Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz

[Solar Designer <solar () openwall com>]

On Sun, Jun 16, 2019 at 12:08:20PM -0500, Bob Friesenhahn wrote:
> On Sun, 16 Jun 2019, Solar Designer wrote:
> > Some people have interpreted this as implying there are ">100 security
> > bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> > not been fixed" specifically in ImageMagick.  However, at the link you
> > referenced there are currently "only" 38 bugs specifically in
> > ImageMagick, with the rest of the >100 being in other projects:
>
> Using the ordinary public access I have, I see that ImageMagick has 
> 129 open issues, and 1479 issues in total.  There are surely issues 
> that I can not see yet since they are hidden for up to 90 days.

I guess this is a distinction between all open deadline-exceeded issues
(129) and only deemed security ones out of those (38).

Removing "Type=Bug-Security status:New", but keeping
"label:Deadline-exceeded" does show 129 issues for ImageMagick.

Also removing "label:Deadline-exceeded" still results in 129, perhaps
because I'm not authorized to see other open issues.

I am unfamiliar with OSS-Fuzz.  Please correct me if I got this wrong.

Alexander