more recent protocols such as OSPF and
BGP, is sometimes preferred for its simplicity and therefore still
used as an interior gateway protocol on smaller networks.
Routers in a RIP network periodically broadcast their routing table on
all enabled interfaces. Neighboring routers and hosts receive these
broadcasts and update their routing tables accordingly.
The routed(8) daemon is a RIP implementation for FreeBSD. The
rtquery(8) utility can be used to send a RIP query to a router and
display the result without updating the routing table.
II. Problem Description
The input path in routed(8) will accept queries from any source and
attempt to answer them. However, the output path assumes that the
destination address for the response is on a directly connected
network.
III. Impact
Upon receipt of a query from a source which is not on a directly
connected network, routed(8) will trigger an assertion and terminate.
The affected system's routing table will no longer be updated. If the
affected system is a router, its routes will eventually expire from
other routers' routing tables, and its networks will no longer be
reachable unless they are also connected to another router.
IV. Workaround
Note that this problem does not affect a system on which routed(8)
is not enabled. The routed(8) daemon is not enabled by default.
Use a packet filter such as pf(4) or ipfw(4) to block incoming UDP
packets with destination port 520 that did not originate on the same
subnet as the destination address.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The routed service has to be restarted after the update. A reboot is
recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The routed service has to be restarted after the update. A reboot is
recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch http://security.FreeBSD.org/patches/SA-15:19/routed.patch
# fetch http://security.FreeBSD.org/patches/SA-15:19/routed.patch.asc
# gpg --verify routed.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/routed.patch
c) Recompile routed. Execute the following commands as root:
# cd /usr/src/sbin/routed
# make && make install
Restart the routed daemon, or reboot the system.
To restart the affected service after updating the system, either
reboot the system or execute the following command as root:
# service routed restart
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r286349
releng/9.3/ r286352
stable/10/ r286348
releng/10.1/ r286351
releng/10.2/ r286350
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5674>
The latest revision of this advisory is available at
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-15:19.routed.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.6 (FreeBSD)
iQIcBAEBCgAGBQJVwoplAAoJEO1n7NZdz2rnMFAP/3HWG6FrFxM3jgMcK7a5+nKP
O6BqVXpFdia0UUN5JlcEZXc89957mXdMXCDqNeTj3CeDc0p9GbPX1zV/vlYoOqhM
eIPwgERbMRFnDRaWm2ClG+aatJvdpeDEioNy8b8tmKq94JcpXIJnwX8dhY3WrMwj
Mc3QBGT08XLImHqNw6d6/0wavFeOZ/3g1ZoloAktsgA9KhTUOai6dUhIbIJzk6gh
0oa4NRkhzRNmUKyHOS6HDrghhQ/kZGtE8joVBxLBljK0Thi0mIZtn3UFGsNAgAWw
7WGAiTN2o8c48IUJosmiGsJ7rV1wCFt5zXrZVCcnq6dr60He16Z2Zwif2tugiTvm
5x9lDbTEnYOTxM38Ya5gMtMf733YgAtoRCkf3ROsnwXukJYVsJXms7Ej4NihoKMd
aYOLDItl+AXUGIyQ44GuUm2955wo9Fb5RlkDSCLAvdgnkPk+k0puLp0MR0B2MOAI
tdKNecRNg0fDR5gJbfdzdjVhsGBZXdYlxo4VjXUXDSZJ+8+jkAg2LA9DTRKIfbgX
BX5GiOhkhIivFlgvSePv0LRuIbgt0H1cxiJdk6OqNS5gROuqwo7wwUnaig8KVKOI
887gfpf7PepYD4xWTo3nAoEcGM0rBwUyq1X3pbx9OJADcqRvOhxfMcHFcCv75uxa
OISkQhkWdZUv6ls76rRu
=p5Rl
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:18.bsdpatch
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-15:18.bsdpatch Security Advisory
The FreeBSD Project
Topic: shell injection vulnerability in patch(1)
Category: contrib
Module: patch
Announced: 2015-08-05
Credits: Martin Natano
Affects: FreeBSD 10.x.
Corrected: 2015-08-05 22:05:02 UTC (stable/10, 10.2-PRERELEASE)
2015-08-05 22:05:02 UTC (stable/10, 10.2-BETA2-p3)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC1-p2)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC2-p1)
2015-08-05 22:05:18 UTC (releng/10.1, 10.1-RELEASE-p17)
CVE Name: CVE-2015-1418
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The patch(1) utility takes a patch file produced by the diff(1) program and
apply the differences to an original file, producing a patched version.
The patch(1) utility supports patches that uses ed(1) script format, as
required by the POSIX.1-2008 standard.
ed(1) is a line-oriented text editor.
II. Problem Description
Due to insufficient sanitization of the input patch stream, it is possible
for a patch file to cause patch(1) to pass certain ed(1) scripts to the
ed(1) editor, which would run commands.
III. Impact
This issue could be exploited to execute arbitrary commands as the user
invoking patch(1) against a specically crafted patch file, which could be
leveraged to obtain elevated privileges.
IV. Workaround
No workaround is available, but systems where a privileged user does not
make use of patches without proper validation are not affected.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
A reboot is not required after updating.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
A reboot is not required after updating.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:18/bsdpatch.patch
# fetch https://security.FreeBSD.org/patches/SA-15:18/bsdpatch.patch.asc
# gpg --verify bsdpatch.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r286348
releng/10.1/ r286351
releng/10.2/ r286350
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1418>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:18.bsdpatch.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.6 (FreeBSD)
iQIcBAEBCgAGBQJVwoplAAoJEO1n7NZdz2rn8D4QAM0077U1nLiJFIU1VcM9IOKp
GeZ/w9SnkrKqKzAQpq3QS1hmw0TxvP8kuJNuRVFF6M15Woprfxccb8mDxM0ntru4
t8rq/QLO2jMWopf67Spv6jr6GLLQXkiyRwLEyr7L8a7MbrFwjO1wYt+8GnQ6Nsvn
kNfCnbNKPr1gNYM1XsLS7Ej1kl7aBx3xGQXU4d9HlOs/1X7rnPCnGKuc3ZD2Z/N4
zu8pV4NMFhWyJsax+FVYEFxwyd2uEb73A35nz/sQhGiwGOCtL424KG+hwj9mnm45
8f4m+53b6RDcBh6xU41fghMsac2PVCzY2r9GXXXJNlfEa+KnSN8yC+CvtXYEM9BX
9Y5g6i++RVLLT7mwFdG86FjZxSGpDBXlkpZ4I9qiS4YC8MFO4qC7SFzufxtfOcg+
R+QSj+DWOfeHDcXjEkHGlqTW9poE2EDWXDLwlEoOykh9NLyWl6enYd8ZEI3GUqyJ
FgKiICrs1vUuGhOhTCgjyQjQUc6jaV/GzhLBJfyxz5xYDpr7DIILxJ8uki2FJcHS
tZhlNu6JNqpBlsWNspqjw7NSP2j58Uj0bBdwWvFNX8otQiIXVfkdY8RCjxstq5lT
3bcF6akAFEBx/f/VYM1lswLM/XdbORYC3asLu84BP541EDqdx9d88TeTKNPvyb4Q
sGJ763WSlsoLrQDr8CUt
=iR0L
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-SA-15:18.bsdpatch Security Advisory
The FreeBSD Project
Topic: shell injection vulnerability in patch(1)
Category: contrib
Module: patch
Announced: 2015-08-05
Credits: Martin Natano
Affects: FreeBSD 10.x.
Corrected: 2015-08-05 22:05:02 UTC (stable/10, 10.2-PRERELEASE)
2015-08-05 22:05:02 UTC (stable/10, 10.2-BETA2-p3)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC1-p2)
2015-08-05 22:05:12 UTC (releng/10.2, 10.2-RC2-p1)
2015-08-05 22:05:18 UTC (releng/10.1, 10.1-RELEASE-p17)
CVE Name: CVE-2015-1418
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The patch(1) utility takes a patch file produced by the diff(1) program and
apply the differences to an original file, producing a patched version.
The patch(1) utility supports patches that uses ed(1) script format, as
required by the POSIX.1-2008 standard.
ed(1) is a line-oriented text editor.
II. Problem Description
Due to insufficient sanitization of the input patch stream, it is possible
for a patch file to cause patch(1) to pass certain ed(1) scripts to the
ed(1) editor, which would run commands.
III. Impact
This issue could be exploited to execute arbitrary commands as the user
invoking patch(1) against a specically crafted patch file, which could be
leveraged to obtain elevated privileges.
IV. Workaround
No workaround is available, but systems where a privileged user does not
make use of patches without proper validation are not affected.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
A reboot is not required after updating.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
A reboot is not required after updating.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-15:18/bsdpatch.patch
# fetch https://security.FreeBSD.org/patches/SA-15:18/bsdpatch.patch.asc
# gpg --verify bsdpatch.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r286348
releng/10.1/ r286351
releng/10.2/ r286350
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1418>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-15:18.bsdpatch.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.6 (FreeBSD)
iQIcBAEBCgAGBQJVwoplAAoJEO1n7NZdz2rn8D4QAM0077U1nLiJFIU1VcM9IOKp
GeZ/w9SnkrKqKzAQpq3QS1hmw0TxvP8kuJNuRVFF6M15Woprfxccb8mDxM0ntru4
t8rq/QLO2jMWopf67Spv6jr6GLLQXkiyRwLEyr7L8a7MbrFwjO1wYt+8GnQ6Nsvn
kNfCnbNKPr1gNYM1XsLS7Ej1kl7aBx3xGQXU4d9HlOs/1X7rnPCnGKuc3ZD2Z/N4
zu8pV4NMFhWyJsax+FVYEFxwyd2uEb73A35nz/sQhGiwGOCtL424KG+hwj9mnm45
8f4m+53b6RDcBh6xU41fghMsac2PVCzY2r9GXXXJNlfEa+KnSN8yC+CvtXYEM9BX
9Y5g6i++RVLLT7mwFdG86FjZxSGpDBXlkpZ4I9qiS4YC8MFO4qC7SFzufxtfOcg+
R+QSj+DWOfeHDcXjEkHGlqTW9poE2EDWXDLwlEoOykh9NLyWl6enYd8ZEI3GUqyJ
FgKiICrs1vUuGhOhTCgjyQjQUc6jaV/GzhLBJfyxz5xYDpr7DIILxJ8uki2FJcHS
tZhlNu6JNqpBlsWNspqjw7NSP2j58Uj0bBdwWvFNX8otQiIXVfkdY8RCjxstq5lT
3bcF6akAFEBx/f/VYM1lswLM/XdbORYC3asLu84BP541EDqdx9d88TeTKNPvyb4Q
sGJ763WSlsoLrQDr8CUt
=iR0L
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[announce] NYC*BUG Tonight: What's New with OpenBSD?
August 5: What's New with OpenBSD, Brian Callahan
18:45, Stone Creek Bar & Lounge: 140 E 27th St
Abstract
Another year, another two releases for OpenBSD. Even for the best of us,
it can be difficult to keep track of all the development activity. This
talk highlights some of the big new things over the last year of
OpenBSD. Hopefully by the end of the talk you will have learned about
some new feature you didn't know about before.
Speaker Bio
Brian is a Ph.D. student in the Science and Technology Studies
department at Rensselaer Polytechnic Institute. He has been an OpenBSD
developer for a few years, spending most of his time in the ports tree.
One time he gave a talk at BSDCan with George. Ike was in attendance.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org/mailman/listinfo/announce
18:45, Stone Creek Bar & Lounge: 140 E 27th St
Abstract
Another year, another two releases for OpenBSD. Even for the best of us,
it can be difficult to keep track of all the development activity. This
talk highlights some of the big new things over the last year of
OpenBSD. Hopefully by the end of the talk you will have learned about
some new feature you didn't know about before.
Speaker Bio
Brian is a Ph.D. student in the Science and Technology Studies
department at Rensselaer Polytechnic Institute. He has been an OpenBSD
developer for a few years, spending most of his time in the ports tree.
One time he gave a talk at BSDCan with George. Ike was in attendance.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org/mailman/listinfo/announce
Heads up: F23 products/spins, weak rpm dependencies, and you
In Fedora 23, rpm has grown support for weak dependencies (Recommends:
and Suggests: tags). However, the compose tools have not been ported to
dnf/libsolv yet, which means these tags will have no effect at image
compose time.
and Suggests: tags). However, the compose tools have not been ported to
dnf/libsolv yet, which means these tags will have no effect at image
compose time.
This has implications for spin kickstarts: the set of packages included
in media derived from a kickstart will be a subset of the packages you
would see installed by passing the kickstart package/group list to dnf.
As a result, any packages that you want to see included on the
generated media must be either explicitly listed in the kickstart, or
brought in with Requires: from another package. Technically this is not
different from previous Fedora releases, but it is different from what
you might get from using F23's dnf to compute a package list.
Product and spin kickstart maintainers are advised to double-check the
package manifests for the produced media to ensure all packages they
want included actually are included.
- ajax
_______________________________________________
devel-announce mailing list
devel-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
Tuesday, August 4, 2015
[Guidelines change] Changes to the packaging guidelines
Here are the recent changes to the packaging guidelines.
-----
The big change is that the Python guidelines have been extensively
reorganized and partially rewritten, and new macros are available which
simplify packaging by removing some of the boilerplate which was
previously required.
The main guideline page has been slimmed down to show the more basic
info and a clean and simple spec using the new macros which is free of
multiline conditionals.
boilerplate previously associated with python packages. Some of the
more esoteric information has been moved to an appendix page to keep the
main page of reasonable size.
The new guidelines are currently only functional on Fedora 22 and newer
releases, but are currently in updates-testing for Fedora 21 and EPEL7.
The older guidelines are preserved in a separate page and we'll try to
keep them updated with new requirements.
The new guidelines page:
* https://fedoraproject.org/wiki/Packaging:Python
The appendix:
* https://fedoraproject.org/wiki/Packaging:Python_Appendix
The old guidelines:
* https://fedoraproject.org/wiki/Packaging:Python_Old
Note that these cleaned up pages (and the old copy) include some
new guidelines as well:
There is new section indicating that -OO must not be used for python
versions less than 3.5.
* https://fedoraproject.org/wiki/Packaging:Python#Optimization
There are requirements for what python module packages must provide
(via Provides:):
* https://fedoraproject.org/wiki/Packaging:Python#Provides
Related FPC tickets:
* https://fedorahosted.org/fpc/ticket/281
* https://fedorahosted.org/fpc/ticket/534
* https://fedorahosted.org/fpc/ticket/542
* https://fedorahosted.org/fpc/ticket/545
* https://fedorahosted.org/fpc/ticket/552
-----
Guidelines have been added covering services which need to perform setup
when they are first started (including self-signed certificate
generation).
*https://fedoraproject.org/wiki/Packaging:Initial_Service_Setup
*https://fedorahosted.org/fpc/ticket/506
-----
The guideline on spec file naming was moved into the main guidelines and
now requires that its name be constructed by taking the name of the
source package and appending ".spec".
* https://fedoraproject.org/wiki/Packaging:Guidelines#Spec_File_Naming
* https://fedorahosted.org/fpc/ticket/553
-----
FPC can now grant exceptions to the regular package review procedures.
* https://fedoraproject.org/wiki/Packaging_Committee#Review_Process_Exemption_Procedure
* https://fedorahosted.org/fpc/ticket/539
* https://fedorahosted.org/fesco/ticket/1435
_______________________________________________
devel-announce mailing list
devel-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
reallost1.fbsd2233449 认识绩效管理的重要性、并正确理解绩效管理
《企业绩效考核与薪酬体系设计实战特训班》
【主讲：蔡巍】
【培训时间】2015年8月13-15日北京、8月21-23日广州 9月10-12日上海、9月18-20日深圳
【培训对象】企、事业单位董事长、总经理、人力资源总监、人力资源经理、绩效、薪酬等
【授课方式】案例分享、实务分析、互动讨论、培训游戏
【培训费用】5400/ 人 (包含：课程、讲义、午餐、茶点等费用)
【报名热线】上海:021--3100--6787 、北京：010--5129--9910，深圳：0755--6128--0006，
【在线QQ】 320588808 、 189-189-58501 许先生
【课程背景】
现代企业管理，更注重"以人为本"的人性化管理模式，企业管理的重点也日趋体现在对人的管理策略上。作为现代企业的人力资源管理者，应以战略高度构建高效实用的人力资源管理系统，建立科学考核激励制度和先进的企业薪酬体系，以最大限度地激发人才潜能，来创建优秀团队，并推动组织变革与创新，最终实现组织的持续发展。我们针对中国企业在推行西方管理模式中的种种弊端和疑惑，以及中国企业目前正处于改革与创新时期，特举办"企业绩效考核与薪酬管理实战特训班"。由著名人力资源专家蔡巍讲授，旨在帮助企业家、人力资源经理开阔思路，激发灵感，培养带领企业持续健康发展的卓越人力资源管理人才，欢迎参加！
【课程目标】
了解薪酬改革背景，更新观念，理清改革思路，明确改革目标，
了解岗位测评的相关知识，科学进行岗位测评；
认识绩效管理的重要性、并正确理解绩效管理，
学习考核的方法，全面了解绩效管理的运作程序和设计方法，
重点学习KPI、并介绍平衡计分卡，
了解绩效管理推进中的问题、并避免运作中的误区。
导师简介 ----【蔡巍】
国内知名的人力资源管理实务专家，工商管理硕士，权威人力资源管理实战专家，特别在绩效与薪酬体系设计方面有很深的造诣，形成了自己特有的实战方法；曾为大型企业集团、上市公司、连锁业集团、高科技公司等多个行业的众多企业进行过全面的人力资源咨询服务。是《中国经营报》、《人力资本》等多家媒体专栏的特约撰稿人和专家评论员。
【出版书籍】
《奔跑的蜈蚣：如何以考核促进成长》、《吹口哨的黄牛：以薪酬留住人才》、
《KPI，"关键绩效"指引成功》、《BSC，"平衡计分"保证发展》，受到企业的高度重视，和给予极高
的评价。
【曾经辅导与参加过培训的企业】
东风汽车、东软集团、中国石油股份、TCL、青岛啤酒、振杰国际、创维集团、徐工集团、三一重工、粤高速、农业银行、北京网通、山西移动、河南移动、宁波成路集团、东风学铁龙、雪铁龙、中国电信、广州西婷化妆品、万家乐燃气热水器、格力空调、南航、新疆华世丹药业、南方李锦记、首信集团、光明维他奶、华工科技、达实智能、拓邦电子、武汉高创集团 、华美集团等企业。
课程大纲:
一．推行KPI与绩效管理体系需要解决的三大问题
1、企业建立绩效体系所面临的方法问题；
以感觉为基础判断还是以事实为基础判断？
短期考核还是长期考核？
短期利益还是长期利益？
关键业绩还是非关键业绩？
绩效管理如何与战略接口？
KPI成绩与奖金挂钩的问题？
2、经理人与员工的认识对推行绩效管理的影响；
传统文化对绩效管理的影响
为什么没有人愿意做A？
为什么推行绩效管理这么困难？
3、管理基础对推行KPI的影响
二、绩效管理的方式方法
1、模糊感觉判断法；
2、360°评估；
3、强制分布法；
要不要排名？
谁和谁排名？
怎么排名？
4、关键业绩指标考核；
三．KPI操作中的几个基本问题
1、什么是目标与指标
2、KPI指标的基本属性与操作注意要点
为什么评价起来感觉很难操作——刻度问题；
他们为什么不接受这些考核指标——可控性问题
为什么考核这些指标后适得其反——行为问题
3、在公司建立KPI体系的思路；
四．平衡计分卡
1、什么是平衡计分卡；
2、战略与平衡计分卡有什么关系？——战略与战略地图；
3、平衡计算分卡落实的三种方式；
五．如何分解KPI
KPI如果不分解落实下去，就会失去了基础，但是分解KPI的过程中会遇到很多问题，比如：一个kpi指标和
好多部门都有关系，到底考核谁好呢？
如何解决这些问题呢？如何将KPI分解落实下去呢？
1、如何分解KpI——上一级指标与下级指标的关系
2、分解指标的2种基本方法
3、按照驱动因素分解KPI指标，3种基本的模式
4、按照驱动因素分解的四种方法
按照指标的结构分解法；
OAM分解法；
贡献路径图法；
流程关键控制点法；
5、分解KPI指标的注意问题：权利对指标分解的影响、组织结构的影响、指标的冲突性等
六．指标词典的编制
指标找到了就万事大吉了？还存在什么问题呢？为什么需要定义KPI，怎样定义KPI?
1、为什么需要定义KPI
2、财务指标定义时，需要注意的问题；
3、非财务指标，定义时需要注意的问题；
4、谁来提供数据——自己提供，别人提供，利益相关者提供？
七、任务指标如何定义
职能部门的指标，有些无法量化，该如何定义？
1、职能部门工作的特点；
2、什么是任务指标；
3、难度不同的任务考核；
4、工作量不均衡如何处理？
5、谁来制定任务？
6、临时任务多如何处理？
7、任务指标的定义模式；
八、目标值的确定
找到了衡量指标就可以了嘛？如何确定目标呢？超过了目标应该计多少分？没有达到目标应该得多少分？
1、设定目标的痛苦；
2、目标订不准怎么办？
3、没有历史数据怎么办？
4、竞争，资源，能力对目标的影响；
5、如何让下属主动把目标定的最合适——联合基法
6、长周期的目标如何分解到短周期；
九、KPI的计分方式
1、比率法；
2、层差法；
3、说明法；
十．权重的设计
1、什么是指标的组合方式；
2、组合方式的种类；
3、设置权重的步骤与注意问题；
十一．主基二元考核法
关注了关键业绩指标，非关键业绩指标怎么办？不关注非关键业绩指标是否会出问题？
如果全面关注关键业绩指标和非关键业绩指标，资源是否够用？如何解决这个问题呢？
1、KPI所无法解决的问题；
2、主要绩效与基础绩效的关系；
3、如何在实践中运用主基二元考核法；
十二．推行绩效管理所遇到的问题与对策；
推行KPI不只是人力资源部门或者企管部门的事情，KPI在推行过程中有哪些问题与难点呢？
1、推行绩效管理的组织模式与各个部门的职责；
2、推行绩效管理需要解决观念问题；
3、推行需要解决制度与技巧问题
4、推行需要解决心态问题；
十三、绩效沟通
1、计划阶段的绩效沟通
2、辅导阶段
3、考核阶段的绩效沟通
4、绩效问题分析与改进——组织改进、领导改进、员工改进；
【岗位分析课程大纲】
一．什么是岗位分析
1、什么是岗位分析；
2、岗位分析的作用；
二、岗位分析的方法
1、组织与部门职责与岗位职责的关系
2、常用的岗位分析的方法——资料分析法，问卷法，观察；
三、岗位分析的步骤与流程
1、组织结构设计与流程设计；
2、部门职责设计；
3、岗位职责设计；
4、岗位任职资格设计；
5、常见的岗位设计的误区与错误；
四、如何确定编制的工具方法
1、业务数据分析法；
2、劳动效率定编法；
3、比例法；
4、预算控制法
【薪酬设计课程大纲】
引子:
什么是薪酬；
人力资源价值链；
职位、人、市场、绩效对薪酬的影响；
薪酬设计的框架
一、岗位分析部分：
1、什么是岗位分析
什么是岗位分析；
岗位分析需要分析什么内容；
岗位分析的原则
2、岗位分析的步骤与流程
岗位分析的方法；
如何编制岗位职责；
3、任职资格
职位族划分；
岗位任职资格编制的方法；
4、如何确定编制的工具方法
业务数据分析法；
劳动效率定编法；
比例法；
预算控制法；
二、薪酬设计需要解决的矛盾——内部公平性
1.为什么要职位评估；
2.职位评估所使用的方法；
3.常见的职位评估的工具介绍；
4.如何设计或者选择职位评估模型；
5.职位评估的程序与注意问题；
6.职位评估案例
三、薪酬设计需要解决的矛盾——外部公平性
1.什么是外部公平性；
2.如何进行薪酬调查；
3.如何处理薪酬调查的数据；
4.如何确定薪酬水平；
5.中位值级差的计算；
四、薪酬结构的划分；
1、什么是薪酬结构；
2、薪酬的幅度与重叠度的计算；
3、宽带还是窄带；
4、固定与变动比例的划分需要考虑的问题
薪酬水平
行业特点
管理层次
职位序列；
五、薪酬与能力的关系
1.薪酬为什么需要和能力挂钩；
2.什么情况下需要与能力挂钩；
3.技能薪酬帮助企业解决的三个问题；
4.如何评估员工能力；
5.加薪是以能力为核心，还是以业绩为核心；
六、奖金设计如何使公司、部门、个人三挂钩；
1、几种公司、部门、个人奖金挂钩模式的思考；
2、几种模式优缺点的对比；
3、集团公司下属分子公司的效益是否要与集团公司挂钩？
七、奖金设计与外部因素的影响
1、老总的奖金究竟该不该发？
2、采购经理的奖金究竟该不该发？
3、如果过滤外部因素的影响；
八、企业内各部门奖金设计的要点
1、销售部门提成制，还是奖金制？
2、项目类型工作奖金的设计；
3、生产部门奖金的设计；
4、年薪制奖金的设计；
九、发奖金的周期
1、奖金周期与考核周期；
2、年终奖还是年中奖；
3、时机选择要考虑的要点；
4、奖金的滞后性；
十、薪酬管理
1、薪酬分析；
企业宏观的薪酬分析——投入产出；
微观的薪酬分析——内部竞争比率与外部竞争比率；
2、如何给员工设计加薪
按照业绩考核成绩加薪；
分数与排名对加薪的影响；
按照能力加薪；
按照能力与业绩综合考虑加薪；
按照能力与业绩与员工在宽带中的位置加薪；
3、薪酬预算与控制
温馨提示: 本课程可针对企业需求，上门服务，组织内训，欢迎咨询。
注：如不需此类信件信息，请转发送"删除"至wytuixin@163.com,我们会及时处理，谢谢您的理解。
[USN-2677-1] Oxide vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBAgAGBQJVwO6bAAoJEGEfvezVlG4PUBMH/REpFyDBMgEctgDrzqJYf5oZ
vI5pqhLBVB8A/lY7RP6AgNx8RjF4Q49qlVcbRFp/y0Z9NFpjcEoKlswz402qNn0K
/aW1Ao3+DEEUHlZZ1jdQnxCnI7Q4bALHUp8MkBEyNZzIkfY7Ao4lhP2PMSo7EVqr
bx9iYU0zXVrmIhfVhwOs1ctpTnkypt4cYr4kFHluWyddo7eQtihs/0nEEvxQBtgi
DfD1iMUxlIhckIiQZtkfbfUrxAE5Bx1L47yOkEM7cEOKIo8V9UbTHm0DgbGLgheo
emt0NMLyRqsgBgQY7rsQxcVmdpsYlbJKr0HSaLI+dYi/ijcGskfzVBv4uqnLJzE=
=lv3c
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2677-1
August 04, 2015
oxide-qt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine library for Qt (QML plugin)
Details:
An uninitialized value issue was discovered in ICU. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service. (CVE-2015-1270)
A use-after-free was discovered in the GPU process implementation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1272)
A use-after-free was discovered in the IndexedDB implementation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1276)
A use-after-free was discovered in the accessibility implemetation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1277)
A memory corruption issue was discovered in Skia. If a user were tricked
in to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service via renderer crash, or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2015-1280)
It was discovered that Blink did not properly determine the V8 context of
a microtask in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass Content Security Policy (CSP) restrictions. (CVE-2015-1281)
Multiple integer overflows were discovered in Expat. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
the program. (CVE-2015-1283)
It was discovered that Blink did not enforce a page's maximum number of
frames in some circumstances, resulting in a use-after-free. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via renderer crash,
or execute arbitrary code with the privileges of the sandboxed render
process. (CVE-2015-1284)
It was discovered that the XSS auditor in Blink did not properly choose a
truncation point. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information. (CVE-2015-1285)
An issue was discovered in the CSS implementation in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1287)
Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service via application crash or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1289)
A use-after-free was discovered in oxide::qt::URLRequestDelegatedJob in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking the program. (CVE-2015-1329)
A crash was discovered in the regular expression implementation in V8 in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service. (CVE-2015-5605)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
liboxideqtcore0 1.8.4-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
liboxideqtcore0 1.8.4-0ubuntu0.14.04.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2677-1
CVE-2015-1270, CVE-2015-1272, CVE-2015-1276, CVE-2015-1277,
CVE-2015-1280, CVE-2015-1281, CVE-2015-1283, CVE-2015-1284,
CVE-2015-1285, CVE-2015-1287, CVE-2015-1289, CVE-2015-1329,
CVE-2015-5605, https://launchpad.net/bugs/1466208
Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.8.4-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.8.4-0ubuntu0.14.04.2
Version: GnuPG v1
iQEcBAEBAgAGBQJVwO6bAAoJEGEfvezVlG4PUBMH/REpFyDBMgEctgDrzqJYf5oZ
vI5pqhLBVB8A/lY7RP6AgNx8RjF4Q49qlVcbRFp/y0Z9NFpjcEoKlswz402qNn0K
/aW1Ao3+DEEUHlZZ1jdQnxCnI7Q4bALHUp8MkBEyNZzIkfY7Ao4lhP2PMSo7EVqr
bx9iYU0zXVrmIhfVhwOs1ctpTnkypt4cYr4kFHluWyddo7eQtihs/0nEEvxQBtgi
DfD1iMUxlIhckIiQZtkfbfUrxAE5Bx1L47yOkEM7cEOKIo8V9UbTHm0DgbGLgheo
emt0NMLyRqsgBgQY7rsQxcVmdpsYlbJKr0HSaLI+dYi/ijcGskfzVBv4uqnLJzE=
=lv3c
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2677-1
August 04, 2015
oxide-qt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine library for Qt (QML plugin)
Details:
An uninitialized value issue was discovered in ICU. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service. (CVE-2015-1270)
A use-after-free was discovered in the GPU process implementation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1272)
A use-after-free was discovered in the IndexedDB implementation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1276)
A use-after-free was discovered in the accessibility implemetation in
Chromium. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1277)
A memory corruption issue was discovered in Skia. If a user were tricked
in to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service via renderer crash, or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2015-1280)
It was discovered that Blink did not properly determine the V8 context of
a microtask in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass Content Security Policy (CSP) restrictions. (CVE-2015-1281)
Multiple integer overflows were discovered in Expat. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
the program. (CVE-2015-1283)
It was discovered that Blink did not enforce a page's maximum number of
frames in some circumstances, resulting in a use-after-free. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via renderer crash,
or execute arbitrary code with the privileges of the sandboxed render
process. (CVE-2015-1284)
It was discovered that the XSS auditor in Blink did not properly choose a
truncation point. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information. (CVE-2015-1285)
An issue was discovered in the CSS implementation in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1287)
Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service via application crash or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2015-1289)
A use-after-free was discovered in oxide::qt::URLRequestDelegatedJob in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking the program. (CVE-2015-1329)
A crash was discovered in the regular expression implementation in V8 in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service. (CVE-2015-5605)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 15.04:
liboxideqtcore0 1.8.4-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
liboxideqtcore0 1.8.4-0ubuntu0.14.04.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2677-1
CVE-2015-1270, CVE-2015-1272, CVE-2015-1276, CVE-2015-1277,
CVE-2015-1280, CVE-2015-1281, CVE-2015-1283, CVE-2015-1284,
CVE-2015-1285, CVE-2015-1287, CVE-2015-1289, CVE-2015-1329,
CVE-2015-5605, https://launchpad.net/bugs/1466208
Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.8.4-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.8.4-0ubuntu0.14.04.2
Subscribe to:
Posts (Atom)