Android, Debian & Ubuntu Top List Of CVE Vulnerabilities In 2016

[dungeon]

He, he, i randomly clicked on one of those for Debian and got this:

https://www.cvedetails.com/cve/CVE-2016-6130/

How can be that assinged to Debian 8 when linux kernel 4.5.5 is not in Debian 8 I guess someone running backported kernel at the time found an issue or something

[Slartifartblast]

He, he, i randomly clicked on one of those for Debian and got this:

https://www.cvedetails.com/cve/CVE-2016-6130/

How can be that assinged to Debian 8 when linux kernel 4.5.5 is not in Debian 8 I guess someone running backported kernel at the time found an issue or something

Or wintards in Seattle trying to make Linux look bad, remember "get the facts".

[starshipeleven]

Or wintards in Seattle trying to make Linux look bad, remember "get the facts".

This. The fact that Windows is split by release while linux distros and macOS are not and there is a highly generic "Linux" entry do hint at some bullshit reasoning if not outright bad faith.

[Delgarde]

I'm not seeing Java (the VM). What tricks did they pull to not be shown in there?

Honestly, I think they've just legitimately improved - Java does have a bad reputation, but they've not actually had many new issues in the last couple of years. And speaking as a Java developer, I can definitely confirm that they've *massively* tightened security policy since around 2014.... deploying client-side code (applets, web-start apps) has become a lot more restrictive than it used to be, to the point where the security checking is actually becoming a performance problem.

So yeah, I think it's plausible enough... it's not like they didn't have any CVEs raised in 2016, just not enough to put them in the top 50 (they had 37 raised).


Also, Java has never really quite as bad as the reputation suggests. The bad rep comes from a few years - 2008 and 2013 - where a lot of serious issues were found... the latter probably found by an audit, since there's a large number of very similar issues, almost all of them fixed in the same release.

[Guest]

The parsing should probably be written in the Rust programming language.

What's wrong with poppler?

[Guest]

Or wintards in Seattle trying to make Linux look bad, remember "get the facts".

Too bad moronix spreads the same FUD as usual. M. Larabel always throws some shit without doing investigation. It's really bad journalism. I have adobe flash installed in my Kubuntu as default. Does it mean it counts as Kubuntu vulnerability? The same about many codecs and nvidia blob.

[bug77]

I'm not seeing Java (the VM). What tricks did they pull to not be shown in there?

Also Acrobat fucking Reader (various flavors) trails it by only a few dozens of CVEs less.

I don't think JVM is that bad. The Java browser plugin was the stuff of nightmares though. And Yahoo Messenger since we're unearthing the dead.

[Delgarde]

I don't think JVM is that bad. The Java browser plugin was the stuff of nightmares though.

Actually, from what I see in the CVE list, most of the problems weren't in the plugin itself - the plugin was just the easiest mechanism for running arbitrary code on a user machine, allowing vulnerabilities elsewhere to be exposed. Quite a lot of them seem to be in AWT which makes sense - that includes native bindings for UI widgets and stuff, and native code (i.e. C/C++) is always a good place to find buffer overflows and other such easy targets.

[dungeon]

I wondering why Windows XP is not in the list, funny that it still has more market than OS X and Linux combined... about 9% of Desktops - that is quite big really

Also very interestingly, Windows XP actually seems started to grow up again:

Windows XP dropped from 10.09 percent in May 2016 to 9.78 percent the next month, before growing to 10.34 percent once again in July. Declines were recorded until November when it recorded a growth from 8.27 percent the month before to 8.63 percent. And this growth continued in December to reach 9.07 percent.

This means that in just two months, an operating system that no longer receives updates since 2014 increased from 8.27 percent to 9.07 percent, in a time when Microsoft is pushing for everyone to adopt Windows 10.

http://news.softpedia.com/news/windo...y-511474.shtml

[starshipeleven]

I wondering why Windows XP is not in the list,

Because none reports CVEs for XP since it is not supported anymore.
It has joined Win2000, Win98 and win95 in the nirvana of 0-CVE operating systems.

Also very interestingly, Windows XP actually seems started to grow up again:
http://news.softpedia.com/news/windo...y-511474.shtml

It may be an artifact (i.e. the amount of people with XP using some sites doing this tracking has increased), OS marketshare testing has never been terribly reliable.

Still better than Steam survey, on average, but there is a large margin for variability.