Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5059
| From | Moritz Muehlenhoff <jmm@inutil.org> |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? |
| Date | 2016-10-12 22:40 +0200 |
| Message-ID | <srytH-10O-3@gated-at.bofh.it> (permalink) |
| References | <sr6QO-8jN-23@gated-at.bofh.it> <sr7a9-8qo-1@gated-at.bofh.it> <srbx7-2Kh-7@gated-at.bofh.it> <srctb-3jq-13@gated-at.bofh.it> <srpgJ-3eb-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, Oct 12, 2016 at 10:43:41AM -0000, te3d4q@sigaint.org wrote:
> > We look at the vulnerabilities and make an assessment.
> > Cheers,
> > Moritz
> >
>
> 1. If I understood correctly the contents of your reply, on what basis
> does the Debian security team assess the severity of each security
> vulnerability? What are those criteria?
Human judgement based on experience.
> 2. Your latest reply implies strongly the possibility of the Debian
> security team's assessments of security vulnerabilities differing from
> those of the security teams of other popular Linux distros such as Gentoo,
> Kali, ArchLinux, Ubuntu, etc. Am I correct?
Of course, every distribution makes their own assessment. After
all each distro might ship an affected codebase in different
versions/configs/environments.
Cheers,
Moritz
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
csiph-web