Gentoo Weekly Newsletter 27 March 2006

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

Gentoo Weekly Newsletter 27 March 2006

Ulrich Plate
Gentoo Weekly Newsletter
This is the Gentoo Weekly Newsletter for the week of 27 March 2006.
1. Gentoo news
Security team recruiting campaign
Security has always been one of the Gentoo project's strongest aspects. To
prevent the quality of GLSAs from dropping, the security team has started
to actively look for additional help among existing and future developers.
This recruitment campaign aims to compensate for the potential problems
that can delay the fixing of security bugs, including missing or inactive
package maintainers, but also a lack of GLSA coordinators. Other areas
that need more support are the KISS project (kernel security advisory
system) and glsa-check integration into Portage. If you're able and
willing to help with any of these security-related issues, please contact
one of the following project/subproject leaders:
 * GLSA team: Sune Kloppenborg Jeppesen[1] or Stefan Cornelius[2] (who
replaces Thierry Carrez as operational co-lead)
 * Kernel team: Tim Yamin[3]
 * Audit team: Tavis Ormandy[4]
 1. [hidden email]
 2. [hidden email]
 3. [hidden email]
 4. [hidden email]

Note:  See the latest security team meeting report for more details.
Bugzilla category change for the installer project
The maintainers of[5] have removed the old "Gentoo Linux
Installer" (GLI) component inside the "Gentoo Linux" category. Instead
they have added an "Installer" component as a "Gentoo Release Media"
subcategory. All the old bugs are already reassigned, and if you would
like to file a bug regarding the installer, please use the new component!

Ruby on Rails 1.1 RC1 hits Portage
The first release candidate of Ruby on Rails[6] 1.1 is now in Portage. For
users running ~arch, it will add the new versions to their gem
installations without removing the old ones. They will be able to make use
of the new version, and can still lock their code to the old version if
they need to. The Portage versions all end in .4008, which represents
upstream's subversion repository commit number for the 1.1_RC1 release.

Users who are interested in trying out the new versions are encouraged to
do so, and file bugs to either Gentoo[7] or[8]
as appropriate. Those who want to lock their existing Rails applications
to a specific version, they can see the following URLs for information on
how to do so:

 * RC 1 announcement[9]
 * How to lock to specific Rails versions[10]

2. Heard in the community
Web forums
Timezone down under
Gentoo's timezone data was not updated in time to support the timezone
change made for the Commonwealth Games held in Australia until the end of
March. Several Australian states postponed the usual changeover to
daylight saving time until 2 April. To prevent clocks from running an hour
ahead of time for a whole week, check this thread:
 * Newb: How to patch for Commonwealth Games DST[11]

Suddenly the dungeon collapses
Are games in Gentoo inherently unsafe? A recently discovered vulnerability
in Nethack has sparked this lively debate. The vulnerability isn't in
Nethack though. It is caused by the way Gentoo handles games and was not a
problem for any other distro. Should we find a new way to handle the games
group? Come and join the debate!
 * Gentoo games group leads to security hole - big surprise(!)[12]

3. Gentoo in the press
ZDNet France (20 March 2006, in French)
"Renaissance"[13] is the title of an animated movie by Christian Volckman
set in the year 2054 in Paris. A young scientist is being kidnapped, and
an obscure police officer is trying to get her back. While real human
actors were involved in the making of this "animated Matrix", it was
merely to capture their movements and have those transformed into
computer-generated black-and-white images -- rendered entirely on a
cluster of 200 Gentoo Linux servers. The French ZDNet website clearly
thought this was worth an article[14], which is based on an interview with
Julien Doussot, a technical director of "Attitude Studio"[15], the
creative team behind the scenes. In cinemas in France since last week.

Newsforge (21 March 2006)
"A distro of power"[16] is what Joseph Quigley calls Gentoo Linux in his
testimonial, published last Tuesday as the latest addition to Newsforge's
"My Desktop OS" mini-series. In spite of using Gentoo on what he calls a
"low-end system," he was impressed that he "could watch a DVD and compile
KDE simultaneously with few interruptions or glitches." There are those
who'd disagree on his 1.58GHz Sempron 2300 with 512MB of RAM being on the
low end of things, but then again: "If you have a higher-end system, you
won't be disappointed either," says Quigley.

4. Gentoo developer moves
The following developers recently left the Gentoo project:
 * None this week
The following developers recently joined the Gentoo project:
 * None this week
The following developers recently changed roles within the Gentoo project:
 * Thierry Carrez (koon) - stepped down as operational security co-lead
 * Stefan Cornelius (DerCorny) - new operational security co-lead
5. Gentoo Security
PeerCast: Buffer overflow
PeerCast is vulnerable to a buffer overflow that may lead to the execution
of arbitrary code.
For more information, please see the GLSA Announcement[17]

Pngcrush: Buffer overflow
Pngcrush is vulnerable to a buffer overflow which could potentially lead
to the execution of arbitrary code.
For more information, please see the GLSA Announcement[18]

cURL/libcurl: Buffer overflow in the handling of TFTP URLs
libcurl is affected by a buffer overflow in the handling of URLs for the
TFTP protocol, which could be exploited to compromise a user's system.
For more information, please see the GLSA Announcement[19]

Macromedia Flash Player: Arbitrary code execution
Multiple vulnerabilities have been identified that allows arbitrary code
execution on a user's system via the handling of malicious SWF files.
For more information, please see the GLSA Announcement[20]

Sendmail: Race condition in the handling of asynchronous signals
Sendmail is vulnerable to a race condition which could lead to the
execution of arbitrary code with sendmail privileges.
For more information, please see the GLSA Announcement[21]

PHP: Format string and XSS vulnerabilities
Multiple vulnerabilities in PHP allow remote attackers to inject arbitrary
HTTP headers, perform cross site scripting or in some cases execute
arbitrary code.
For more information, please see the GLSA Announcement[22]

NetHack, Slash'EM, Falcon's Eye: Local privilege escalation
NetHack, Slash'EM and Falcon's Eye are vulnerable to local privilege
escalation vulnerabilities that could potentially allow the execution of
arbitrary code as other users.
For more information, please see the GLSA Announcement[23]

RealPlayer: Buffer overflow vulnerability
RealPlayer is vulnerable to a buffer overflow that could lead to remote
execution of arbitrary code.
For more information, please see the GLSA Announcement[24]

6. Bugzilla
The Gentoo community uses Bugzilla ([25]) to record and
track bugs, notifications, suggestions and other interactions with the
development team. Between 19 March 2006 and 26 March 2006, activity on the
site has resulted in:

 * 832 new bugs during this period
 * 481 bugs closed or resolved during this period
 * 27 previously closed bugs were reopened this period
Of the 9756 currently open bugs: 66 are labeled 'blocker', 150 are labeled
'critical', and 536 are labeled 'major'.
Closed bug rankings
The developers and teams who have closed the most bugs during this period
 * Gentoo Games[26], with 47 closed bugs[27]  
 * Gentoo Linux Gnome Desktop Team[28], with 21 closed bugs[29]  
 * Gentoo X-windows packagers[30], with 19 closed bugs[31]  
 * AMD64 Project[32], with 18 closed bugs[33]  
 * X11 External Driver Maintainers[34], with 14 closed bugs[35]  
 * Gentoo's Team for Core System packages[36], with 13 closed bugs[37]  
 * Gentoo KDE team[38], with 12 closed bugs[39]  
 * Gentoo Security[40], with 11 closed bugs[41]  
 26. [hidden email]
 28. [hidden email]
 30. [hidden email]
 32. [hidden email]
 34. [hidden email]
 36. [hidden email]
 38. [hidden email]
 40. [hidden email]

New bug rankings
The developers and teams who have been assigned the most new bugs during
this period are:
 * Default Assignee for New Packages[42], with 32 new bugs[43]  
 * AMD64 Project[44], with 14 new bugs[45]  
 * Gentoo's Team for Core System packages[46], with 11 new bugs[47]  
 * Gentoo Sound Team[48], with 10 new bugs[49]  
 * Default Assignee for Orphaned Packages[50], with 10 new bugs[51]  
 * Gentoo Science Related Packages[52], with 7 new bugs[53]  
 * media-video herd[54], with 7 new bugs[55]  
 * Gentoo Toolchain Maintainers[56], with 6 new bugs[57]  
 42. [hidden email]
 44. [hidden email]
 46. [hidden email]
 48. [hidden email]
 50. [hidden email]
 52. [hidden email]
 54. [hidden email]
 56. [hidden email]

7. GWN feedback
Please send us your feedback[58] and help make the GWN better.

 58. [hidden email]
8. GWN subscription information
To subscribe to the Gentoo Weekly Newsletter, send a blank email to
[hidden email].
To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to
[hidden email] from the email address you are
subscribed under.
9. Other languages
The Gentoo Weekly Newsletter is also available in the following languages:
 * Danish[59]  
 * Dutch[60]  
 * English[61]  
 * German[62]  
 * French[63]  
 * Korean[64]  
 * Japanese[65]  
 * Italian[66]  
 * Polish[67]  
 * Portuguese (Brazil)[68]  
 * Portuguese (Portugal)[69]  
 * Russian[70]  
 * Spanish[71]  
 * Turkish[72]  

Ulrich Plate <[hidden email]> - Editor
Andrew Gaffney <[hidden email]> - Author
Curtis Napier <[hidden email]> - Author
Caleb Tennis <[hidden email]> - Author
[hidden email] mailing list