Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Jul 2017 11:05:39 -0400
From: Santiago Torres <>
Subject: Re: Estimate for the total number of exploitable bugs
 in large linux distro?

On Fri, Jul 14, 2017 at 12:34:01PM +0300, Georgi Guninski wrote:
> What is an estimate for the total number of exploitable bugs in large
> linux distro?

You may want to look at[1] for the case of ArchLinux. Do consider the
caveat brought up by other people on the list: CVE numbers are not a 1:1
mapping to bugs (or even exploitable bugs). For example, there are
vendors that group all bugs discovered in a period (or with a conceputal
similarity) under one CVE number, whereas others take mutliple
variations of a bug and request an individual CVE for each. Needless to
say, some bugs never get a CVE ;).

> Also, does the total number decrease, increase or change in other way
> over time?

You could use the json api[2] on [1] to get a rolling count if you'd like
to measure this (also pasted on [3]]):

>>> import json, requests
>>> response = requests.get("")
>>> data = json.loads(response.content)
>>> len(data)



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.