[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Jun 2019 21:29:14 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
On Sun, Jun 16, 2019 at 12:08:20PM -0500, Bob Friesenhahn wrote:
> On Sun, 16 Jun 2019, Solar Designer wrote:
> >
> >Some people have interpreted this as implying there are ">100 security
> >bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> >not been fixed" specifically in ImageMagick. However, at the link you
> >referenced there are currently "only" 38 bugs specifically in
> >ImageMagick, with the rest of the >100 being in other projects:
>
> Using the ordinary public access I have, I see that ImageMagick has
> 129 open issues, and 1479 issues in total. There are surely issues
> that I can not see yet since they are hidden for up to 90 days.
I guess this is a distinction between all open deadline-exceeded issues
(129) and only deemed security ones out of those (38).
Removing "Type=Bug-Security status:New", but keeping
"label:Deadline-exceeded" does show 129 issues for ImageMagick.
Also removing "label:Deadline-exceeded" still results in 129, perhaps
because I'm not authorized to see other open issues.
I am unfamiliar with OSS-Fuzz. Please correct me if I got this wrong.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
