[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1906250946080.7899@scrappy.simplesystems.org>
Date: Tue, 25 Jun 2019 09:51:02 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
OSS-Fuzz
On Tue, 25 Jun 2019, Matthew Fernandez wrote:
> I’m probably telling you things you already know and it sounds like
> you don’t consider such issues worth addressing, but I just wanted
> to point out that these are not theoretical. These cause real
> problems for users and, for open source software, you may not have
> full control over what toolchain/flags users build your code with.
I think that almost all bugs are issues worth addressing given
sufficent resources available to address them. The issue discussed is
what proportion of bugs discovered via automated testing and claimed
to be "security" issues based on computer analysis are exploitable
vulnerabilities which deserve a CVE.
A good point has been made that Linux heap memory allocation behavior
may be very different than other OSs and that behavior can also be
hardware-specific.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
