The Lubuntu Team announces that as a non-LTS release, 17.04 has a 9-month support cycle and, as such, reached end of life on Saturday, January 13, 2018. Lubuntu will no longer provide bug fixes or security updates for 17.04, and we strongly recommend that you update to 17.10, which continues to be actively supported with security updates and select high-impact bug fixes.
Lubuntu 17.04 Reaches End of Life on Saturday, January 13, 2018
Following the End of Life notice for Ubuntu, the Lubuntu Team would like to announce that as a non-LTS release, 17.04 has a 9-month support cycle and, as such, will reach end of life on Saturday, January 13, 2018. Lubuntu will no longer provide bug fixes or security updates for 17.04, and we highly recommend that you update to 17.10, which continues to be actively supported with security updates and select high-impact bug fixes.
If you have been wondering about the Spectre and Meltdown vulnerabilities and how that affects Lubuntu, here is a snippet from the Ubuntu 17.04 EOL notice published above:
Development of a complete response to the highly-publicized Meltdown and Spectre vulnerabilities is ongoing, and due to the timing with respect to this End of Life, we will not be providing updated Linux kernel packages for Ubuntu 17.04. We advise users to upgrade to Ubuntu 17.10 and install the updated kernel packages for that release when they become available.
For more information about Canonical’s response to the Meltdown and Spectre vulnerabilities, see the updates notes.
For more information on the timeline of the Spectre and Meltdown vulnerabilities, see the Ubuntu Security Team’s Knowledge Base article on the topic.
Lubuntu 17.10 Respins Incoming
For those who were not aware or who do not follow us on Twitter or Mastodon, the Lubuntu Team was made aware of a mainline kernel issue related to the Intel SPI drivers in the Linux kernel which caused a considerable amount of laptops to have varying BIOS issues (the most common of which is that the user can no longer save settings). While a full list is not known, we highly suggest you check the list of known affected systems on the bug report if you have a Lenovo laptop.
Immediately after this was widely discovered, Lubuntu put a notice on our downloads page, and so did many other flavors (alongside Canonical on Ubuntu.com). The official Lubuntu Twitter account tweeted something as well:
We’re aware of issues at the moment that installing Ubuntu (and Lubuntu) 17.10 on some Lenovo laptops can corrupt the BIOS. We are exploring respinning the 17.10 ISOs and will keep you updated, but for the time being, install 16.04 instead.
We apologize for the inconvenience.
— Lubuntu Official (@LubuntuOfficial) December 20, 2017
(Unfortunately, the unofficial Lubuntu website at Lubuntu.net has yet to make a notice about this, so we deeply apologize if you have been unaware and affected due to that.)
We are pleased to announce that images with the affected driver disabled are being created at the time of writing, and should be ready for testing in the next day or so, which could be released next Thursday (01/11). Once images are ready for testing, we will announce a call for testing on the Lubuntu-devel mailing list, so please subscribe to that if you are interested. As always, we will announce something on our official blog at Lubuntu.me once we are ready to release these images.
FAQ about the 17.10 images
Q: If I update from 16.04 to 17.10 on an affected system, will the bug still exist?
A: No, an update was released on December 18, 2017 disabling this kernel flag, and this will be pulled in if you upgrade.
Q: My laptop was unfortunately affected by this. Is there any hope for it?
A: Yes, there is. If you can still boot into Ubuntu 17.10 or a flavor like Lubuntu, you can follow the instructions in the bug report description that has been verified by the fine folks in the Canonical Hardware Enablement Team and others to recover your BIOS. If you are unable to boot into Ubuntu or a flavor, you will likely need to replace the BIOS chip on your motherboard (which could cause replacing the motherboard entirely). Lubuntu and/or Canonical is not liable for any damage caused while replacing hardware in affected systems.
Q: Why did it take so long to get new images and blog about this?
A: The people working on this wanted to test proposed fixes and learn more about what exactly was causing this issue before releasing new images.
Q: Is Canonical or Lubuntu liable for any damage caused by this?
A: No, because the Linux kernel, which Ubuntu and flavors use, is licensed under the GNU General Public License Version 2, which states that we are not liable. You can read a full copy here. We are also not lawyers and this is not legal advice. We deeply apologize for the inconvenience and any cost that may have occurred.
Q: I still have questions! Where is the best place to ask them?
A: Try asking in the support channels linked in the Links page of Lubuntu.me.
To end this blog post on a positive note, since Alpha 1 is unlikely to be happening at this point due to Launchpad builders being in maintenance mode for Spectre and Meltdown, here’s the Lenny Beaver that we were going to put in the Alpha 1 announcement:
You can find PNG and SVG versions of Lenny Bionic Beaver and more on the Ubuntu Wiki.
A belated Happy Holidays from the Lubuntu Team!
Lubuntu’s Development Team has decided to convert Lubuntu’s seeds to Git from Bazaar. So where you would see independent branches like this:
You will now see different Git branches in one central Git repository:
If you prefer viewing things in Phabricator, we have mirrored it there too:
This change has been made on the metapackage side in 0.87 and on, and any future lubuntu-meta SRUs should probably consider doing this conversion as well.
We’re the first flavor to do this, so hiccups shouldn’t be out of the question, but overall this should be a fairly low-impact change.
This is an security and bugfix update. However, there is also minor feature added to enhance usability. It will be integrated into Lubuntu very soon.
Changes since previous release 0.3.0 (see git log for details):
- Fix CVE-2016-10369, a Denial-of-Service vulnerability.
- Fix bug that prevents changing tab name, which is introduced since 0.3.0.
- The keyboard shortcut can be changed by pressing key combinations.
Source: LXDE blog.
Thanks to all the hard work from our contributors, Lubuntu 17.10 has been released! With the codename Artful Aardvark, Lubuntu 17.10 is the 13th release of Lubuntu, with support until July of 2018.
Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly handled WPA2. A remote attacker could use this issue with key reinstallation attacks to obtain sensitive information. (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
Lubuntu Artful Aardvark Final Beta (soon to be 17.10) has been released! Also in this release (in addition to the usual LXDE ISO) is an experimental image with LXQt instead of LXDE.
Lubuntu Artful Aardvark Beta 1 (soon to be 17.10) has been released! Also in this release (in addition to the usual LXDE ISO) is an experimental image with LXQt instead of LXDE.