Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Jun 2019 21:29:14 +0200
From: Solar Designer <>
Subject: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz

On Sun, Jun 16, 2019 at 12:08:20PM -0500, Bob Friesenhahn wrote:
> On Sun, 16 Jun 2019, Solar Designer wrote:
> >
> >Some people have interpreted this as implying there are ">100 security
> >bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> >not been fixed" specifically in ImageMagick.  However, at the link you
> >referenced there are currently "only" 38 bugs specifically in
> >ImageMagick, with the rest of the >100 being in other projects:
> Using the ordinary public access I have, I see that ImageMagick has 
> 129 open issues, and 1479 issues in total.  There are surely issues 
> that I can not see yet since they are hidden for up to 90 days.

I guess this is a distinction between all open deadline-exceeded issues
(129) and only deemed security ones out of those (38).

Removing "Type=Bug-Security status:New", but keeping
"label:Deadline-exceeded" does show 129 issues for ImageMagick.

Also removing "label:Deadline-exceeded" still results in 129, perhaps
because I'm not authorized to see other open issues.

I am unfamiliar with OSS-Fuzz.  Please correct me if I got this wrong.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.