mailing list archives
Re: CVE-2012-2248: isc-dhcp, Debian-specific: build path included in PATH
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 18 Oct 2012 14:19:06 -0600
-----BEGIN PGP SIGNED MESSAGE-----
On 10/18/2012 01:35 PM, Michael Gilbert wrote:
On Wed, Oct 17, 2012 at 8:41 PM, Kurt Seifried wrote:
It was uploaded to and affected Debian testing and unstable.
Testing has not yet been officially "released", but some people
use testing as if it were an official release. Unstable never
When I say released I meant in the sense of made available for
download, not in the sense of software engineering and doing a
So, at the risk of sounding nitpicky, the Debian testing +
unstable archives are pretty much equivalent to Fedora rawhide.
Even though Redhat's position is that issues affecting only rawhide
should not get CVE identifiers, in Debian I think we should try to
be more honest, so we'll assign identifiers to all "uploaded"
versions (in Debian, we use the term upload to mean that a package
is available in an archive vice the term release).
Part of it also depends on usage. Google labels everything as a Beta,
sometimes for years and with millions of users. My experience is a lot
of people use Debian unstable (when I used Debian I did, otherwise
everything was to boring =). What would be interesting is if you could
provide download statistics from the main site. I know for a fact
CVE's have been assigned for publicly released applications that are
probably in use by less than 100 or in extreme cases possibly less
than 10 people globally.
Best wishes, Mike
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
-----END PGP SIGNATURE-----