linux-from-scratch/glfs
1
0
Fork 0
mirror of https://github.com/Zeckmathederg/glfs.git synced 2025-02-04 07:17:15 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Text fixups on vuln page

Browse Source 
git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@10790 af4574ff-66df-0310-9fd7-8a98e5e911e0
This commit is contained in:
Chris Staub 2012-10-26 06:15:09 +00:00
parent 0d7beb476c
commit 321434ca1f
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
postlfs/security/vulnerabilities.xml
View File

@ -25,7 +25,7 @@
<para>All software has bugs. Sometimes, a bug can be exploited, for example
to allow users to gain enhanced privileges (perhaps gaining a root shell, or
simply accessing or deleting other users&apos; files), or to allow a remote
simply accessing or deleting other user&apos;s files), or to allow a remote
site to crash an application (denial of service), or for theft of data. These
bugs are labelled as vulnerabilities.</para>
@ -37,14 +37,14 @@
<command>configure</command> options, or only apply to old versions of
packages which have long since been updated in BLFS.</para>
<para>BLFS differs from distributions - there is no BLFS security team and
<para>BLFS differs from distributions - there is no BLFS security team, and
the editors only become aware of vulnerabilities after they are public
knowledge. Sometimes, a package with a vulnerability will not be updated in
the book for a long time. Issues can be logged in the trac system, which
the book for a long time. Issues can be logged in the Trac system, which
might speed up resolution.</para>
<para>The normal way for BLFS to fix a vulnerability is, ideally, to update
the book to a new fixed releasse of the package. Sometimes that happens even
the book to a new fixed release of the package. Sometimes that happens even
before the vulnerability is public knowledge, so there is no guarantee that
it will be shown as a vulnerability fix in the Changelog. Alternatively, a
<command>sed</command> command, or a patch taken from a distribution, may be
@ -54,14 +54,14 @@
for assessing the potential impact of any problems.</para>
<para>To keep track of what is being discovered, you may wish to follow the
security announcements of one or more distributions. For example, debian have
<ulink url="http://www.debian.org/security">debian security</ulink>.
fedora links on security are at
<ulink url="http://fedoraproject.org/wiki/Security">the fedora wiki</ulink>.
details of gentoo linux security announcements are discussed at
<ulink url="http://www.gentoo.org/security">gentoo security</ulink>.
security announcements of one or more distributions. For example, Debian has
<ulink url="http://www.debian.org/security">Debian security</ulink>.
Fedora's links on security are at
<ulink url="http://fedoraproject.org/wiki/Security">the Fedora wiki</ulink>.
details of Gentoo linux security announcements are discussed at
<ulink url="http://www.gentoo.org/security">Gentoo security</ulink>.
and the Slackware archives of security announcements are at
<ulink url="http://slackware.com/security">slackware security</ulink>.
<ulink url="http://slackware.com/security">Slackware security</ulink>.
</para>
<para>The most general English source is perhaps
@ -71,7 +71,7 @@
<ulink url="http://www.heise.de/security">heise.de</ulink> (German) or
<ulink url="http://www.cert.hr">cert.hr</ulink> (Croatian). These are not
linux-specific. There is also a daily update at lwn.net for subscribers
(free access to the data after 2 weeks), but their vulnerabilities database at
(free access to the data after 2 weeks, but their vulnerabilities database at
<ulink url="http://lwn.net/Vulnerabilities/">lwn.net/Vulnerabilities</ulink>
is unrestricted).</para>