Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On Thu 2015-01-29 19:00:35 -0500, Hanno Böck wrote:
> As promised, I wrote down my lengthy thoughts in a blog post:
> https://blog.hboeck.de/archives/864-What-the-GHOST-tells-us-about-free-software-vulnerability-management.html

thanks for this writeup, Hanno.  you wrote:

> > It would be an interesting (and time consuming) project to take a
> > package like PHP and check for all the security vulnerabilities whether
> > they are fixed in the latest packages in Debian Squeeze/Wheezy, all Red
> > Hat Enterprise versions and other long term support systems.

I don't know about RHEL, but Debian's security tracker does actually try
to do this, and to coordinate it with the CVEs.  For example:

  https://security-tracker.debian.org/tracker/source-package/php5

It ain't pretty, but it's there.  If you (or anyone) is interested in
working on this sort of tracker, or integrating between this and other
trackers, please talk to the debian security team:

  https://wiki.debian.org/Teams/Security

Regards,

      --dkg

Attachment: signature.asc
Description: