All posts by jzb

Security updates for Tuesday

Post Syndicated from jzb original https://lwn.net/Articles/1048973/

Security updates have been issued by Fedora (gnutls, libpng, mingw-python3, python-spotipy, source-to-image, unbound, and webkitgtk), Mageia (libpng), SUSE (bash-git-prompt, gitea-tea, java-17-openjdk, java-21-openjdk, kernel, openssh, python, and shadowsocks-v2ray-plugin, v2ray-core), and Ubuntu (binutils, openjdk-17-crac, openjdk-21-crac, and openjdk-25-crac).

Security updates for Monday

Post Syndicated from jzb original https://lwn.net/Articles/1048817/

Security updates have been issued by AlmaLinux (bind9.18, cups, gimp, ipa, kernel, libssh, mingw-expat, openssl, pcs, sssd, tigervnc, and valkey), Debian (gnome-shell-extension-gsconnect, mistral-dashboard, pagure, python-mistralclient, pytorch, qtbase-opensource-src, sogo, tryton-server, and unbound), Fedora (cef, drupal7, glib2, linux-firmware, migrate, pack, pgadmin4, rnp, and unbound), Slackware (libxslt), SUSE (cpp-httplib, curl, glib2, grub2, kernel, libcoap-devel, libcryptopp, libwireshark19, postgresql15, and postgresql17), and Ubuntu (edk2).

KDE Plasma 6.8 will be Wayland-only

Post Syndicated from jzb original https://lwn.net/Articles/1048208/

KDE’s Plasma team has announced
that KDE Plasma will drop X11 session support with Plasma 6.8:

The Plasma X11 session will be supported by KDE into early
2027.

We cannot provide a specific date, as we’re exploring the
possibility of shipping some extra bug-fix releases for Plasma
6.7. The exact timing of the last one will only be known when we get
closer to its actual release, which we expect will be sometime in
early 2027.

What if I still really need X11?

This is a perfect use case for long term support (LTS)
distributions shipping older versions of Plasma. For example,
AlmaLinux 9 includes the Plasma X11 session and will be supported
until sometime in 2032.

See the blog post for information on running X11 applications
(still supported), accessibility, gaming, and more.

AlmaLinux 10.1 released

Post Syndicated from jzb original https://lwn.net/Articles/1047763/

AlmaLinux 10.1 has been released. In
addition to providing binary compatibility with Red Hat Enterprise
Linux (RHEL) 10.1, the most notable feature in AlmaLinux 10.1 is
the addition of support
for Btrfs, which is not available in RHEL:

Btrfs support encompasses both kernel and userspace enablement, and it
is now possible to install AlmaLinux OS on a Btrfs filesystem from the
very beginning. Initial enablement was scoped to the installer and
storage management stack, and broader support within the AlmaLinux
software collection for Btrfs features is forthcoming.

In addition to Btrfs support, AlmaLinux OS 10.1 includes numerous
other improvements to serve our community. We have continued to extend
hardware support both by adding
drivers and by adding a secondary version of AlmaLinux OS and EPEL
to extend support of x86_64_v2 processors.

See the release
notes for a full list of changes.

[$] APT Rust requirement raises questions

Post Syndicated from jzb original https://lwn.net/Articles/1046841/

It is rarely newsworthy when a project or package picks up a new
dependency. However, changes in a core tool like Debian’s Advanced Package
Tool (APT) can have far-reaching effects. For example, Julian
Andres Klode’s declaration
that APT would require Rust in May 2026 means that a few of Debian’s
unofficial ports must either acquire a working Rust toolchain or
depend on an old version of APT. This has raised several questions
within the project, particularly about the ability of a single
maintainer to make changes that have widespread impact.

Racing karts on a Rust GPU kernel driver (Collabora blog)

Post Syndicated from jzb original https://lwn.net/Articles/1047291/

In July, Collabora announced
the Rust-based Tyr
GPU driver for Arm Mali
GPUs. Daniel Almeida has posted an update
on progress with a prototype of the driver running on a Rock 5B board
with the Rockchip RK3588 system-on-chip:

The Tyr prototype has progressed from basic GPU job execution to
running GNOME, Weston, and full-screen 3D games like SuperTuxKart,
demonstrating a functional, high-performance Rust driver that matches
C-driver performance and paves the way for eventual upstream
integration! […]

Tyr is not ready to be used as a daily-driver, and it will still
take time to replicate this upstream, although it is now clear that we
will surely get there. And as a mere prototype, it has a lot of
shortcuts that we would not have in an upstream version, even though
it can run on top of an unmodified (i.e., upstream) version of
Mesa.

That said, this prototype can serve as an experimental driver and
as a testbed for all the Rust abstraction work taking place
upstream. It will let us experiment with different design decisions
and gather data on what truly contributes to the project’s
objective.

There is also a video on
YouTube of the prototype in action.

Security updates for Thursday

Post Syndicated from jzb original https://lwn.net/Articles/1047220/

Security updates have been issued by AlmaLinux (bind, bind9.18, container-tools:rhel8, expat, grub2, haproxy, idm:DL1, kernel, kernel-rt, lasso, libsoup, libssh, libtiff, pcs, podman, python-kdcproxy, qt5-qt3d, redis, redis:7, runc, shadow-utils, sqlite, squid, vim, webkit2gtk3, xorg-x11-server, xorg-x11-server-Xwayland, and zziplib), Debian (chromium), Oracle (lasso and postgresql), SUSE (erlang27, ghostscript, grub2, kernel, libIex-3_4-33, python312, and sbctl), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4,
linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4,
linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux-aws-6.8, linux-fips, linux-aws-fips, linux-gcp-fips, linux-oracle, and mysql-8.0, mysql-8.4).

Postmortem of the Xubuntu.org download site compromise

Post Syndicated from jzb original https://lwn.net/Articles/1047056/

In mid-October, the Xubuntu
download site was compromised and had directed users to a malicious
zip file instead of the Torrent file that users expected. Elizabeth
K. Joseph has published
a postmortem of the incident, along with plans to avoid such a breach
in the future:

To be perfectly clear: this only impacted our website, and the torrent
links provided there.

If you downloaded or opened a file named “Xubuntu-Safe-Download.zip”
from the Xubuntu downloads page during this period, you should assume
it was malicious. We strongly recommend scanning your computer with a
trusted antivirus or anti-malware solution and deleting the file
immediately.

Nothing on cdimages.ubuntu.com or any of the other official Ubuntu
repositories was impacted, and our mirrors remained safe as long as
they were also mirroring from official resources.

None of the build systems, packages, or other components of Xubuntu
itself were impacted.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1047021/

Security updates have been issued by Debian (pdfminer), Fedora (chromium and firefox), Mageia (bubblewrap, flatpak, cups-filters, and thunderbird), Oracle (container-tools:rhel8, kernel, and squid), Red Hat (kernel), Slackware (libarchive), SUSE (gimp, itextpdf, kernel, thunderbird, and unbound), and Ubuntu (lasso).

[$] Pouring packages with Homebrew

Post Syndicated from jzb original https://lwn.net/Articles/1046236/

The Homebrew project is an
open-source package-management system that comes with a repository of
useful packages for Linux and macOS. Even though Linux distributions
have their own package management and repositories, Homebrew is often
used to obtain software that is not available in a distribution’s repository
or to install more current versions of projects than are available
from long-term-support (LTS) distributions. Homebrew 5.0.0,
released on November 12, 2025, expanded Linux support to include
64-bit Arm packages in addition to x86_64, and turned on concurrent
downloads by default to speed up package downloads.

Security updates for Tuesday

Post Syndicated from jzb original https://lwn.net/Articles/1046891/

Security updates have been issued by Debian (libwebsockets), Fedora (chromium and fvwm3), Mageia (apache, firefox, and postgresql13, postgresql15), Oracle (idm:DL1), Red Hat (bind, bind9.18, firefox, and openssl), SUSE (alloy, ghostscript, and openssl-1_0_0), and Ubuntu (ffmpeg and freeglut).

Josefsson: Introducing the Debian Libre Live Images

Post Syndicated from jzb original https://lwn.net/Articles/1046757/

Debian developer Simon Josefsson has announced
the Debian
Libre Live Images project, to allow installing Debian without any
non-free software:

Since the 2022 decision on non-free firmware, the official images
for bookworm and trixie contains non-free software.

The Debian Libre Live Images project provides Live ISO images for
Intel/AMD-compatible 64-bit x86 CPUs (amd64) built without any
non-free software, suitable for running and installing Debian. The
images are similar to the Debian Live Images
distributed as Debian
live images.

He does warn that this is a first public release, so there may be
problems. See the current
list of known issues before trying the images out.

Security updates for Monday

Post Syndicated from jzb original https://lwn.net/Articles/1046756/

Security updates have been issued by Debian (gst-plugins-base1.0, lasso, and thunderbird), Fedora (bind9-next, chromium, containerd, fvwm3, luksmeta, opentofu, python-pdfminer, python-uv-build, ruff, rust-get-size-derive2, rust-get-size2, rust-regex, rust-regex-automata, rust-reqsign, rust-reqsign-aws-v4, rust-reqsign-command-execute-tokio, rust-reqsign-core, rust-reqsign-file-read-tokio, rust-reqsign-http-send-reqwest, suricata, uv, and xmedcon), Mageia (apache-commons-beanutils, apache-commons-fileupload, apache-commons-lang, botan2, python-django, spdlog, stardict, webkit2, and yelp-xsl), Slackware (xpdf), and SUSE (bind, chromedriver, firefox, kernel, libxml2, and openssh).

Security updates for Friday

Post Syndicated from jzb original https://lwn.net/Articles/1046497/

Security updates have been issued by Debian (keystone and lxd), Fedora (docker-buildkit, firefox, gh, gitleaks, lasso, runc, and seamonkey), Mageia (perl-Authen-SASL, perl-Cpanel-JSON-XS, perl-Crypt-OpenSSL-RSA, perl-JSON-XS, python-flask-cors, python-py, python-setuptools, and ruby), Oracle (java-1.8.0-openjdk), SUSE (binutils, cargo-packaging, rust-bindgen, chromium, go-sendxmpp, helm, lasso, libxml2, openssh, openssh8.4, python-Django, python-Scrapy-doc, python311-Brotli, squid, tomcat10, and weblate), and Ubuntu (linux-nvidia-6.8, linux-oracle, linux-oracle-6.8 and linux-xilinx-zynqmp).

Privilege escalation in LightDM Greeter by KDE (SUSE Security Team Blog)

Post Syndicated from jzb original https://lwn.net/Articles/1046376/

The SUSE Security Team has published an in-depth
article on its findings after reviewing a D-Bus service contained
in LightDM
Greeter by KDE (the lightdm-kde-greeter package)
for addition to openSUSE Tumbleweed. The team found a privilege
escalation from the lightdm service user to root, as
well as other attack vectors in the service:

In agreement with upstream, we assigned CVE-2025-62876 to track the
lightdm service user to root privilege escalation aspect described in
this report. The severity of the issue is low, since it only affects
defense-in-depth (if the lightdm service user were compromised) and
the problematic logic can only be reached and exploited if triggered
interactively by a privileged user.

The fixes are contained in the 6.0.4
release of the project.