Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5057
| From | te3d4q@sigaint.org |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? |
| Date | 2016-10-12 12:50 +0200 |
| Message-ID | <srpgJ-3eb-11@gated-at.bofh.it> (permalink) |
| References | <sr6QO-8jN-23@gated-at.bofh.it> <sr7a9-8qo-1@gated-at.bofh.it> <srbx7-2Kh-7@gated-at.bofh.it> <srctb-3jq-13@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
> We look at the vulnerabilities and make an assessment. > Cheers, > Moritz > 1. If I understood correctly the contents of your reply, on what basis does the Debian security team assess the severity of each security vulnerability? What are those criteria? 2. Your latest reply implies strongly the possibility of the Debian security team's assessments of security vulnerabilities differing from those of the security teams of other popular Linux distros such as Gentoo, Kali, ArchLinux, Ubuntu, etc. Am I correct? As an example, ArchLinux issues a patch for a security vulnerability CVE-2016-xyz with an NVD rating of medium risk. However the Debian security team does not issue a fix for it.
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
csiph-web