Date: Sun, 16 Jun 2019 12:08:20 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz On Sun, 16 Jun 2019, Solar Designer wrote: > > Some people have interpreted this as implying there are ">100 security > bugs OSS-Fuzz found and publicly disclosed [...], and which still have > not been fixed" specifically in ImageMagick. However, at the link you > referenced there are currently "only" 38 bugs specifically in > ImageMagick, with the rest of the >100 being in other projects: Using the ordinary public access I have, I see that ImageMagick has 129 open issues, and 1479 issues in total. There are surely issues that I can not see yet since they are hidden for up to 90 days. Taking the number 129, that would mean that there is a huge number of issues already fixed (1350) which are gradually making it out to users. This is too many fixes to deal with via distribution-specific patches. Using my privileged access for GraphicsMagick, I currently see 343 issues in total, with 12 issues remaining to fix. Some of those 12 issues are open to the public for some time now. :-( Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/ Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.