This shows you the differences between two versions of the page.
|
mailing-lists:distros:stats:2025 [2025/09/24 03:30] solar add partial 2025-09 |
mailing-lists:distros:stats:2025 [2026/01/13 04:47] (current) solar add 2025-12 |
||
|---|---|---|---|
| Line 14: | Line 14: | ||
| | 2025-07 | 4 | 4 | 8.68 | 9.15 | 1.48 | 14.94 | | | 2025-07 | 4 | 4 | 8.68 | 9.15 | 1.48 | 14.94 | | ||
| | 2025-08 | 4 | 4 | 5.64 | 4.42 | 1.06 | 12.65 | | | 2025-08 | 4 | 4 | 5.64 | 4.42 | 1.06 | 12.65 | | ||
| - | | 2025-09 | 8 | 8 | 3.67 | 1.97 | 1.00 | 9.19 | | + | | 2025-09 | 11 | 11 | 5.04 | 4.78 | 1.00 | 13.89 | |
| - | | Total | 56 | 56 | 6.56 | 6.68 | 0.63 | 20.16 | | + | | 2025-10 | 8 | 8 | 7.36 | 6.94 | 1.00 | 15.48 | |
| + | | 2025-11 | 4 | 4 | 7.85 | 8.54 | 5.30 | 9.03 | | ||
| + | | 2025-12 | 8 | 8 | 8.19 | 7.93 | 4.38 | 12.39 | | ||
| + | | Total | 79 | 79 | 6.95 | 6.99 | 0.63 | 20.16 | | ||
| - | Non-embargoed reports (issue already posted to oss-security before being brought to (linux-)distros, which in 2025 didn't occur yet) are (will be) excluded from the calculation of average, median, and minimum embargo duration above. | + | Non-embargoed reports (issue already posted to oss-security before being brought to (linux-)distros, which in 2025 didn't occur) are (would be) excluded from the calculation of average, median, and minimum embargo duration above. |
| ===== Formatted input data ===== | ===== Formatted input data ===== | ||
| Line 82: | Line 85: | ||
| | curl | [vs-plain] : pre-notification curl CVE-2025-10148 \\ [[https://www.openwall.com/lists/oss-security/2025/09/10/2|[oss-security] [SECURITY ADVISORY] curl: CVE-2025-10148: predictable WebSocket mask]] | Tue Sep 09 05:49:00 2025 \\ Wed Sep 10 05:54:41 2025 | 1.00 | tomorrow \\ September 10 2025 around 06:00 UTC | CVE-2025-10148 | | | curl | [vs-plain] : pre-notification curl CVE-2025-10148 \\ [[https://www.openwall.com/lists/oss-security/2025/09/10/2|[oss-security] [SECURITY ADVISORY] curl: CVE-2025-10148: predictable WebSocket mask]] | Tue Sep 09 05:49:00 2025 \\ Wed Sep 10 05:54:41 2025 | 1.00 | tomorrow \\ September 10 2025 around 06:00 UTC | CVE-2025-10148 | | ||
| | Stork | [vs] One Stork vulnerability will be announced on 10 September 2025 \\ [[https://www.openwall.com/lists/oss-security/2025/09/10/5|[oss-security] ISC has disclosed one vulnerability in Stork (CVE-2025-8696)]] | Tue Sep 09 17:00:28 2025 \\ Wed Sep 10 19:08:02 2025 | 1.09 | 10 September 2025 | CVE-2025-8696 | | | Stork | [vs] One Stork vulnerability will be announced on 10 September 2025 \\ [[https://www.openwall.com/lists/oss-security/2025/09/10/5|[oss-security] ISC has disclosed one vulnerability in Stork (CVE-2025-8696)]] | Tue Sep 09 17:00:28 2025 \\ Wed Sep 10 19:08:02 2025 | 1.09 | 10 September 2025 | CVE-2025-8696 | | ||
| + | | OpenSSL | [vs-plain] Embargoed OpenSSL security issue \\ [[https://www.openwall.com/lists/oss-security/2025/09/30/5|[oss-security] OpenSSL Security Advisory]] | Tue Sep 16 16:32:28 2025 \\ Tue Sep 30 13:49:20 2025 | 13.89 | 30th September 2025 | CVE-2025-9230 \\ CVE-2025-9231 \\ CVE-2025-9232 | | ||
| + | | open-vm-tools | [vs] [EMBARGOED] CVE-2025-41244 - open-vm-tools \\ [[https://www.openwall.com/lists/oss-security/2025/09/29/10|[oss-security] [Security Advisory] open-vm-tools: Local privilege escalation (CVE-2025-41244)]] | Tue Sep 23 07:27:43 2025 \\ Mon Sep 29 16:24:26 2025 | 6.37 | Sep 29th, 2025 | CVE-2025-41244 \\ VMSA-2025-0015 | | ||
| + | | FreeIPA | [vs-plain] CVE-2025-7493 - Privilege escalation from host to domain admin in FreeIPA \\ [[https://www.openwall.com/lists/oss-security/2025/09/30/6|[oss-security] FreeIPA - CVE-2025-7493 - Privilege Escalation from host to domain admin]] | Wed Sep 24 19:00:18 2025 \\ Tue Sep 30 15:50:21 2025 | 5.87 | September 30th | CVE-2025-7493 | | ||
| + | | X.Org X server and Xwayland | [vs-plain] Preview of X.Org Security Advisory for 2025-10-28 \\ [[https://www.openwall.com/lists/oss-security/2025/10/28/7|[oss-security] Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland]] | Mon Oct 13 07:46:59 2025 \\ Tue Oct 28 19:24:11 2025 | 15.48 | October 28, 2025 at 13:00 UTC | CVE-2025-62229 \\ CVE-2025-62230 \\ CVE-2025-62231 \\ ZDI-CAN-27238 \\ ZDI-CAN-27545 \\ ZDI-CAN-27560 | | ||
| + | | BIND 9 | [vs] ... \\ [[https://www.openwall.com/lists/oss-security/2025/10/22/1|[oss-security] ISC has disclosed three vulnerabilities in BIND 9 (CVE-2025-8677, CVE-2025-40778, CVE-2025-40780)]] | Tue Oct 21 10:16:48 2025 \\ Wed Oct 22 15:54:47 2025 | 1.23 | 22 October 2025 | CVE-2025-8677 \\ CVE-2025-40778 \\ CVE-2025-40780 | | ||
| + | | runc | [vs] ... \\ [[https://www.openwall.com/lists/oss-security/2025/11/05/3|[oss-security] runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881]] | Wed Oct 22 12:16:52 2025 \\ Wed Nov 05 09:53:38 2025 | 13.90 | 2025-11-05 09:00 UTC | CVE-2025-31133 \\ CVE-2025-52565 \\ CVE-2025-52881 | | ||
| + | | OpenSMTPD | [vs] encrypted subject \\ [[https://www.openwall.com/lists/oss-security/2025/10/31/3|[oss-security] OpenSMTPD: Trivial Local Denial-of-Service via UNIX Domain Socket (CVE-2025-62875)]] | Thu Oct 23 09:35:42 2025 \\ Fri Oct 31 17:22:01 2025 | 8.32 | 2025-10-31 | CVE-2025-62875 | | ||
| + | | OpenStack Keystone | [vs] Vulnerability in OpenStack Keystone (CVE pending) \\ [[https://www.openwall.com/lists/oss-security/2025/11/04/2|[oss-security] [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE PENDING)]] | Tue Oct 28 16:03:06 2025 \\ Tue Nov 04 15:01:25 2025 | 6.96 | Tuesday, 2025-11-04, 1500UTC | | | ||
| + | | Kea | [vs] One Kea vulnerability will be announced on 29 October 2025 \\ [[https://www.openwall.com/lists/oss-security/2025/10/29/5|[oss-security] ISC has disclosed one vulnerability in Kea (CVE-2025-11232)]] | Tue Oct 28 18:00:50 2025 \\ Wed Oct 29 17:55:19 2025 | 1.00 | 29 October 2025 | CVE-2025-11232 | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-10966 \\ [[https://www.openwall.com/lists/oss-security/2025/11/05/2|[oss-security] [SECURITY ADVISORY] curl: missing SFTP host verification with wolfSSH]] | Wed Oct 29 08:55:34 2025 \\ Wed Nov 05 07:14:23 2025 | 6.93 | November 5 2025 around 07:00 UTC | CVE-2025-10966 | | ||
| + | | wcurl | [vs-plain] : pre-notification wcurl CVE-2025-11563 \\ [[https://www.openwall.com/lists/oss-security/2025/11/04/1|[oss-security] [SECURITY ADVISORY] wcurl path traversal with percent-encoded slashes]] | Thu Oct 30 07:19:58 2025 \\ Tue Nov 04 08:42:13 2025 | 5.06 | November 4 | CVE-2025-11563 | | ||
| + | | cups-filters | [vs-plain] EMBARGOED CVE-2025-64524 cups-filters: Heap Buffer Overflow in rastertopclx Filter Leading to Potential Arbitrary Code Execution \\ [[https://www.openwall.com/lists/oss-security/2025/11/20/1|[oss-security] CVE-2025-64524 cups-filters: Heap Buffer Overflow in rastertopclx Filter Leading to Potential Arbitrary Code Execution]] | Wed Nov 12 15:21:34 2025 \\ Thu Nov 20 17:02:55 2025 | 8.07 | November 20th 15:00 UTC | CVE-2025-64524 | | ||
| + | | cups | [vs-plain] EMBARGOED CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack \\ [[https://www.openwall.com/lists/oss-security/2025/11/27/4|[oss-security] CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack]] | Tue Nov 18 16:21:35 2025 \\ Thu Nov 27 17:00:36 2025 | 9.03 | November 27th 15:00 UTC | CVE-2025-58436 | | ||
| + | | cups | [vs-plain] EMBARGOED CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues \\ [[https://www.openwall.com/lists/oss-security/2025/11/27/5|[oss-security] CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues]] | Tue Nov 18 16:57:39 2025 \\ Thu Nov 27 17:00:58 2025 | 9.00 | November 27th 15:00 UTC | CVE-2025-61915 | | ||
| + | | Unbound | [vs] ... \\ [[https://www.openwall.com/lists/oss-security/2025/11/26/4|[oss-security] Unbound: 1.24.2 addresses CVE-2025-11411 (again)]] | Fri Nov 21 14:11:18 2025 \\ Wed Nov 26 21:27:10 2025 | 5.30 | 26th of November | CVE-2025-11411 | | ||
| + | | smb4k | [vs] encrypted subject \\ [[https://www.openwall.com/lists/oss-security/2025/12/10/6|[oss-security] smb4k: Major Vulnerabilities in KAuth Helper (CVE-2025-66002, CVE-2025-66003)]] | Mon Dec 01 15:17:53 2025 \\ Wed Dec 10 18:23:16 2025 | 9.13 | 2025-12-10 | CVE-2025-66002 \\ CVE-2025-66003 | | ||
| + | | dropbear | [vs-plain] dropbear: privilege escalation via unix domain socket forwardings \\ [[https://www.openwall.com/lists/oss-security/2025/12/16/2|[oss-security] Dropbear 2025.89 fixes privilege escalation, CVE-2025-14282]] | Thu Dec 04 04:49:55 2025 \\ Tue Dec 16 14:07:31 2025 | 12.39 | Tuesday 16th December, around 10pm +0800 | CVE-2025-14282 | | ||
| + | | systemd | [vs-plain] systemd: exposure of resource to wrong sphere \\ [[https://www.openwall.com/lists/oss-security/2025/12/28/4|[oss-security] Systemd vsock sshd]] | Tue Dec 23 21:34:00 2025 \\ Sun Dec 28 06:47:57 2025 | 4.38 | January 15th 2026 \\ January 6 | | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-13034 (1/5) \\ [[https://www.openwall.com/lists/oss-security/2026/01/07/2|[oss-security] [ADVISORY] curl CVE-2025-13034: No QUIC certificate pinning with GnuTLS]] \\ [[https://github.com/curl/curl/commit/3d91ca8cdb3b434226e743946]] | Tue Dec 30 08:52:43 2025 \\ Wed Jan 07 07:09:24 2026 | 7.93 | January 7 2026 around 07:00 UTC | CVE-2025-13034 | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-14524 (2/5) \\ [[https://www.openwall.com/lists/oss-security/2026/01/07/4|[oss-security] [ADVISORY] curl CVE-2025-14524: bearer token leak on cross-protocol redirect]] \\ [[https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd]] | Tue Dec 30 08:52:48 2025 \\ Wed Jan 07 07:09:41 2026 | 7.93 | January 7 2026 around 07:00 UTC | CVE-2025-14524 | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-14819 (3/5) \\ [[https://www.openwall.com/lists/oss-security/2026/01/07/5|[oss-security] [ADVISORY] curl CVE-2025-14819: OpenSSL partial chain store policy bypass]] \\ [[https://github.com/curl/curl/commit/cd046f6c93b39d673a58c1864]] | Tue Dec 30 08:52:55 2025 \\ Wed Jan 07 07:09:47 2026 | 7.93 | January 7 2026 around 07:00 UTC | CVE-2025-14819 | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-15079 (4/5) \\ [[https://www.openwall.com/lists/oss-security/2026/01/07/6|[oss-security] [ADVISORY] curl CVE-2025-15079: libssh global knownhost override]] \\ [[https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803]] | Tue Dec 30 08:53:03 2025 \\ Wed Jan 07 07:09:52 2026 | 7.93 | January 7 2026 around 07:00 UTC | CVE-2025-15079 | | ||
| + | | curl | [vs-plain] : pre-notification curl CVE-2025-15224 (5/5) \\ [[https://www.openwall.com/lists/oss-security/2026/01/07/7|[oss-security] [ADVISORY] curl CVE-2025-15224: libssh key passphrase bypass without agent set]] \\ [[https://github.com/curl/curl/commit/16d5f2a5660c61cc27bd5f1c7f512391d1c92]] | Tue Dec 30 08:53:10 2025 \\ Wed Jan 07 07:09:56 2026 | 7.93 | January 7 2026 around 07:00 UTC | CVE-2025-15224 | | ||
| ===== Source input data ===== | ===== Source input data ===== | ||
| Line 96: | Line 122: | ||
| * {{stats-202508.txt}} | * {{stats-202508.txt}} | ||
| * {{stats-202509.txt}} | * {{stats-202509.txt}} | ||
| + | * {{stats-202510.txt}} | ||
| + | * {{stats-202511.txt}} | ||
| + | * {{stats-202512.txt}} | ||