This page lists security contacts, bug tracker links, links to advisories, etc. for various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems.

When adding to this page, please include the following vendor information:

1. link to bug tracker (i.e. Bugzilla)
2. link to security advisories, errata, or any other page that provides notification of security-related updates/changes
3. email address for the security contact

As well, please keep this list in alphabetical order.

• Annvix Bugzilla
• Changelog and errata information
• Security contact: security [at] annvix [dot] org

• Security process information
• Security issues should be sent to product [dash] security [at] apple [dot] com
• Alternatively, reported through the Apple Bug Reporter
• Security advisories

• ClamAV bug tracker
• RSS-feed for advisories http://www.clamav.net/lang/en/feed
• Contact information http://www.clamav.net/lang/en/contacts/

• Debian bug tracker
• Security issues should be sent to security [at] debian [dot] org
• Recent advisories are listed upon our front page

• Security issues should be sent to security [at] foresightlinux [dot] org
• Advisories are published for the currently-maintained branch at the Foresight Linux Essential Advisory mailing list

• Gentoo Bugzilla – see “Gentoo Security” product.
• Gentoo Linux Security Advisories (GLSA) published via Mail (subscribe), HTTP and RSS.
• Security Website with Vulnerability Policy and confidential contacts.
• Security contact: security [at] gentoo [dot] org, #gentoo-security on irc.freenode.net.

• Mandriva Bugzilla
• Security and errata information
• Security contact: security [at] mandriva [dot] com

• The process for distribution of security advisories is currently under discussion.
• MontaVista security contacts can be reached at security [dash] exploder [at] mvista [dot] com.

• Bug tracking database
• Contact and errata information
• Security contact: security [dash] alert [at] NetBSD [dot] org

• Bug tracking database
• Security and errata information
• Security contact: deraadt [at] openbsd [dot] org

• Bugzilla
• Security-support page
• SUSE Security Announcements RSS feed
• Mailing-list: opensuse-security-announce and opensuse-security
• Security contact: security [at] suse [dot] de

• Changes in the currently-maintained stable branch (any security fixes are marked as such, along with issue severity information)
• Changes in the development branch (ditto)
• Security contact: security [at] owl [dot] openwall [dot] com

• Pardus Bugzilla – see “Guvenlik/Security” product.
• Pardus Linux Security Advisories (PLSA) published via Mail list (subscribe), HTTP and RSS.
• Security contact: security [at] pardus [dot] org [dot] tr

• Report security issues to secalert [at] redhat [dot] com or see https://www.redhat.com/security/team/contact/ for our keys and policies
• Advisories for all Red Hat products are published to the RHSA announce mailing list since Nov 2007 (older are at http://www.redhat.com/archives/enterprise-watch-list/).

• Security-related bugs can either be mailed to security [at] rpath [dot] com or filed at https://issues.rpath.com (setting the “security level” to “reporter and rPath Security Team”)
• Advisories are published to the security-announce mailing list for all branches which are currently being supported.

• Use https://developer.symbian.org/bugs/ to report Symbian Platform bugs (private security bugs can be opened by checking the “This is a security problem that should be kept confidential until addressed” box).
• The process for distribution of security advisories is currently under discussion.
• Symbian Foundation security contacts can be reached at security [dash] alert [at] symbian [dot] org.

• Use https://launchpad.net/ubuntu/+filebug to report Ubuntu bugs (private security bugs can be opened by checking the “This bug is a security vulnerability” box).
• Ubuntu Security Notices are sent to the ubuntu-security-announce mailing list.
• Security contacts for Ubuntu can be reached at security [at] ubuntu [dot] com.

There are separate wiki pages with similar information on individual Open Source projects and the infrastructure.

There's a similar page on the Distributions Wiki.

OSVDB maintains The Vendor Dictionary, an extensive database of software and appliance vendors (not limited to Open Source ones).