CentOS Errata and Security Advisory 2016:1217 Critical
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1217.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
acc8466a5e2e7b4f97e476ef08608babd3957f9dea929ede45436549dd189940 firefox-45.2.0-1.el6.centos.i686.rpm
x86_64:
acc8466a5e2e7b4f97e476ef08608babd3957f9dea929ede45436549dd189940 firefox-45.2.0-1.el6.centos.i686.rpm
3c0badf351a25c811dce868afd434b9341a3da64018937be7bac76c39ecb5a42 firefox-45.2.0-1.el6.centos.x86_64.rpm
Source:
733ca4db9bc0d6dcb4edc0d270299834e4b78b0f115025fd310146ce420380e2 firefox-45.2.0-1.el6.centos.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Wednesday, June 8, 2016
[FreeBSD-Announce] Latest issue of the FreeBSD Journal now available
Hi everyone,
The latest issue of the FreeBSD Journal is posted.
The latest issue of the FreeBSD Journal is posted.
Table of contents:
• ARMv8 Enabled as Tier 1 Architecture: A Collaborative Development Project
• FreeBSD on Cavium ThunderX System on a Chip
• bhyve ATA Emulation
• Foundation Letter
• Conference Report
• This Month in FreeBSD
• svn update
• Building Community Around the Google Summer of Code
• Meeting Report
• Events Calendar
See a preview, login to view, or subscribe here: https://mydigitalpublication.com/publication?i=307616
Thanks
Anne
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Tuesday, June 7, 2016
Information about increase of spam in Fedora Infrastructure
Greetings.
Over the last few months there has been a large increase in spam
submitted to some Fedora Infrastructure services, mostly focused on
fedorahosted trac (wiki and tickets) and the Fedora project wiki.
(They have also begun targeting bugzilla.redhat.com, please report any
spams there to
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&version=4.4)
To combat this flood of spam we have created an automated spam
detection and cleanup service called Basset (https://pagure.io/basset)
Basset hooks into our infrastructure in a number of places:
* Into the Fedora Account System (FAS). Basset may decide based on a
number of factors that a new account does not appear legitimate and
mark it 'spamcheck_denied' or 'spamcheck_manual' (it's not sure). New
account holders that find themselves with this status should get an
email asking them to mail accounts@fedoraproject.org to reset and
retrain Basset.
* Into trac ticket and wiki submissions. When spam tickets or wiki
edits are noted, the user is moved to 'spamcheck_denied' status,
their edits or tickets are deleted. If you see a spam ticket or wiki
edit that is older than an hour or so please let us know and we can
train Basset on it. Otherwise, please leave such tickets and edits
alone, or Basset may mark your account as well for editing the spam.
* Into other services soon as well that spammers may target.
Please do let us know at admin@fedoraproject.org or via a
infrastructure trac ticket
( https://fedorahosted.org/fedora-infrastructure/ ) if you find any
spam not deleted/cleaned up, or users mis-marked. Do allow Basset
a few minutes processing time however.
kevin
Over the last few months there has been a large increase in spam
submitted to some Fedora Infrastructure services, mostly focused on
fedorahosted trac (wiki and tickets) and the Fedora project wiki.
(They have also begun targeting bugzilla.redhat.com, please report any
spams there to
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&version=4.4)
To combat this flood of spam we have created an automated spam
detection and cleanup service called Basset (https://pagure.io/basset)
Basset hooks into our infrastructure in a number of places:
* Into the Fedora Account System (FAS). Basset may decide based on a
number of factors that a new account does not appear legitimate and
mark it 'spamcheck_denied' or 'spamcheck_manual' (it's not sure). New
account holders that find themselves with this status should get an
email asking them to mail accounts@fedoraproject.org to reset and
retrain Basset.
* Into trac ticket and wiki submissions. When spam tickets or wiki
edits are noted, the user is moved to 'spamcheck_denied' status,
their edits or tickets are deleted. If you see a spam ticket or wiki
edit that is older than an hour or so please let us know and we can
train Basset on it. Otherwise, please leave such tickets and edits
alone, or Basset may mark your account as well for editing the spam.
* Into other services soon as well that spammers may target.
Please do let us know at admin@fedoraproject.org or via a
infrastructure trac ticket
( https://fedorahosted.org/fedora-infrastructure/ ) if you find any
spam not deleted/cleaned up, or users mis-marked. Do allow Basset
a few minutes processing time however.
kevin
reallost1.fbsd2233449：工业4.0背景下中国制造业的明天
尊敬的reallost1.fbsd2233449:您好！
工业4.0背景下中国制造业的明天
——从传统到精益化到智能化的卓越生产系统构建
——制造型企业（降成本、提效率）必修之课
附件中的知识希望能帮助到您的工作。。。
感谢您百忙中查收这份邮件。。。
贾寒儿
2016-6-723:13:49
[CentOS-announce] CESA-2016:1205 Important CentOS 7 spice Security Update
CentOS Errata and Security Advisory 2016:1205 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1205.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
6373aaf37d9487127df5fb1afed95d2629f63ca38209b0e550758558798ce7c5 spice-server-0.12.4-15.el7_2.1.x86_64.rpm
5cb372ceb2fdf595c7eba34b8938ad8db7e87a61bfb77c73a5afb57e559e28a4 spice-server-devel-0.12.4-15.el7_2.1.x86_64.rpm
Source:
98a5551264ccbd5d1e686783186d6d36a63d375ff90f87f2b8d779b9320e9481 spice-0.12.4-15.el7_2.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1205.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
6373aaf37d9487127df5fb1afed95d2629f63ca38209b0e550758558798ce7c5 spice-server-0.12.4-15.el7_2.1.x86_64.rpm
5cb372ceb2fdf595c7eba34b8938ad8db7e87a61bfb77c73a5afb57e559e28a4 spice-server-devel-0.12.4-15.el7_2.1.x86_64.rpm
Source:
98a5551264ccbd5d1e686783186d6d36a63d375ff90f87f2b8d779b9320e9481 spice-0.12.4-15.el7_2.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2016:1204 Important CentOS 6 spice-server Security Update
CentOS Errata and Security Advisory 2016:1204 Important
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1204.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
809e9d71025ce9587d91b9f2d5d9fb02534a80cacae2a99996f46e1be7187480 spice-server-0.12.4-13.el6.1.x86_64.rpm
9fbb2f0cc41fa67b76a366ef426de81d516a6514a23942ca30e97cfb52599c32 spice-server-devel-0.12.4-13.el6.1.x86_64.rpm
Source:
b1a32672aeb5a90664d461b30155a6f74f8d6c533750551eb3111d222e5c1a10 spice-server-0.12.4-13.el6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1204.html
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
809e9d71025ce9587d91b9f2d5d9fb02534a80cacae2a99996f46e1be7187480 spice-server-0.12.4-13.el6.1.x86_64.rpm
9fbb2f0cc41fa67b76a366ef426de81d516a6514a23942ca30e97cfb52599c32 spice-server-devel-0.12.4-13.el6.1.x86_64.rpm
Source:
b1a32672aeb5a90664d461b30155a6f74f8d6c533750551eb3111d222e5c1a10 spice-server-0.12.4-13.el6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Monday, June 6, 2016
[USN-2994-1] libxml2 vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJXVbfmAAoJEGVp2FWnRL6TMGAP/1Ouz3CwxCVKrxAETopcvzT5
4ozan1DJorPwr3p1KKhWLUWK5oack2PtvIeLQ4Pf0Cj4hhfwO0gobF+crbyRR6mQ
TjgHXUc96s7kIpZn5O9E+VeIo6a2iK2UQYDMQm7SGDKJX8mmb7gzxrb9m+Z7If/Z
WS2QU6fEXByPEUMgQG2bgY33Ppniltxxi640WK4qvLlWOLBNUT9Y5sDzzSHNA5Tb
rGKfZVV2vHYOFG0oyCx24hL7aca/Tak7+iIQS/9xBpodr+bCHJphjXRJXN9oyca7
lLvW2X18t/bnVef8lPTXOcowH1zliVBXuuVCUBUdht3nZsQEmtykQ1GIFuJCJm4/
wymYYZ/zHy5memTp+uTf8keKmhz0s5UV421pK4zkAo2wXX2NW6uczUa4b6s68+Dw
rEHDbbQeVbxBlMr9RS54J3mWdLyV9J4tijPU4e4MmSi8udkBWBBc6y+4vnAB7kSo
r/cgQd1ULuJLiEv/L4nrzMqa3O7taQNwSHlvY5xHYWWPCuph/DVsjXPTavmIMaiF
InLZFV86FHFkyEYEknW1vxpt9dJfU+TswzBuQLDi+KqbO/OAzAARmY6ajU2FJNR7
s14D7tNIvPIjFkuUX50sSfLBoRCaxolRr3G5kBNJ51SH7/TKOLgVOwS2Pw3CTp+Y
NOwPPV2xjxb6LwStUgh1
=OT5F
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2994-1
June 06, 2016
libxml2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 15.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in libxml2.
Software Description:
- libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,
CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-1762, CVE-2016-1834)
Mateusz Jurczyk discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1835, CVE-2016-1837)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and
Ubuntu 16.04 LTS. (CVE-2016-1836)
Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1840)
It was discovered that libxml2 would load certain XML external entities. If
a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. (CVE-2016-4449)
Gustavo Grieco discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.1
Ubuntu 15.10:
libxml2 2.9.2+zdfsg1-4ubuntu0.4
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.8
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2994-1
CVE-2015-8806, CVE-2016-1762, CVE-2016-1833, CVE-2016-1834,
CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,
CVE-2016-1839, CVE-2016-1840, CVE-2016-2073, CVE-2016-3627,
CVE-2016-3705, CVE-2016-4447, CVE-2016-4449, CVE-2016-4483
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.2+zdfsg1-4ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.8
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.15
Version: GnuPG v2
iQIcBAEBCgAGBQJXVbfmAAoJEGVp2FWnRL6TMGAP/1Ouz3CwxCVKrxAETopcvzT5
4ozan1DJorPwr3p1KKhWLUWK5oack2PtvIeLQ4Pf0Cj4hhfwO0gobF+crbyRR6mQ
TjgHXUc96s7kIpZn5O9E+VeIo6a2iK2UQYDMQm7SGDKJX8mmb7gzxrb9m+Z7If/Z
WS2QU6fEXByPEUMgQG2bgY33Ppniltxxi640WK4qvLlWOLBNUT9Y5sDzzSHNA5Tb
rGKfZVV2vHYOFG0oyCx24hL7aca/Tak7+iIQS/9xBpodr+bCHJphjXRJXN9oyca7
lLvW2X18t/bnVef8lPTXOcowH1zliVBXuuVCUBUdht3nZsQEmtykQ1GIFuJCJm4/
wymYYZ/zHy5memTp+uTf8keKmhz0s5UV421pK4zkAo2wXX2NW6uczUa4b6s68+Dw
rEHDbbQeVbxBlMr9RS54J3mWdLyV9J4tijPU4e4MmSi8udkBWBBc6y+4vnAB7kSo
r/cgQd1ULuJLiEv/L4nrzMqa3O7taQNwSHlvY5xHYWWPCuph/DVsjXPTavmIMaiF
InLZFV86FHFkyEYEknW1vxpt9dJfU+TswzBuQLDi+KqbO/OAzAARmY6ajU2FJNR7
s14D7tNIvPIjFkuUX50sSfLBoRCaxolRr3G5kBNJ51SH7/TKOLgVOwS2Pw3CTp+Y
NOwPPV2xjxb6LwStUgh1
=OT5F
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2994-1
June 06, 2016
libxml2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 15.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in libxml2.
Software Description:
- libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,
CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-1762, CVE-2016-1834)
Mateusz Jurczyk discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1835, CVE-2016-1837)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and
Ubuntu 16.04 LTS. (CVE-2016-1836)
Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1840)
It was discovered that libxml2 would load certain XML external entities. If
a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. (CVE-2016-4449)
Gustavo Grieco discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.1
Ubuntu 15.10:
libxml2 2.9.2+zdfsg1-4ubuntu0.4
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.8
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2994-1
CVE-2015-8806, CVE-2016-1762, CVE-2016-1833, CVE-2016-1834,
CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,
CVE-2016-1839, CVE-2016-1840, CVE-2016-2073, CVE-2016-3627,
CVE-2016-3705, CVE-2016-4447, CVE-2016-4449, CVE-2016-4483
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.2+zdfsg1-4ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.8
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.15
[opensuse-announce] Open Build Service version 2.7 released
We are happy to announce the availability of the Open Build Service
Version 2.7! Three large features around the topic of integrating
external resources made it into this release. We worked on automatic
tracking of moving repositories of development versions like Fedora
Rawhide, distribution updates or rolling Linux releases like Arch. A
change to the OBS git integration to enable developers to work on
continuous builds. And last but not least an experimental KIWI import
that can be used to easily migrate your images from SUSE studio.
Our awesome community has been busy with this release. Since OBS 2.6
there have been over 2000 commits, changing over a 1.000 files with
nearly 9.000 additions and 16.000 deletions!
Additional to these three main features OBS 2.7 brings a lot of smaller,
more isolated features. The OBS backend now has support for the
simpleimage format to produce simple rootfs or squashfs images and can
build packages in the collax format, which is a variation of deb.
Additionally it supports build time source services that get executed
before the package build tool (eg. rpm-build).
The OBS frontend makes it possible to enforce removal of projects with
dependencies, restricts superseding requests to the same source project
and allows to pick only certain requests to supersede.
If you are interested in more details check out the 2.7 Release Notes.
It is also recommended to read these before updating your OBS instance!
https://github.com/openSUSE/open-build-service/blob/2.7/ReleaseNotes-2.7
Try OBS 2.7
-----------
The latest OBS version version is always deployed to our reference
server. You can try it out there.
The reference server http://build.opensuse.org is available for all open
source developers to build packages for the most popular distributions
including openSUSE, Debian, Fedora, Ubuntu, Arch, Red Hat Enterprise
Linux and SUSE Linux Enterprise. It is also used to build, release and
maintain the openSUSE distribution.
Install 2.7
-----------
Please read our setup instructions or better yet, use our appliance
http://openbuildservice.org/download/
WARNING: OBS 2.7 will be the last release supporting SUSE Linux
Enterprise Server 11 as base operating system.
Update to 2.7
-------------
If you already have a running OBS installation and want to update it,
please read also the README.UPDATERS file about the necessary steps.
https://github.com/openSUSE/open-build-service/blob/2.7/dist/README.UPDATERS
OBS Appliance users who have setup their LVM according to our
documentation can just replace their appliance image without data loss.
The migration will happen automatically.
About the Open Build Service
----------------------------
The Open Build Service (OBS) is a generic system to build and distribute
binary packages from sources in an automatic, consistent and
reproducible way. You can release packages as well as updates, add-ons,
appliances and entire distributions for a wide range of operating
systems and hardware architectures.
It is developed by a talented team of developers as Free Software and is
used by many Free and Open Source software projects, companies and
researchers. Including but not limited to SUSE the original provider of
the enterprise Linux distribution, the Tizen standards-based software
platform supported by leading mobile operators and ownCloud your secure
enterprise file sync and share.
We hope you enjoy this release and look forward to your feedback!
💚 Your Open Build Service Team
--
To unsubscribe, e-mail: opensuse-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-announce+help@opensuse.org
Version 2.7! Three large features around the topic of integrating
external resources made it into this release. We worked on automatic
tracking of moving repositories of development versions like Fedora
Rawhide, distribution updates or rolling Linux releases like Arch. A
change to the OBS git integration to enable developers to work on
continuous builds. And last but not least an experimental KIWI import
that can be used to easily migrate your images from SUSE studio.
Our awesome community has been busy with this release. Since OBS 2.6
there have been over 2000 commits, changing over a 1.000 files with
nearly 9.000 additions and 16.000 deletions!
Additional to these three main features OBS 2.7 brings a lot of smaller,
more isolated features. The OBS backend now has support for the
simpleimage format to produce simple rootfs or squashfs images and can
build packages in the collax format, which is a variation of deb.
Additionally it supports build time source services that get executed
before the package build tool (eg. rpm-build).
The OBS frontend makes it possible to enforce removal of projects with
dependencies, restricts superseding requests to the same source project
and allows to pick only certain requests to supersede.
If you are interested in more details check out the 2.7 Release Notes.
It is also recommended to read these before updating your OBS instance!
https://github.com/openSUSE/open-build-service/blob/2.7/ReleaseNotes-2.7
Try OBS 2.7
-----------
The latest OBS version version is always deployed to our reference
server. You can try it out there.
The reference server http://build.opensuse.org is available for all open
source developers to build packages for the most popular distributions
including openSUSE, Debian, Fedora, Ubuntu, Arch, Red Hat Enterprise
Linux and SUSE Linux Enterprise. It is also used to build, release and
maintain the openSUSE distribution.
Install 2.7
-----------
Please read our setup instructions or better yet, use our appliance
http://openbuildservice.org/download/
WARNING: OBS 2.7 will be the last release supporting SUSE Linux
Enterprise Server 11 as base operating system.
Update to 2.7
-------------
If you already have a running OBS installation and want to update it,
please read also the README.UPDATERS file about the necessary steps.
https://github.com/openSUSE/open-build-service/blob/2.7/dist/README.UPDATERS
OBS Appliance users who have setup their LVM according to our
documentation can just replace their appliance image without data loss.
The migration will happen automatically.
About the Open Build Service
----------------------------
The Open Build Service (OBS) is a generic system to build and distribute
binary packages from sources in an automatic, consistent and
reproducible way. You can release packages as well as updates, add-ons,
appliances and entire distributions for a wide range of operating
systems and hardware architectures.
It is developed by a talented team of developers as Free Software and is
used by many Free and Open Source software projects, companies and
researchers. Including but not limited to SUSE the original provider of
the enterprise Linux distribution, the Tizen standards-based software
platform supported by leading mobile operators and ownCloud your secure
enterprise file sync and share.
We hope you enjoy this release and look forward to your feedback!
💚 Your Open Build Service Team
--
To unsubscribe, e-mail: opensuse-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-announce+help@opensuse.org
[USN-2992-1] Oxide vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJXVZeiAAoJEGEfvezVlG4PJsEIAKCs/O7xFJAWo9b/9hWjULgs
Hp1JYfvDgR9eknqzaWAAXfGT1EMyEqdwgUsgZmBS9wPdPmKqXcONVLNnD9L9cP9P
mUvBfNX5O+Tw8z7fcIS0RKHsi9Fs01gZVkqoOjF4T5AV0tvz674HELhTpkE1zuni
u78VCmm/1bzWHReWSGmm3X/7SIyzMAL8T05y3f45BhSeOCZJJQOUxdv6eRnZvfSq
3hzIgxa0ubvhKex0MgS6t+YtOiYD8HdVw4MACAyB2ZxYlK16KSjyah9VhAONAHFI
/HbA0jahRIjapq/wA206Ypgnf0/kTybFss83x0vaycZBWivVCSPN8SUryTWxA40=
=Kdjo
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2992-1
June 06, 2016
oxide-qt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 15.10
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine for Qt (QML plugin)
Details:
An unspecified security issue was discovered in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1673)
An issue was discovered with Document reattachment in Blink in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1675)
A type confusion bug was discovered in V8. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to obtain sensitive information. (CVE-2016-1677)
A heap overflow was discovered in V8. If a user were tricked in to opening
a specially crafted website, an attacker could potentially exploit this to
cause a denial of service (application crash) or execute arbitrary code.
(CVE-2016-1678)
A use-after-free was discovered in the V8ValueConverter implementation in
Chromium in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service (application crash) or execute arbitrary code.
(CVE-2016-1679)
A use-after-free was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1680)
A security issue was discovered in ServiceWorker registration in Blink in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to bypass
Content Security Policy (CSP) protections. (CVE-2016-1682)
An out-of-bounds memory access was discovered in libxslt. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service (application crash)
or execute arbitrary code. (CVE-2016-1683)
An integer overflow was discovered in libxslt. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service (application crash or resource
consumption). (CVE-2016-1684)
An out-of-bounds read was discovered in the regular expression
implementation in V8. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service (application crash). (CVE-2016-1688)
A heap overflow was discovered in Chromium. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1689)
A heap overflow was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1691)
It was discovered that Blink permits cross-origin loading of stylesheets
by a service worker even when the stylesheet download has an incorrect
MIME type. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1692)
Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service (application crash) or execute arbitrary code. (CVE-2016-1695,
CVE-2016-1703)
It was discovered that Blink does not prevent frame navigation during
DocumentLoader detach operations. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass same-origin restrictions. (CVE-2016-1697)
A parameter sanitization bug was discovered in the devtools subsystem in
Blink. An attacker could potentially exploit this to bypass intended
access restrictions. (CVE-2016-1699)
An out-of-bounds read was discovered in Skia. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service (application crash).
(CVE-2016-1702)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
liboxideqtcore0 1.15.7-0ubuntu0.16.04.1
Ubuntu 15.10:
liboxideqtcore0 1.15.7-0ubuntu0.15.10.1
Ubuntu 14.04 LTS:
liboxideqtcore0 1.15.7-0ubuntu0.14.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2992-1
CVE-2016-1673, CVE-2016-1675, CVE-2016-1677, CVE-2016-1678,
CVE-2016-1679, CVE-2016-1680, CVE-2016-1682, CVE-2016-1683,
CVE-2016-1684, CVE-2016-1688, CVE-2016-1689, CVE-2016-1691,
CVE-2016-1692, CVE-2016-1695, CVE-2016-1697, CVE-2016-1699,
CVE-2016-1702, CVE-2016-1703
Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.14.04.1
Version: GnuPG v2
iQEcBAEBCAAGBQJXVZeiAAoJEGEfvezVlG4PJsEIAKCs/O7xFJAWo9b/9hWjULgs
Hp1JYfvDgR9eknqzaWAAXfGT1EMyEqdwgUsgZmBS9wPdPmKqXcONVLNnD9L9cP9P
mUvBfNX5O+Tw8z7fcIS0RKHsi9Fs01gZVkqoOjF4T5AV0tvz674HELhTpkE1zuni
u78VCmm/1bzWHReWSGmm3X/7SIyzMAL8T05y3f45BhSeOCZJJQOUxdv6eRnZvfSq
3hzIgxa0ubvhKex0MgS6t+YtOiYD8HdVw4MACAyB2ZxYlK16KSjyah9VhAONAHFI
/HbA0jahRIjapq/wA206Ypgnf0/kTybFss83x0vaycZBWivVCSPN8SUryTWxA40=
=Kdjo
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2992-1
June 06, 2016
oxide-qt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 15.10
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine for Qt (QML plugin)
Details:
An unspecified security issue was discovered in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1673)
An issue was discovered with Document reattachment in Blink in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1675)
A type confusion bug was discovered in V8. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to obtain sensitive information. (CVE-2016-1677)
A heap overflow was discovered in V8. If a user were tricked in to opening
a specially crafted website, an attacker could potentially exploit this to
cause a denial of service (application crash) or execute arbitrary code.
(CVE-2016-1678)
A use-after-free was discovered in the V8ValueConverter implementation in
Chromium in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service (application crash) or execute arbitrary code.
(CVE-2016-1679)
A use-after-free was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1680)
A security issue was discovered in ServiceWorker registration in Blink in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to bypass
Content Security Policy (CSP) protections. (CVE-2016-1682)
An out-of-bounds memory access was discovered in libxslt. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service (application crash)
or execute arbitrary code. (CVE-2016-1683)
An integer overflow was discovered in libxslt. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service (application crash or resource
consumption). (CVE-2016-1684)
An out-of-bounds read was discovered in the regular expression
implementation in V8. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service (application crash). (CVE-2016-1688)
A heap overflow was discovered in Chromium. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1689)
A heap overflow was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service (application crash) or execute arbitrary
code. (CVE-2016-1691)
It was discovered that Blink permits cross-origin loading of stylesheets
by a service worker even when the stylesheet download has an incorrect
MIME type. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1692)
Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service (application crash) or execute arbitrary code. (CVE-2016-1695,
CVE-2016-1703)
It was discovered that Blink does not prevent frame navigation during
DocumentLoader detach operations. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass same-origin restrictions. (CVE-2016-1697)
A parameter sanitization bug was discovered in the devtools subsystem in
Blink. An attacker could potentially exploit this to bypass intended
access restrictions. (CVE-2016-1699)
An out-of-bounds read was discovered in Skia. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service (application crash).
(CVE-2016-1702)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
liboxideqtcore0 1.15.7-0ubuntu0.16.04.1
Ubuntu 15.10:
liboxideqtcore0 1.15.7-0ubuntu0.15.10.1
Ubuntu 14.04 LTS:
liboxideqtcore0 1.15.7-0ubuntu0.14.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2992-1
CVE-2016-1673, CVE-2016-1675, CVE-2016-1677, CVE-2016-1678,
CVE-2016-1679, CVE-2016-1680, CVE-2016-1682, CVE-2016-1683,
CVE-2016-1684, CVE-2016-1688, CVE-2016-1689, CVE-2016-1691,
CVE-2016-1692, CVE-2016-1695, CVE-2016-1697, CVE-2016-1699,
CVE-2016-1702, CVE-2016-1703
Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.14.04.1
libcrypto patch available for DSA security issue
Fixes are available to correct a problem that prevents the DSA signing
algorithm from running in constant time even if the flag
BN_FLG_CONSTTIME is set.
This issue was reported by Cesar Pereida (Aalto University), Billy
Brumley (Tampere University of Technology), and Yuval Yarom (The
University of Adelaide and NICTA). The fix was developed by Cesar
Pereida.
Patches are available for 5.8 and 5.9 at:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/017_crypto.patch.sig
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/011_crypto.patch.sig
and have been commmitted to -current.
Portably LibreSSL releases will appear shortly.
algorithm from running in constant time even if the flag
BN_FLG_CONSTTIME is set.
This issue was reported by Cesar Pereida (Aalto University), Billy
Brumley (Tampere University of Technology), and Yuval Yarom (The
University of Adelaide and NICTA). The fix was developed by Cesar
Pereida.
Patches are available for 5.8 and 5.9 at:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/017_crypto.patch.sig
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/011_crypto.patch.sig
and have been commmitted to -current.
Portably LibreSSL releases will appear shortly.
Fedora 24 Final Go/No-Go Meeting on Thursday, June 9th @ 17:00 UTC
Join us on irc.freenode.net in #fedora-meeting-1 for this important
meeting, wherein we shall determine the readiness of the Fedora 24.
meeting, wherein we shall determine the readiness of the Fedora 24.
The meeting is scheduled at 17:00 UTC. Please follow the [FedoCal]
link to find the time of the meeting in your time-zone.
[FedoCal] https://apps.fedoraproject.org/calendar/meeting/4107/
"Before each public release Development, QA and Release Engineering
meet to determine if the release criteria are met for a particular
release. This meeting is called the Go/No-Go Meeting."
"Verifying that the Release criteria are met is the responsibility of
the QA Team."
For more details about this meeting see:
https://fedoraproject.org/wiki/Go_No_Go_Meeting
In the meantime, keep an eye on the Fedora 24 Final Blocker list:
https://qa.fedoraproject.org/blockerbugs/milestone/24/final/buglist
Thanks for attending,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list
devel-announce@lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/devel-announce@lists.fedoraproject.org
Fedora 24 Final Release Readiness Meeting on Thursday, June 9th @ 19:00 UTC
This Thursday, we will meet on irc.freenode.net in #fedora-meeting-1
to make sure we are coordinated and ready for the release of Fedora 24
on Tuesday, June 14th, 2016.
to make sure we are coordinated and ready for the release of Fedora 24
on Tuesday, June 14th, 2016.
Please note that this meeting will occur even if the release is
delayed at the Go/No-Go meeting on the same day two hours earlier.
The meeting is scheduled at 19:00 UTC. Please follow the [FedoCal]
link to find the time of the meeting in your time-zone.
[FedoCal] https://apps.fedoraproject.org/calendar/meeting/4105/
You may received this message several times as this meeting is opened
to all teams. I also hope this will raise awareness and more team
representatives will come to this meeting. This meeting works best
when we have representatives from all of the teams.
Thanks for attending,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list
devel-announce@lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/devel-announce@lists.fedoraproject.org
Subscribe to:
Posts (Atom)