Linux Weekly News
LWN.net is a comprehensive source of news and opinions from
and about the Linux community. This is the main LWN.net feed,
listing all articles which are posted to the site front page.
URL: https://lwn.net
Updated: 4 hours 2 min ago
Security updates for Friday
Security updates have been issued by Debian (cups, imagemagick, libcpanel-json-xs-perl, and libjson-xs-perl), Fedora (checkpointctl, chromium, civetweb, glycin, kernel, libssh, ruff, rust-secret-service, snapshot, and uv), Mageia (curl), Red Hat (kernel), SUSE (cups, curl, perl-Cpanel-JSON-XS, regionServiceClientConfigAzure, regionServiceClientConfigEC2, regionServiceClientConfigGCE, trivy, and xen), and Ubuntu (cups, node-cipher-base, and qemu).
Six stable kernels patching the VMScape Spectre variant
The VMScape
vulnerability is a Spectre variant that "allows a malicious KVM guest to
leak sensitive information such as encryption/decryption keys from a
userspace hypervisor such as QEMU". Greg Kroah-Hartman has announced
the 6.16.7, 6.12.47, 6.6.106, 6.1.152, 5.15.193, and 5.10.244 stable kernels, which add a
mitigation for the hardware bug.
[$] A policy for Link tags
The Git source-code management system stores a lot of information about
changes to code — but it does not hold everything that might be of interest
to a developer who needs to investigate a specific change in the future.
Commits in a repository are the end result of a (sometimes extended)
discussion; often, that discussion will result in changes to the code that
are not explained in the changelog. For some years now, many maintainers
have followed the convention of applying a Link tag to commits that points
back to the mailing-list posting of the change. Linus Torvalds has been
expressing his dislike for this convention for a while, though, and its
time appears to be coming to an end.
Security updates for Thursday
Security updates have been issued by AlmaLinux (python3.12-cryptography), Debian (chromium, hsqldb1.8.0, and imagemagick), Fedora (bustle, cef, maturin, rust-busd, rust-crypto-auditing-agent, rust-crypto-auditing-client, rust-crypto-auditing-event-broker, rust-monitord, rust-monitord-exporter, rustup, tuigreet, and wireshark), Oracle (kernel, microcode_ctl, and python3.12-cryptography), Red Hat (httpd:2.4 and multiple packages), SUSE (coreutils, curl, dpkg, ffmpeg-4, glib2, gnutls, go1.23-openssl, go1.24-openssl, go1.25-openssl, grub2, ImageMagick, jbigkit, kernel, libxslt, Mesa, opensc, opera, perl-JSON-XS, polkit, postgresql16, protobuf, python311, python311-deepdiff, sqlite3, ucode-intel, and warewulf4), and Ubuntu (bind9 and libxml2).
