Date: Thu, 29 Jan 2015 21:43:46 -0500 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: Hanno Böck <hanno@...eck.de>, oss-security@...ts.openwall.com Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) On Thu 2015-01-29 19:00:35 -0500, Hanno Böck wrote: > As promised, I wrote down my lengthy thoughts in a blog post: > https://blog.hboeck.de/archives/864-What-the-GHOST-tells-us-about-free-software-vulnerability-management.html thanks for this writeup, Hanno. you wrote: >> It would be an interesting (and time consuming) project to take a >> package like PHP and check for all the security vulnerabilities whether >> they are fixed in the latest packages in Debian Squeeze/Wheezy, all Red >> Hat Enterprise versions and other long term support systems. I don't know about RHEL, but Debian's security tracker does actually try to do this, and to coordinate it with the CVEs. For example: https://security-tracker.debian.org/tracker/source-package/php5 It ain't pretty, but it's there. If you (or anyone) is interested in working on this sort of tracker, or integrating between this and other trackers, please talk to the debian security team: https://wiki.debian.org/Teams/Security Regards, --dkg Download attachment "signature.asc" of type "application/pgp-signature" (949 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.