The Secunia security firm has found multiple vulnerabilities in the popular ffmpeg multimedia framework that is the basis for most Linux media players.
Numerous cases of heap memory corruption and null pointer dereferences can allow specially prepared media files to execute malicious code on target systems. Secunia confirmed the vulnerability in the popular ffmpeg version 0.5. The advisory also confirms that some of the security holes have been fixed in the SVN repository and the remainder should be closed immediately.
The VideoLAN Client (VLC) project has meanwhile released version 1.0.2, which fixes a number of stack overflow problems in the AVI, MP4 and ASF demuxers that also allowed specially prepared media files to execute malicious code. Affected were all VideoLAN versions back to 0.5.0, so that the update is recommended for all users. VLC also uses the ffmpeg framework, although it's not clear whether the vulnerabilities correspond to those reported by Secunia. The descriptions are nonetheless very similar.
Even QNAP, the popular maker of NAS hard disks, faces some security issues. As is reported, a secondary key is added to the hard disk encryption and stored in flash memory with insufficient obfuscation, thus enabling an attacker physical or network access to unlock and reproduce the hard disk contents. Especially precarious for a product calling itself secure storage is the presence of what by all appearances is a back door with a weakly protected and nonsensical key. QNAP was informed of the problem and promises a firmware update fix in October.
The Raspberry Pi Foundation has announced an even smaller version of the tiny computer that will fit into a DIMM slot.
A new class of problems lets a malicious app pre-configure an invisible privilege update.
New Hack language adds static typing and other conveniences.
New crypto policy system will offer easier configuration and more uniform security.
Ubuntu founder denounces insecurity in proprietary, close-source software blobs.
Vulnerability affects many Linux web servers
The Bavarian capital shuns Microsoft, Google, and other alternatives to implement an open source groupware solution.
Phone vendor partnerships bring Mark Shuttleworth's dream of Ubuntu on a phone a step closer to reality.
Donors will get to vote on new features for the free video editor.
Debian project puts init out to pasture and says no to Ubuntu's Upstart.