cves

We agree that the developer is to blame for the thousands of overflow CVEs out there.

With the other 8+ 10/10 CVEs adobe announced today, they're not exactly covering themselves in glory here...

It would be nice if it said why the installed version is vulnerable, links to CVEs, etc.

Edit: those stats show Chrome is better in terms of CVE severity, not number of annual CVEs.

There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.

If it is one of the open source systems, where are the CVEs they've found and upstreamed?

You can judge whether you need to reboot based on the CVEs being patched.

Currently, there is no straightforward way of checking Ubuntu package versions against CVEs.

There have been 10 Linux kernel CVEs issued in the last 2 months.

So you're cataloging the software installed and then monitoring for CVEs?

Though we also keep track of which versions are supported and also create an inventory with the CVEs and their risk.

Let's compare CVEs when it's at least in the top three.

Flash has over 34 CVEs in one week—and only because a prominent organization that was sitting on a bunch of them got hacked—and you call mozilla taking steps to protect the security and integrity of their customers an "engineered annoyance"?

The management tools are fairly decent, and the question "which CVEs are we vulnerable to our production environment" or "were are we still using Java 6" shouldn't be more than a keypress away.