Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 Jun 2019 09:51:02 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
 OSS-Fuzz

On Tue, 25 Jun 2019, Matthew Fernandez wrote:

> I’m probably telling you things you already know and it sounds like 
> you don’t consider such issues worth addressing, but I just wanted 
> to point out that these are not theoretical. These cause real 
> problems for users and, for open source software, you may not have 
> full control over what toolchain/flags users build your code with.

I think that almost all bugs are issues worth addressing given 
sufficent resources available to address them.  The issue discussed is 
what proportion of bugs discovered via automated testing and claimed 
to be "security" issues based on computer analysis are exploitable 
vulnerabilities which deserve a CVE.

A good point has been made that Linux heap memory allocation behavior 
may be very different than other OSs and that behavior can also be 
hardware-specific.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.