Post Syndicated from jzb original https://lwn.net/Articles/1044222/

Security updates have been issued by AlmaLinux (java-21-openjdk and libtiff), Debian (pdns-recursor and xorg-server), Fedora (bind, bind-dyndb-ldap, dtk6core, dtk6gui, dtk6log, dtk6widget, fcitx5-qt, fluidsynth, gammaray, kddockwidgets, LabPlot, mingw-qt6-qt3d, mingw-qt6-qt5compat, mingw-qt6-qtactiveqt, mingw-qt6-qtbase, mingw-qt6-qtcharts, mingw-qt6-qtdeclarative, mingw-qt6-qtimageformats, mingw-qt6-qtlocation, mingw-qt6-qtmultimedia, mingw-qt6-qtpositioning, mingw-qt6-qtscxml, mingw-qt6-qtsensors, mingw-qt6-qtserialport, mingw-qt6-qtshadertools, mingw-qt6-qtsvg, mingw-qt6-qttools, mingw-qt6-qttranslations, mingw-qt6-qtwebchannel, mingw-qt6-qtwebsockets, nheko, python-pyqt6, qt-creator, qt6, qt6-qt3d, qt6-qt5compat, qt6-qtbase, qt6-qtcharts, qt6-qtcoap, qt6-qtconnectivity, qt6-qtdatavis3d, qt6-qtdeclarative, qt6-qtgrpc, qt6-qthttpserver, qt6-qtimageformats, qt6-qtlanguageserver, qt6-qtlocation, qt6-qtlottie, qt6-qtmqtt, qt6-qtmultimedia, qt6-qtnetworkauth, qt6-qtopcua, qt6-qtpositioning, qt6-qtquick3d, qt6-qtquick3dphysics, qt6-qtquicktimeline, qt6-qtremoteobjects, qt6-qtscxml, qt6-qtsensors, qt6-qtserialbus, qt6-qtserialport, qt6-qtshadertools, qt6-qtspeech, qt6-qtsvg, qt6-qttools, qt6-qttranslations, qt6-qtvirtualkeyboard, qt6-qtwayland, qt6-qtwebchannel, qt6-qtwebengine, qt6-qtwebsockets, qt6-qtwebview, unbound, xorg-x11-server-Xwayland, and zeal), Oracle (kernel and libtiff), Red Hat (redis:6), Slackware (tigervnc and xorg), SUSE (java-21-openjdk, java-25-openjdk, strongswan, and xorg-x11-server), and Ubuntu (amd64-microcode, binutils, and xorg-server, xwayland).

Post Syndicated from jzb original https://lwn.net/Articles/1042980/

Inside this week’s LWN.net Weekly Edition:

• Front: Pixnapping attack; Fil-C; Debian ftpmasters; GoFundMe complaints; Safer user-space access.
• Briefs: Man pages 6.16; Btrfs on AlmaLinux; Fedora Linux 43; ICANN report; PSF grants; Rust Coreutils 0.3.0; Tor Browser 15.0; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1044066/

Alejandro Colomar has announced the release of version 6.16 of the GNU/Linux man pages. This release includes new or rewritten man pages for fsconfig(), fsmount(), and fsopen(), as well as a number of newly documented interfaces in existing man pages. The release is also available as a PDF book.

Post Syndicated from jzb original https://lwn.net/Articles/1044064/

ICANN’s Security and
Stability Advisory Committee (SSAC) has announced
a report
on “the critical role of Free and Open Source Software (FOSS)
within the Domain Name System (DNS)“. The report is aimed at
policymakers and examines recent cybersecurity regulations in the US,
UK, and EU as they apply to FOSS in the DNS system; it includes
findings and guidelines “to strengthen the FOSS ecosystem that is
critical to the secure and stable operation of the Internet“. From
the report’s summary:

This ecosystem depends on a global network of maintainers and
contributors who are often unpaid volunteers. While many are unpaid
volunteers, the DNS space is unique in also relying on a handful of
long-lived maintenance organizations. This creates a model based on
community collaboration rather than the commercial contracts that
define a traditional software supply chain, which introduces unique
risks related to financial sustainability for the maintenance
organizations and maintainer burnout for volunteers.

These unique characteristics mean that regulatory frameworks
designed for proprietary software may not be well-suited for FOSS and
therefore could have severe unintended consequences to the stability
of critical Internet infrastructure.

Thanks to SSAC member Maarten Aertsen for the tip.

Post Syndicated from jzb original https://lwn.net/Articles/1044047/

Version 15.0
of the Tor
Browser has been released:

This is our first stable release based on Firefox ESR 140,
incorporating a year’s worth of changes that have been shipped
upstream in Firefox. As part of this process, we’ve also completed our
annual ESR transition audit, where we reviewed and addressed around
200 Bugzilla issues for changes in Firefox that may negatively affect
the privacy and security of Tor Browser users. Our final reports from
this audit are now available in the tor-browser-spec
repository on our GitLab instance.

This release inherits the vertical tabs feature, unified search
button, as well as other new features and usability improvements in
Firefox that have passed the Tor Project’s audit.

Post Syndicated from jzb original https://lwn.net/Articles/1043364/

Debian’s ftpmaster
team has been responsible for allowing new packages to enter Debian,
removing old packages, and otherwise maintaining Debian’s package
archive for more than two decades. As of October 26, the team is
no more and its duties are being split between two new teams. The Archive
Operations Team will focus on the infrastructure required to
support the Debian
archives, and the DFSG, Licensing & New
Packages Team, which is responsible for reviewing packages
entering the new
queue. In time, this move could speed up processing of new
packages, as well as making the teams more sustainable, but only after
new members are recruited and trained. For now, the same folks are
doing the work but spread across two teams.

Post Syndicated from jzb original https://lwn.net/Articles/1043992/

Greg Kroah-Hartman has announced the release of the 6.17.6, 6.12.56, 6.6.115, 6.1.158, 5.15.196, 5.10.246, and 5.4.301 stable kernels. As always, each
contains important fixes throughout the tree. Users of these kernels
are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1043983/

Security updates have been issued by Debian (gimp, python-authlib, and xorg-server), Fedora (chromium and git-lfs), Mageia (poppler and tomcat), Red Hat (kernel, kernel-rt, redis, and redis:6), SUSE (fetchmail, grafana, ImageMagick, kernel-devel, libluajit-5_1-2, proxy-helm, python-Authlib, and xen), and Ubuntu (linux-intel-iotg, linux-intel-iotg-5.15 and squid, squid3).

Post Syndicated from jzb original https://lwn.net/Articles/1043785/

The Fedora Project has announced the release of Fedora Linux 43,
with “what’s new” articles for Fedora
Workstation, Fedora
KDE Plasma Desktop, and Fedora
Atomic Desktops.

For those of you installing fresh Fedora Linux 43 Spins, you may be
greeted with the new Anaconda WebUI. This was the default installer
interface for Fedora Workstation 42, and now it’s the default
installer UI for the Spins as well.

If you are a GNOME desktop user, you’ll also notice that the GNOME
is now Wayland-only in Fedora Linux 43. GNOME upstream has deprecated
X11 support, and has disabled it as a compile time default in GNOME 49. Upstream GNOME plans to fully remove X11 support in GNOME 50.

See the release
notes for a full list of changes in Fedora 43.

Post Syndicated from jzb original https://lwn.net/Articles/1043776/

Security updates have been issued by AlmaLinux (kernel, kernel-rt, libtiff, squid:4, and thunderbird), Debian (strongswan and webkit2gtk), Fedora (pcre2, qt5-qtbase, squid, unbound, and xen), Mageia (icu and libtpms), Oracle (java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, kernel, squid:4, and thunderbird), Red Hat (libtiff, squid, squid:4, and webkit2gtk3), SUSE (cmake, dracut-saltboot, erlang, exim, expat, ffmpeg-4, firefox, golang-github-prometheus-alertmanager, haproxy, java-11-openjdk, kernel, libxslt, multi-linux-manager, openssl-3, podman, rabbitmq-server, spacewalk-web, strongswan, and wireshark), and Ubuntu (gst-plugins-good1.0, linux-aws-5.15, radare2, ruby2.3, ruby2.5, ruby2.7, and strongswan).

Post Syndicated from jzb original https://lwn.net/Articles/1043390/

Version
0.3.0 of Rust Coreutils, part of the uutils project, has been
released. This release adds safe directory traversal for several
utilities, better error handling, and performance
improvements. The project has upgraded its test suite reference from
GNU coreutils 9.7 to 9.8, and added 16 new tests. It includes a fix
for the date bug
that affected automatic updates in Ubuntu 25.10.

Post Syndicated from jzb original https://lwn.net/Articles/1043499/

Security updates have been issued by Debian (intel-microcode, openjdk-11, openjdk-17, openjdk-21, python-pip, request-tracker4, thunderbird, and tika), Fedora (cef, chromium, complyctl, cri-o1.31, cri-o1.32, cri-o1.33, cri-o1.34, docker-buildkit, docker-buildx, dovecot, fetchmail, gi-docgen, golang-github-facebook-time, insight, mbedtls, mingw-binutils, mingw-python3, mingw-qt5-qtsvg, mingw-qt6-qtsvg, moodle, openssl, perl-YAML-Syck, podman-tui, python-socketio, python-sqlparse, python3.10, python3.11, python3.12, python3.9, qt5-qtsvg, runc, samba, squid, sssd, suricata, valkey, wireshark, wordpress, and yarnpkg), Red Hat (libssh), SUSE (aaa_base, afterburn, bind, chromedriver, chrony, firefox, git, govulncheck-vulndb, grub2, ImageMagick, java-11-openjdk, java-17-openjdk, kernel, libssh, libunbound8, libxslt, micropython, mozilla-nss, netty, open-vm-tools, openbao, p7zip, podman, poppler, python-python-socketio, python-urllib3, ruby2.5, rust-keylime, vim, wireshark, and xen), and Ubuntu (linux-aws-6.14).

Post Syndicated from jzb original https://lwn.net/Articles/1043391/

Version 3.26.0 of the Valgrind
memory-profiling and debugging framework has been released. Notable
changes include updated support for the Linux Test
Project (LTP) to version v20250930, many new Linux syscall
wrappers, and the license for Valgrind has been changed from GPLv2 to
GPLv3.

Post Syndicated from jzb original https://lwn.net/Articles/1043075/

Open-source foundations and projects that have charity status in
the US may want to see if GoFundMe has created a profile
for them without permission. The company has operated since 2010 as a
self-service fundraising platform; individuals or groups could create
pages to raise money for all manner of causes. In June, the company announced
that it would expand its offerings to “manage all aspects of
charitable giving” for users through its platform. That seems to
include creating profiles for nonprofit organizations without their
involvement. After pushback, the company said
on October 23 that it would be removing the pages. It has not
answered more fundamental questions about how it planned to disburse
funds to nonprofits that had no awareness of the GoFundMe pages in the
first place.

Post Syndicated from jzb original https://lwn.net/Articles/1043103/

The Ubuntu Project has announced
that a bug in the Rust-based uutils version of the
date command shipped with Ubuntu 25.10 broke automatic
updates:

Some Ubuntu 25.10 systems have been unable to automatically check
for available software updates. Affected machines include cloud
deployments, container images, Ubuntu Desktop and Ubuntu Server
installs.

The announcement includes remediation instructions for those
affected by the bug. Systems with the rust-coreutils package
version 0.2.2-0ubuntu2 or earlier have the bug, it is fixed in
0.2.2-0ubuntu2.1 or later. It does not impact manual updates using the
apt command or other utilities.

Ubuntu embarked on a project to “oxidize” the distribution by
switching to uutils and sudo-rs
for the 25.10 release, and to see if the Rust-based utilities would be
suitable for the long-term-release slated for next April. LWN covered that project in
March.

Post Syndicated from jzb original https://lwn.net/Articles/1043081/

Greg Kroah-Hartman has released the 6.17.5, 6.12.55, and 6.6.114 stable kernels. As usual, each
contains important fixes throughout the tree; users are advised to
upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1043029/

The AlmaLinux project has announced
that the upcoming 10.1 release will include support for
Btrfs:

Btrfs support encompasses both kernel and userspace enablement, and
it is now possible to install AlmaLinux OS with a Btrfs filesystem
from the very beginning. Initial enablement was scoped to the
installer and storage management stack, and broader support within the
AlmaLinux software collection for Btrfs features is forthcoming.

Btrfs support in AlmaLinux OS did not happen in isolation. This was
proposed and scoped in RFC 0005, and has been built upon prior efforts
by the Fedora
Btrfs SIG in Fedora Linux and the CentOS Hyperscale SIG
in CentOS Stream.

AlmaLinux OS is designed to be binary compatible with Red Hat
Enterprise Linux (RHEL); Btrfs, however, has never been supported in
RHEL. A technology preview of Btrfs in RHEL 6 and 7 ended with the
filesystem being dropped from RHEL 8 and
onward. AlmaLinux OS 10.1 is currently
in beta.

Post Syndicated from jzb original https://lwn.net/Articles/1043027/

Security updates have been issued by AlmaLinux (ipa, kernel, and thunderbird), Debian (gdk-pixbuf, gegl, gimp, intel-microcode, raptor2, request-tracker4, and request-tracker5), Fedora (samba and wireshark), Mageia (haproxy, nginx, openssl, and python-django), Oracle (kernel and thunderbird), Red Hat (redis and redis:7), Slackware (bind), SUSE (aws-cli, local-npm-registry, python-boto3, python- botocore, python-coverage, python-flaky, python-pluggy, python-pytest, python- pytest-cov, python-pytest-html, python-pytest-metada, cargo-audit-advisory-db-20251021, fetchmail, git-bug, ImageMagick, istioctl, kernel, krb5, libsoup, libxslt, python-Authlib, and sccache), and Ubuntu (bind9, linux, linux-aws, linux-azure, linux-azure-6.8, linux-gcp, linux-gkeop,
linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8,
linux-oracle, linux-azure, linux-azure-5.15, linux-gcp-5.15, linux-gcp-6.8, linux-gke, linux-nvidia, linux-nvidia-6.8,
linux-nvidia-lowlatency, and linux-realtime, linux-realtime-6.8).

Post Syndicated from jzb original https://lwn.net/Articles/1042947/

The Fedora Council has approved
an AI-assisted
contributions policy. This follows several
weeks of discussion, some of which were covered by LWN on
October 1. The final policy contains substantial differences from
the initial
proposal, and now requires disclosure of AI tools “when the
significant part of the contribution is taken from a tool without
changes“.

Post Syndicated from jzb original https://lwn.net/Articles/1042936/

KDE Plasma
6.5 has been released. Notable new
features include automatic light-to-dark theme switching based on
time of day, support for the experimental Wayland picture-in-picture protocol,
as well as a number of usability
and accessibility
improvements. See the complete
changelog for a complete list of the new features, enhancements,
and bug fixes.