Date: Thu, 18 Oct 2012 14:19:06 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2012-2248: isc-dhcp, Debian-specific: build path included in PATH -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/18/2012 01:35 PM, Michael Gilbert wrote: > On Wed, Oct 17, 2012 at 8:41 PM, Kurt Seifried wrote: >>> It was uploaded to and affected Debian testing and unstable. >>> Testing has not yet been officially "released", but some people >>> use testing as if it were an official release. Unstable never >>> gets released. >> >> When I say released I meant in the sense of made available for >> download, not in the sense of software engineering and doing a >> proper "release". > > So, at the risk of sounding nitpicky, the Debian testing + > unstable archives are pretty much equivalent to Fedora rawhide. > Even though Redhat's position is that issues affecting only rawhide > should not get CVE identifiers, in Debian I think we should try to > be more honest, so we'll assign identifiers to all "uploaded" > versions (in Debian, we use the term upload to mean that a package > is available in an archive vice the term release). Part of it also depends on usage. Google labels everything as a Beta, sometimes for years and with millions of users. My experience is a lot of people use Debian unstable (when I used Debian I did, otherwise everything was to boring =). What would be interesting is if you could provide download statistics from the main site. I know for a fact CVE's have been assigned for publicly released applications that are probably in use by less than 100 or in extreme cases possibly less than 10 people globally. > Best wishes, Mike - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQgGQ6AAoJEBYNRVNeJnmTKXQP/joBpBQnvha7YENjPIoDdNl4 VFaleMmBXx2ozTRsxj9mJ24yqHUSTmvzj5pAbnmg9zBzVJay2FiY0/c5kRTL9plU 2CloMtQ3jmPbPONVZo8op8YT5j1h4OB3SUAYh5Ac4Z9HZ2xOWmi9cTA2pO0jxnq3 HiL+dyaqgxnLF8DUEYVYSP9q9qklLnm1lT1VU+ZrjXMvTYn40HwPHFF70pa42pkl s/LQG9GsKg94iLZJvA8Q/7cZ65NyfKBsXnU6z0+Qfb7Siod2HGfm6DR1MgTc3x/h 2EJdHFgpUtEIddI4zmdjFQw9yTk77sXfEq8qK+CuLGI35VEVOoiN2+GlL0AqOzeY Jz/fCxav5XjV4HP3eyN4SW1WCtXi62WoMPWn58dRyZDEy9Yr20qNL7u4BrG8jrVA RmASwWPmsDggQpWWmb5GYKVGTcHxjrjr+1hNuH6cQRPvA3SIT4iGb8A9r7KEaws2 UeQjP0pkdI3MjFjmGOTNDeK50cRScqH2dyNn+NPQJJxP698TtRVFaSWaWH8aWgs1 ZeqFbkICf6JOQo5uCnZuG23wz0C2mOBLWSEfZgSi8iNSnhnUKRuBu/36BJEbbRz8 8idGPrgf+6Bl38mOxdYTrds/ftr0ocnm5hQcP22Hyoy/eYBeKg14jbIdPhaJ69ub yAjuinXcXh2xZT9+7OyM =dSbi -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.