There's a brand new generation of technology engulfing the publishing industry, and we're launching an event designed to highlight the opportunities: TOC, the Tools of Change for Publishing Conference. TOC is happening in San Jose, California June 18-20, 2007, and we've just opened the call for participation.
If you're a publisher, editor, author, marketing or production manager, consultant, technology provider, or other interested commentator with bold ideas for the future of publishing and would like to share them with 500 other publishing innovators and decision-makers, we want to hear from you. The deadline to submit proposals to speak at TOC is January 22, 2007.
From: Will Woods
To: fedora-test-list
Date: Mon, 04 Dec 2006 16:24:17 -0500
Subject: Fedora QA Meeting - 1700 UTC Thursday, Dec. 7
It's time for another fun Fedora QA (aka Fedora Testing) meeting!
(Yes, I'm calling it "Fedora QA" now. I want it to be obvious to the
world that Fedora really does have an official QA group.)
It'll be this Thursday, Dec. 7, at 1700UTC in the usual place
The goal of the FlightGear project is to create a sophisticated flight simulator framework for use in research or academic environments, for the development and pursuit of other interesting flight simulation ideas, and as an end-user application. We are developing a sophisticated, open simulation framework that can be expanded and improved upon by anyone interested in contributing.
Security database references:
More information:
Several security related problems have been discovered in Mozilla and derived products such as Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities:
Tomas Kempinsky discovered that malformed FTP server responses could lead to denial of service.
Ulrich Kühn discovered that the correction for a cryptographic flaw in the handling of PKCS-1 certificates was incomplete, which allows the forgery of certificates.
"shutdown" discovered that modification of JavaScript objects during execution could lead to the execution of arbitrary JavaScript bytecode.
Jesse Ruderman and Martijn Wargers discovered several crashes in the layout engine, which might also allow execution of arbitrary code.
Igor Bukanov and Jesse Ruderman discovered several crashes in the JavaScript engine, which might allow execution of arbitrary code.
This update also adresses several crashes, which could be triggered by malicious websites and fixes a regression introduced in the previous Mozilla update.
For the stable distribution (sarge) these problems have been fixed in version 1.0.4-2sarge13.
For the unstable distribution (sid) these problems have been fixed in the current icedove package 1.5.0.8.
We recommend that you upgrade your mozilla-thunderbird package.
Security database references:
More information:
Several security related problems have been discovered in Mozilla and derived products such as Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities:
Tomas Kempinsky discovered that malformed FTP server responses could lead to denial of service.
Ulrich Kühn discovered that the correction for a cryptographic flaw in the handling of PKCS-1 certificates was incomplete, which allows the forgery of certificates.
"shutdown" discovered that modification of JavaScript objects during execution could lead to the execution of arbitrary JavaScript bytecode.
Jesse Ruderman and Martijn Wargers discovered several crashes in the layout engine, which might also allow execution of arbitrary code.
Igor Bukanov and Jesse Ruderman discovered several crashes in the JavaScript engine, which might allow execution of arbitrary code.
This update also adresses several crashes, which could be triggered by malicious websites and fixes a regression introduced in the previous Mozilla update.
For the stable distribution (sarge) these problems have been fixed in version 1.0.4-2sarge13.
For the unstable distribution (sid) these problems have been fixed in the current iceweasel package 2.0+dfsg-1.
We recommend that you upgrade your mozilla firefox package.
Security database references:
More information:
Several security related problems have been discovered in Mozilla and derived products. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities:
Tomas Kempinsky discovered that malformed FTP server responses could lead to denial of service.
Ulrich Kühn discovered that the correction for a cryptographic flaw in the handling of PKCS-1 certificates was incomplete, which allows the forgery of certificates.
"shutdown" discovered that modification of JavaScript objects during execution could lead to the execution of arbitrary JavaScript bytecode.
Jesse Ruderman and Martijn Wargers discovered several crashes in the layout engine, which might also allow execution of arbitrary code.
Igor Bukanov and Jesse Ruderman discovered several crashes in the JavaScript engine, which might allow execution of arbitrary code.
This update also adresses several crashes, which could be triggered by malicious websites and fixes a regression introduced in the previous Mozilla update.
For the stable distribution (sarge) these problems have been fixed in version 1.7.8-1sarge8.
We recommend that you upgrade your mozilla package.
Security database references:
More information:
Teemu Salmela discovered a vulnerability in GNU tar that could allow a malicious user to overwrite arbitrary files by inducing the victim to attempt to extract a specially crafted tar file containing a GNUTYPE_NAMES record with a symbolic link.
For the stable distribution (sarge), this problem has been fixed in version 1.14-2.3
For the unstable distribution (sid) and the forthcoming stable release (etch), this problem will be fixed in version 1.16-2.
We recommend that you upgrade your tar package.
Security database references:
More information:
Due to technical problems yesterday's proftpd update lacked a build for the amd64 architecture, which is now available. For reference please find below the original advisory text:
Several remote vulnerabilities have been discovered in the proftpd FTP daemon, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:
- CVE-2006-5815
It was discovered that a buffer overflow in the
sreplace()
function may lead to denial of service and possibly the execution of arbitrary code.- CVE-2006-6170
It was discovered that a buffer overflow in the mod_tls addon module may lead to the execution of arbitrary code.
- CVE-2006-6171
It was discovered that insufficient validation of FTP command buffer size limits may lead to denial of service. Due to unclear information this issue was already fixed in DSA-1218 as CVE-2006-5815.
For the stable distribution (sarge) these problems have been fixed in version 1.2.10-15sarge3.
For the unstable distribution (sid) these problems have been fixed in version 1.3.0-16 of the proftpd-dfsg package.
We recommend that you upgrade your proftpd package.
Security database references:
More information:
"infamous41md" discovered a heap buffer overflow vulnerability in libgsf, a GNOME library for reading and writing structured file formats, which could lead to the execution of arbitrary code.
For the stable distribution (sarge) this problem has been fixed in version 1.11.1-1sarge1
For the unstable distribution (sid) this problem has been fixed in version 1.14.2-1
We recommend that you upgrade your libgsf packages.
Security database references:
More information:
Brian May discovered that pstotext, a utility to extract plain text from Postscript and PDF files, performs insufficient quoting of file names, which allows execution of arbitrary shell commands.
For the stable distribution (sarge) this problem has been fixed in version 1.9-1sarge2. The build for the mipsel architecture is not yet available due to technical problems with the build host.
For the upcoming stable distribution (etch) this problem has been fixed in version 1.9-4.
For the unstable distribution (sid) this problem has been fixed in version 1.9-4.
We recommend that you upgrade your pstotext package.
Security database references:
More information:
Multiple vulnerabilities have been found in the GNU texinfo package, a documentation system for on-line information and printed output.
Handling of temporary files is performed in an insecure manner, allowing an attacker to overwrite any file writable by the victim.
A buffer overflow in util/texindex.c could allow an attacker to execute arbitrary code with the victim's access rights by inducing the victim to run texindex or tex2dvi on a specially crafted texinfo file.
For the stable distribution (sarge), these problems have been fixed in version 4.7-2.2sarge2. Note that binary packages for the mipsel architecture are not currently available due to technical problems with the build host. These packages will be made available as soon as possible.
For unstable (sid) and the upcoming stable release (etch), these problems have been fixed in version 4.8.dfsg.1-4.
We recommend that you upgrade your texinfo package.
Slackware has updated tar (symlink vulnerability), proftpd (several vulnerabilities), libpng (denial of service).
Debian has updated mozilla (multiple vulnerabilities), mozilla-firefox (multiple vulnerabilities), mozilla-firefox (covers MIPS architecture), links (arbitrary file access), mozilla-thunderbird (multiple vulnerabilities).
rPath has updated doxygen (libpng denial of service vulnerability).
Welcome to our issue number 69 of Fedora Weekly News.
http://fedoranews.org/wiki/Fedora_Weekly_News_Issue_69
1 Fedora Project is Hiring
2 Fedora Ambassadors Day
3 Eclipse on Linux Distributions Project
4 FUDCon Boston 2007
5 SCALE 5X Registration Opens
6 Migration to Fedora Core 6
7 Fedora Weekly Reports 2006-11-27
8 Fedora Core 5 and 6 Updates
Welcome to our issue number 69 of Fedora Weekly News.
http://fedoranews.org/wiki/Fedora_Weekly_News_Issue_69
In this issue, we have following articles:
1 Fedora Project is Hiring
2 Fedora Ambassadors Day
3 Eclipse on Linux Distributions Project
4 FUDCon Boston 2007
5 SCALE 5X Registration Opens
6 Migration to Fedora Core 6
7 Fedora Weekly Reports 2006-11-27
8 Fedora Core 5 and 6 Updates