松本です。
昨日 (日本時間の本日未明)、opensuse-security、opensuse-security-announce
メーリングリスト宛に openSUSE 11.2 公式サポート終了のお知らせが流れまし
たので転送しておきます。
# 以下、参考までに抄訳を。
5月12日木曜日付けの kdelibs4 のセキュリティフィックスをもちまして、
openSUSE 11.2 向けのアップデートのリリースを終了いたしました。
これをもって SUSE による公式な openSUSE 11.2 のサポートは終了いたしました。
しかしながら、openSUSE Evergreen により 11.1 同様 openSUSE 11.2 もコミュ
ニティによるサポートを継続していこうとしています。
このプロジェクトの概要、どうすれば使えるようになるのか、その他の詳細につ
いては以下をご参照ください:
http://en.opensuse.org/openSUSE:Evergreen
Evergreen プロジェクトは openSUSE コミュニティのメンバー、Wolfgang
Rosenauer が主導しているプロジェクトです。
(...)
# このお知らせに対していくつかリプライもついていますが、それらについては
# メーリングリストのアーカイブをご参照ください。
http://lists.opensuse.org/archive/opensuse-security/2011-05/msg00007.html
-------- Original Message --------
Date: Thu, 12 May 2011 19:01:39 +0200
From: Marcus Meissner
To: opensuse-security-announce@opensuse.org
Subject: [security-announce] openSUSE 11.2 has reached end of SUSE
support - 11.2 Evergreen goes on!
Hi,
With the release of a kdelibs4 security fix on Thursday 12th of May
SUSE has released the last update for openSUSE 11.2.
openSUSE 11.2 is now officially discontinued and out of support by SUSE.
However the openSUSE Evergreen community effort is going to continue
the openSUSE 11.2 maintenance similar to 11.1.
The overview page of this project, how to activate and use it, and other
details, is on:
http://en.opensuse.org/openSUSE:Evergreen
The Evergreen project is lead by openSUSE community member Wolfgang
Rosenauer.
Here are some security statistics:
openSUSE 11.2 was released on November 12th 2009, making it 18 months
of security and bugfix support.
Some statistics on the released patches (compared to 11.1, which had 7
months more):
(As comparison would otherwise be difficult due to the different lifetimes,
I did adjust the 11.1 numbers by *18/25)
Total updates: 489 (-19)
Security: 317 (-19)
Recommended: 172 (+ 3)
Optional: 0 (- 3)
CVE Entries: 1134 (+288) (-35 unadjusted)
There is a 3% decrease in the number of security updates compared
to openSUSE 11.1. There is however a 24% increase in CVE numbers fixed.
The increase is largely due to approximately 180 webkit CVEs we solved
by two version upgrades.
Top issues (compared to 11.1 for issues down to 5), (not lifetime adjusted):
13 MozillaFirefox (-6)
11 seamonkey (+3)
10 flash-player (+1)
9 krb5 (+4)
8 MozillaThunderbird (0)
8 java-1_6_0-openjdk (-2)
8 acroread (-3)
7 opera (-2)
6 mozilla-xulrunner191
5 tomcat6
5 libopenssl-devel (-4)
5 kernel (-9)
5 java-1_6_0-sun (+2)
5 clamav (-2)
5 apache2-mod_php5 (-2)
And top issues sorted by CVE (Common Vulnerability Enumeration) count
(down to 5) (compared to 11.1 for the top, not adjusted to lifetime):
180 libwebkit (NEW)
120 seamonkey (+37)
119 MozillaFirefox (-44) (would be around 0 equalized)
113 acroread (-2)
95 MozillaThunderbird (-25)
94 java-1_6_0-sun (-20)
106 kernel (+23)
84 mozilla-xulrunner191 (-43)
83 flash-player (+1)
63 java-1_6_0-openjdk (-20)
45 php5 (+7)
27 opera (0)
26 wireshark (-7)
23 mysql (+8)
18 freetype2 (+1)
15 krb5 (+3)
19 OpenOffice_org (+12)
12 pidgin/finch (-2)
11 tomcat6 (+1)
10 clamav (0)
9 perl
9 poppler (-4)
9 postgresql (-2)
8 cups
8 python
6 sudo
6 gimp
6 glibc
6 openssl (-8)
6 libvirt
6 bind
5 viewvc
5 ghostscript (-6)
5 texlive
5 fuse
5 libtiff
5 exim
5 dovecot12
5 build
5 evince
5 python-feedparser
5 libpcsclite1
5 samba (-7)
# security updates by count
# grep -l type..secur updateinfo-*|sed -e
's/^updateinfo-//;s/-[0-9]*.xml$//;'|sort|uniq -c|sort -n +0 -r|less
# grep CVE- update* |perl -e '%cves=();while (<>) { while
(/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print
join("\n",sort keys %cve)."\n";' | wc -l
# for i in updateinfo-* ; do echo -n "$i " ; grep CVE- $i|perl -e
'%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++;
s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l ;
done |perl -e 'while (<>) { /^updateinfo-(\S*)-\d*.xml (\d*)$/;
$cnt{$1}+=$2; } ; foreach (sort { $cnt{$b} <=> $cnt{$a} } keys %cnt) {
print "$cnt{$_}\t\t$_\n";} '
--
_/_/ Satoru Matsumoto - openSUSE Member - Japan _/_/
_/_/ Marketing/Weekly News/openFATE Screening Team _/_/
_/_/ mail: helios_reds_at_gmx.net / irc: HeliosReds _/_/
_/_/ http://blog.zaq.ne.jp/opensuse/ _/_/
--
To unsubscribe, e-mail: opensuse-ja+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-ja+help@opensuse.org
Satoru Matsumoto