Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Michal Zalewski <lcamtuf () coredump cx>]

The reality is that there probably are hundreds of security bugs that
are fixed without CVEs and advisories every year, because of a
combination of several things:

1) "Accidental" fixes as a part of code rewrites or design changes,

2) Developers not knowledgeable enough to understand the impact or
quickly assess exploitability,

3) Developers being actively opposed to treating security
vulnerabilities in a special way, disliking the security community, or
wanting to sweep bugs under the rug.

In addition to this, even when advisories are written, there are
incentives to game the system. Some have an incentive to overhype
issues, others to make them go away, and yet others make the world
worse by comparing the security of products by counting CVEs.

This kind of sucks, but I'm not sure how can we fix this in a
practical way. The best approach may be to release and push out new
versions of packages far more aggressively, without trying to identify
and cherry-pick security updates. This also means causing a lot more
breakage, but maybe that's OK.

/mz

PS. A good chunk of the bugs linked to via
http://lcamtuf.coredump.cx/afl/ probably don't have CVEs assigned,
probably including most of the security-relevant ones here:
https://udd.debian.org/cgi-bin/bts-usertags.cgi?user=jwilk () debian org&tag=afl
. I actually tried to ping cve-assign@ about the libtiff bugs, but
they didn't get back to me.