this post was submitted on 07 Nov 2024
-16 points (21.4% liked)
Linuxsucks
188 readers
123 users here now
Rules:
- FOSS advocates and Linux evangelists aren't welcome. -We ask that you block us.
- Moderation is heavy handed. Try to stay on topic.
- No Complaining Mute the sub if users, content, or rules bother you
founded 1 month ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That number shows across all versions, regardless if they have been patched or mitigated
If you look on that site at current versions only it looks very different
iOS 18 - 30
iOS 18.1 beta - 0
macOS 11.2.3 - 0
Windows 11 22h2 current patch - 0
Fedora 41 - 1
Android 15 - 7
Ubuntu 23.10 - 2 (for some reason 24.04 and 24.10 are missing)
It's a pretty interesting site!
Bingo. That site is counting that same vuln repeatedly.
How do you figure? The title says 'distinct'.
By looking at the data on the website..? The same vuln appears under multiple different versions of an OS.
Your statement seems worded to imply that the same vulnerability is being counted in the same version of the OS, and it wouldn't make sense to comment as such since it would be omitting data otherwise.
They’re still not distinct vulnerabilities. They’re the same vulnerabilities across different products and versions. Others in the thread immediately misunderstood what the table was presenting.
Cvedetails was far better (albeit uglier) in the past before Security Scorecard took over the brand / domains.
Another fundamental mistake Security Scorecard are making is that they don’t understand the data they’re trying to visualise, group, and rank. Debian, for instance, do a stellar job and enumerate any version of their product that has a vulnerable package in their repos even if it’s nothing to do with the actual operating system whereas Apple don’t enumerate vulnerable App Store apps in the same way nor do many other Linux distributions which have their own repos of packaged FOSS apps.
What thus results in is Debian getting tabulated to look like they’re doing something really wrong with the number of vulns they’re enumerating whereas it’s actually exceptionally awesome that they do. This kind of junk “Top x” just incentivises other distributions to not put in get hard work and provide CPE codes for their distro’s package repos.