Table of Contents

• Welcome
• Events
• Tips and tricks
• Focus on package(s)
• Bug fixes
• Security announcements
• About the newsletter

Welcome

The newsletter's aim is to keep you up to date with what's happened recently in the world of the Linux distribution 'Frugalware'.

In this issue:

• Frugalware 0.8 ("Kalgan") pre-release 2
• Newsletter now in French and Danish

Events

Here's a selection of events which have occurred since the previous newsletter:

• Kalgan - are we there yet?

  On 10 January 2008, vmiklos announced that Frugalware 0.8 ("Kalgan") pre-release 2 had been released. This release has some new features, also some updated packages, including XFCE 4.4.2 and OpenOffice 2.3.1.

  The purpose of Frugalware's pre-releases and release candidates is to allow anyone who's interested to test the work in progress. If you have the bandwidth and time required to help, please test these pre-releases and release candidates. The more bugs that are found during the testing phase, the better the quality of the final release.

  According to my calculations, there are only 937,363,242,343,242,522 trillion light years to go. :)

• Xorg 7.3 - available for testing

  Xorg 7.3 is now available for testing to all those who are willing and able. This release include Xorg server version 1.4 and includes some new features as well as updated drivers and bug fixes. For details of how to test this release, read vmiklos' blog entry.

Tips and tricks

• Mirrors, mirrors, speed is the key! - submitted by 'phayz'

  When downloading a package, pacman will try to retrieve the package from each of the Frugalware mirrors in turn until it succeeds or gets to the end of the mirror list.

  To have packages downloaded faster, re-sort the list of Frugalware's mirrors so that at least the three mirrors with the lowest ping response times are at the top. Now when pacman tries to download a package, it will first try the fastest mirror(s) first.

  Frugalware's mirrors are listed in either -

  /etc/pacman-g2/repos/frugalware

  for -stable, or

  /etc/pacman-g2/repos/frugalware-current

  for -current

• Installing TrueType fonts - submitted by 'bee-carl'

  If you have found some TrueType fonts on the Internet you would like being able to use in all your programs on your computer, here are the instructions -

  1. Save the font in your Home directory, e.g. /home/carl/fonts
  2. Open now a root terminal and cd /to/where/the/fonts/are/saved.
  3. After this the font is to be copied to /usr/lib/X11/fonts/TTF
  4. cp name-font.ttf /usr/lib/X11/fonts/TTF
  5. And now as root you need to run fc-cache before you will be able to use the font in any programs you have on the computer.
  6. After this you restart X, and now you can use your new TTF font in all programs.

This section relies on your contributions! If have some tips and tricks that you would like to be shown in the newsletter, please post them on the forums in the Tips and Tricks section!

VirtualBox is an x86 virtualisation product supporting Windows, Linux and Macintosh hosts and an even wider range of guest operating systems. It is developed by innotek, and is available in two editions - one being GPL-d, Open Source and the other is for only Private use and evaluation. The Open Source edition lacks some features of the other edition but most will be able to live without them. Features added recently to both editions include native support for VMware disk images and seamless windows. VirtualBox is ideal for many people but particularly those who want to use a free virtualisation product ('free' as in beer and 'free' as in freedom) with a feature set which compares with its proprietary competitors.

VirtualBox is useful in all sorts of situations, for example -

• Testing a new release of Frugalware
• Running applications under another operating system without having to reboot
• Documenting - with screenshots - the boot sequence/messages

Go ahead and try it - you just might be surprised at what comes in so small a package.

Bug fixes

A list of bugs closed since the previous newsletter is available here.

Security announcements

According to the normal support arrangements for Frugalware, when Frugalware 0.7 (Sayshell) was released, support for the previous release ended. This means that no further security or bug fixes will be released for Frugalware 0.6 (Terminus).

Here is a list of security issues which have been discovered and fixed in the 0.7 release since the previous newsletter.

• FSA346 - e2fsprogs: Some vulnerabilities have been reported in the libext2fs library of e2fsprogs, which potentially can be exploited by malicious people to compromise an application using the library. Please upgrade to e2fsprogs-1.40.2-2sayshell1.
• FSA345 - claws-mail: A security issue has been reported in Claws Mail, which can be exploited by malicious, local users to perform certain actions with escalated privileges. Please upgrade to claws-mail-3.0.1-2sayshell1.
• FSA344 - cairo: A vulnerability has been reported in Cairo, which potentially can be exploited by malicious people to compromise an application using the library. Please upgrade to cairo-1.4.10-2sayshell1.
• FSA343 - wesnoth: Some vulnerabilities have been reported in Wesnoth, which can be exploited by malicious people to cause a DoS (Denial of Service), disclose potentially sensitive information, or potentially compromise a vulnerable system. Please upgrade to wesnoth-1.2.8-1terminus1.
• FSA342 - wordpress: Some vulnerabilities and a security issue have been reported in WordPress, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to bypass certain security restrictions and to disclose sensitive or system information. Please upgrade to wordpress-2.3.2-1terminus1.
• FSA341 - drupal: A vulnerability has been reported in Drupal, which can be exploited by malicious people to conduct SQL injection attacks. Please upgrade to drupal-5.2-2sayshell2.
• FSA340 - liferea: A security issue has been reported in Liferea, which can be exploited by malicious, local users to gain escalated privileges. Please upgrade to liferea-1.2.23-2sayshell2.
• FSA339 - cacti: A vulnerability has been reported in Cacti, which potentially can be exploited by malicious people to conduct SQL injection attacks. Please upgrade to cacti-0.8.6j-3terminus1.
• FSA338 - thunderbird: Some vulnerabilities have been reported in Mozilla Thunderbird, which potentially can be exploited by malicious people to compromise a user's system. Please upgrade to thunderbird-2.0.0.9-1terminus1.
• FSA337 - wireshark: Some vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). Please upgrade to wireshark-0.99.7-1terminus1.
• FSA336 - seamonkey: Some vulnerabilities have been reported in Mozilla SeaMonkey, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks and potentially to compromise a user's system.. Please upgrade to seamonkey-1.1.7-1sayshell1.
• FSA335 - samba: Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. Please upgrade to samba-3.0.26-2sayshell2.
• FSA334 - mysql: A security issue and two vulnerabilities have been reported in MySQL, which can be exploited by malicious users to gain escalated privileges, manipulate certain data, or to cause a DoS (Denial of Service). Please upgrade to mysql-5.0.45-2sayshell2.
• FSA333 - openoffice.org: A vulnerability has been reported in OpenOffice, which can be exploited by malicious people to compromise a user's system. Please upgrade to openoffice.org-2.3.0-2sayshell1.
• FSA332 - firefox: A security issue has been reported in Mozilla Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks. Please upgrade to firefox-2.0.0.11-1sayshell1.

About the newsletter

The Frugalware newsletter is written by Russell Dickenson (AKA phayz). Credit for the Frugalware distribution goes to the development team.

The newsletter is currently translated into French and Danish. The French translation is provided by the French Frugalware community. The Danish translation is provided by the Danish Frugalware community. Thanks to all those involved in providing and hosting these translations.

If you have feedback about the Frugalware newsletter - whether good or bad - please provide it via the forums. Your feedback is valuable because we want the newsletter to meet the needs of Frugalware's users.