[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1906161200500.1813@freddy.simplesystems.org>
Date: Sun, 16 Jun 2019 12:08:20 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
OSS-Fuzz
On Sun, 16 Jun 2019, Solar Designer wrote:
>
> Some people have interpreted this as implying there are ">100 security
> bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> not been fixed" specifically in ImageMagick. However, at the link you
> referenced there are currently "only" 38 bugs specifically in
> ImageMagick, with the rest of the >100 being in other projects:
Using the ordinary public access I have, I see that ImageMagick has
129 open issues, and 1479 issues in total. There are surely issues
that I can not see yet since they are hidden for up to 90 days.
Taking the number 129, that would mean that there is a huge number of
issues already fixed (1350) which are gradually making it out to
users. This is too many fixes to deal with via distribution-specific
patches.
Using my privileged access for GraphicsMagick, I currently see 343
issues in total, with 12 issues remaining to fix. Some of those 12
issues are open to the public for some time now. :-(
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
