Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Sun, 16 Jun 2019, Solar Designer wrote:
> Some people have interpreted this as implying there are ">100 security
> bugs OSS-Fuzz found and publicly disclosed [...], and which still have
> not been fixed" specifically in ImageMagick.  However, at the link you
> referenced there are currently "only" 38 bugs specifically in
> ImageMagick, with the rest of the >100 being in other projects:

Using the ordinary public access I have, I see that ImageMagick has 
129 open issues, and 1479 issues in total.  There are surely issues 
that I can not see yet since they are hidden for up to 90 days.

Taking the number 129, that would mean that there is a huge number of 
issues already fixed (1350) which are gradually making it out to 
users.  This is too many fixes to deal with via distribution-specific 
patches.

Using my privileged access for GraphicsMagick, I currently see 343 
issues in total, with 12 issues remaining to fix.  Some of those 12 
issues are open to the public for some time now. :-(

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt