Vulnerability Development: Re: Vendor Changelogs /Notifications

[Blue Boar <BlueBoar () thievco com>]

quentyn () fotango com wrote:
> Is it appropriate to send notifications to public lists if you spot that
> a vendor has fixed a serious security hole ( mentioned only in the
> change log) but hasn't sent any notification and doesn't have any
> notification on their site ? Other than using the product ( and reading
> change logs) I have had nothing to do with this issue.

It has been done before, both on Bugtraq and here.  It's probably
appropriate to both places, Bugtraq so people are aware there's a problem
and fix, and here, since the vulnerability may not have been otherwise
explored.

                                                BB