5 ms·
At one point I made an attempt to do this from the CVE database, but it's difficult to do since CVEs aren't really machine readable from a "memory safety vs. ot
by dikaiosune 10y ago
At one point I made an attempt to do this from the CVE database, but it's difficult to do since CVEs aren't really machine readable from a "memory safety vs. other security flaws" perspective. I recall finding a lot of reported vulns with buffer, overflow, null pointer dereference, double free, etc., but that's far from scientific.
- digikata 10y agoI would be nice to also track the maturity of the errant code base that those types of bugs are being reported in. One theory might be very mature/well tended code bases should have decreasing numbers of memory safety issues, and data in this regard would form some sort of basis to say - this code should be left alone, this other code would likely benefit from a rewrite into a new lang..