https://oss-security.openwall.org/wiki/ 2026-05-19T06:44:35+02:00 https://oss-security.openwall.org/wiki/ https://oss-security.openwall.org/wiki/lib/tpl/local/images/favicon.ico text/html 2008-05-23T04:20:10+02:00 https://oss-security.openwall.org/wiki/about?rev=1211509210&do=diff The Open Source Security (oss-security) wiki and mailing list are a product of co-operation amongst various open source software vendors, projects, and researchers. The purpose of the oss-security group is to encourage public discussion of security flaws, concepts, and practices in the Open Source community. text/html 2010-11-08T22:28:41+02:00 https://oss-security.openwall.org/wiki/code-reviews?rev=1289251721&do=diff This page will hopefully soon consist of many code review reports with proper description of project/version/architecture/possible flaws and security relevant patches. As a start, I will add some packages which are common across a lot of Linux distributions and have been identified as a potential risk since they either run privileged or with network input. Feel free to add other OS's or move to another, separate, page. The intention is NOT to enumerate all possibly problematic packages such as … text/html 2025-11-15T07:25:56+02:00 https://oss-security.openwall.org/wiki/development-guide?rev=1763187956&do=diff Introduction Welcome to the Secure OSS Development Guide. The goal of this wiki is to provide a list of best practices that are recommended for securely developing an open source project. Note: This development guide is currently a work in progress. At this point the guide should not be considered complete, and current content will not necessarily be included in the final draft. text/html 2013-10-24T01:28:37+02:00 https://oss-security.openwall.org/wiki/disclosure?rev=1382570917&do=diff Flaw Disclosure Anytime an individual discovers a security flaw, there are certain steps that should be taken to ensure that the details of the flaw are disclosed in a responsible and acceptable manner. Reporting a flaw in open source software poses a number of unique challenges compared to the closed source counterparts. text/html 2019-07-12T14:45:43+02:00 https://oss-security.openwall.org/wiki/distro-patches?rev=1562935543&do=diff This page lists how to find and extract patches from various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems. See the general Vendor information page for details on where to find security announcements. text/html 2016-01-02T13:22:16+02:00 https://oss-security.openwall.org/wiki/exploit-mitigation?rev=1451737336&do=diff There are a number of exploit mitigation techniques to reduce the impact of common C vulnerabilities. Unfortunately they are not as widely used as they should in free operating systems. For ASLR to work properly Linux needs position independent code and position independent executables (CFLAGS -fpic and -pie). Currently most Linux distributions don't enable pie by default. text/html 2008-05-27T19:54:22+02:00 https://oss-security.openwall.org/wiki/infrastructure?rev=1211910862&do=diff This page lists security contacts, status links, etc. for various open source-providing infrastructure folks. When adding to this page, please include the following vendor information: * email address for the security contact * link to FAQ * link to network/service status information (i.e. scheduled down-times) * link to issue tracker (i.e. Bugzilla) text/html 2025-11-15T07:31:58+02:00 https://oss-security.openwall.org/wiki/links?rev=1763188318&do=diff Here is a list of other websites with OSS-security-related information (be it articles, tutorials, general information, etc.) Vulnerability databases and security advisory archives * <http://cve.mitre.org> - MITRE's CVE (Common Vulnerabilities and Exposures) dictionary * <http://nvd.nist.gov> - NIST's NVD (National Vulnerability Database) * <http://osvdb.org> - OSVDB (The Open Source Vulnerability Database) * <http://www.linuxsecurity.com/content/section/3/170/> - LinuxSecurity.com adv… text/html 2023-08-09T13:04:43+02:00 https://oss-security.openwall.org/wiki/mailing-lists?rev=1691579083&do=diff This page provides links to a number of security-related mailing list resources. Public Lists * <oss-security@lists.openwall.com>: The open source software security mailing list (oss-security), which is a counter-part to this wiki. This is a public mailing list for anyone to subscribe to. Non-members may post to the list, however their messages will be moderated before release. This list is an open list for open source software authors and vendors to discuss public security issues. * o… text/html 2008-05-23T04:36:27+02:00 https://oss-security.openwall.org/wiki/mailinglists?rev=1211510187&do=diff This page has moved. text/html 2025-04-01T19:40:56+02:00 https://oss-security.openwall.org/wiki/software?rev=1743529256&do=diff This is a list of various open source software projects with links to security contacts for the project. Please only list those projects that do have a security contact to list! The contact may be an email address or a web page with more information. text/html 2026-03-13T15:09:25+02:00 https://oss-security.openwall.org/wiki/tools?rev=1773410965&do=diff This page will give you some hints about various tools that might be used to uncover security vulnerabilities and perform code reviews. Please note that the tools listed here have been recommended by various individuals who participate in the oss-security mailing list and there are no guarantees, so please take time to carefully evaluate any tools that you use. text/html 2025-04-10T04:36:33+02:00 https://oss-security.openwall.org/wiki/vendors?rev=1744252593&do=diff This page lists security contacts, bug tracker links, links to advisories, etc. for various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems. When adding to this page, please include the following vendor information: text/html 2018-09-07T15:25:29+02:00 https://oss-security.openwall.org/wiki/welcome?rev=1536326729&do=diff Welcome to the Open Source Software Security Wiki. This wiki provides information on a variety of open source security resources and “best practices” information. It is also the counterpart to the oss-security mailing list. Please note that registration on this wiki is distinct from mailing list subscription; you're not automatically subscribed when you register on the wiki. text/html 2013-10-24T01:30:11+02:00 https://oss-security.openwall.org/wiki/whattodo?rev=1382571011&do=diff See also: disclosure This page is designed to teach folks who may not be familiar with security what the generally accepted procedures are, and why they exist. When a user or security researcher submits a bug to a maintainer of an open-source project, there are a number of factors that determine the proper course of action. The most basic is who is known to consume the software. If all your users obtain the code directly from your site, do not modify it, and are not known to redistribute it,…