This page lists security contacts, bug tracker links, links to advisories, etc. for various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems.

When adding to this page, please include the following vendor information:

1. link to bug tracker (i.e. Bugzilla)
2. link to security advisories, errata, or any other page that provides notification of security-related updates/changes
3. email address for the security contact

As well, please keep this list in alphabetical order.

• Annvix Bugzilla
• Changelog and errata information
• Security contact: security [at] annvix [dot] org

• Security process information
• Security issues should be sent to product [dash] security [at] apple [dot] com
• Alternatively, reported through the Apple Bug Reporter
• Security advisories

• Security issues should be sent to security [at] debian [dot] org
• Recent advisories are listed upon our front page

• Security issues should be sent to security [at] foresightlinux [dot] org
• Advisories are published for the currently-maintained branch at the Foresight Linux Essential Advisory mailing list

• Gentoo Bugzilla – see “Gentoo Security” product.
• Gentoo Linux Security Advisories (GLSA) published via Mail (subscribe), HTTP and RSS.
• Security Website with Vulnerability Policy and confidential contacts.
• Security contact: security [at] gentoo [dot] org, #gentoo-security on irc.freenode.net.

• Mandriva Bugzilla
• Security and errata information
• Security contact: security [at] mandriva [dot] com

• Bug tracking database
• Contact and errata information
• Security contact: security [dash] alert [at] NetBSD [dot] org

• Bug tracking database
• Security and errata information
• Security contact: deraadt [at] openbsd [dot] org

• Bugzilla
• Security-support page
• SUSE Security Announcements RSS feed
• Mailing-list: opensuse-security-announce and opensuse-security
• Security contact: security [at] suse [dot] de

• Changes in the currently-maintained stable branch (any security fixes are marked as such, along with issue severity information)
• Changes in the development branch (ditto)
• Security contact: security [at] owl [dot] openwall [dot] com

• Report security issues to secalert [at] redhat [dot] com or see https://www.redhat.com/security/team/contact/ for our keys and policies
• Advisories for all Red Hat products are published to the RHSA announce mailing list since Nov 2007 (older are at http://www.redhat.com/archives/enterprise-watch-list/).

• Security-related bugs can either be mailed to security [at] rpath [dot] com or filed at https://issues.rpath.com (setting the “security level” to “reporter and rPath Security Team”)
• Advisories are published to the security-announce mailing list for all branches which are currently being supported.

• Use https://launchpad.net/ubuntu/+filebug to report Ubuntu bugs (private security bugs can be opened by checking the “This bug is a security vulnerability” box).
• Ubuntu Security Notices are sent to the ubuntu-security-announce mailing list.
• Security contacts for Ubuntu can be reached at security [at] ubuntu [dot] com.

There are separate wiki pages with similar information on individual Open Source projects and the infrastructure.

OSVDB maintains The Vendor Dictionary, an extensive database of software and appliance vendors (not limited to Open Source ones).