I didn’t read it but there are always vulnerabilities and rushing may introduce other bugs or vulnerabilities. There’s a reason why it’s first in beta.
Some of these bugs don’t even have a fix yet, at least not one that’s committed to the kernel source. The real headline here is that Trend Micro fucked up and blasted the vulnerabilities and proof code to the Linux kernel public mailing list instead of the private vulnerability disclosure email address. They basically gave hackers everywhere a bunch of new zero-day exploits, for free. Absolute clownshoes behaviour.
Shouldn’t it have these distro maintainers thinking of quickly merging security fixes into their stable branches?
I didn’t read it but there are always vulnerabilities and rushing may introduce other bugs or vulnerabilities. There’s a reason why it’s first in beta.
Some of these bugs don’t even have a fix yet, at least not one that’s committed to the kernel source. The real headline here is that Trend Micro fucked up and blasted the vulnerabilities and proof code to the Linux kernel public mailing list instead of the private vulnerability disclosure email address. They basically gave hackers everywhere a bunch of new zero-day exploits, for free. Absolute clownshoes behaviour.
Gotcha! Thanks!