5 ms·
> MS Windows has been the "most" exploited OS in our history. Doesn't look that way Top 50 Products By Total Number Of "Distinct" Vulnerabilities https://www.
by benaadams 8y ago
> MS Windows has been the "most" exploited OS in our history.
Doesn't look that way
Top 50 Products By Total Number Of "Distinct" Vulnerabilities https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/top-50-products.php
Vulns Product
1. 2124 Linux Kernel Linux OS
2. 2084 Mac Os X Apple OS
3. 1924 Android Google OS
4. 1741 Firefox Mozilla App
5. 1664 Debian Linux Debian OS
6. 1546 Chrome Google App
7. 1495 Iphone Os Apple OS
8. 1123 Ubuntu Linux Canonical OS
9. 1103 Windows Server 2008 Microsoft OS
10. 1057 Flash Player Adobe App
11. 984 Safari Apple App
12. 961 Windows 7 Microsoft OS
13. 951 Internet Explorer Microsoft App
14. 951 Acrobat Adobe App
15. 856 Thunderbird Mozilla App
16. 818 Windows Vista Microsoft OS
17. 784 Opensuse Novell OS
18. 731 Windows Server 2012 Microsoft OS
19. 731 Windows Xp Microsoft OS
20. 698 Seamonkey Mozilla App
21. 685 Acrobat Reader Adobe App
22. 665 Windows 8.1 Microsoft OS
23. 641 Mac Os X Server Apple OS
24. 636 Windows 10 Microsoft OS
- craftyguy 8y agoThat list inconsistently splits some things by version (windows), and groups others (Debian, android, etc). What it says is that a single version of Windows had more than half as many CVEs as the entire Linux kernel has ever had. That doesn't exactly support what you are trying to convey. If you add up all windows versions, it would top the list.
- wvenable 8y agoSince Windows versions share most of their code; I wonder how many vulnerabilities on that list are counted multiple times -- once for each version. It's a terrible list one way or the other.
- benaadams 8y agoThat's because the vulns are repeated across the Windows versions, adding the versions together counts the same vuln multiple times
- deleted 8y ago[deleted]
- justwalt 8y agoI’m not sure if it’s worse to have the same vulnerability across two versions, or to have two distinct vulnerabilities.
- craftyguy 8y agoIt's almost like saying "vulnerabilities in our code exist for decades before they are noticed by anyone (with a whitehat)". Sure, that happens in open source projects too (openssl anyone?), but it seems like an exception rather than a rule. If there are so many of these multiple-version vulnerabilities in Windows that the author of the list had to specifically break Windows into individual versions, then that speaks for itself.
- dylan604 8y agois this a list of reported and as of yet still vulnerable, or is this a list of all reported vuln including ones that have been fixed?
- benaadams 8y agoFollowing the links it includes fixed vulns
- chooseaname 8y ago1/3 of that list is Windows!
- robhu 8y agoIt seems a bit strange that all the Windows kernels are in separate versions, while Linux is all bundled in to one?
- benaadams 8y agoThe vulns are reported for each version of Windows they exist in e.g. https://www.cvedetails.com/cve/CVE-2018-8307/ https://www.cvedetails.com/cve/CVE-2018-8307/
- ernesth 8y agoBy Vendor: Microsoft : 9673 Apple : 6157 Adobe : 3939 Mozilla : 3888 Linux : 2124
- bigtunacan 8y agoThat's some seriously funny counting. You added together everything by "vendor" even though the CVE count can't be summed that way since they are reported for every affected version; so you would have double, triple, quadruple counting for a single vulnerability. Then on the opposite side of the coin for Linux you left everything off except the kernel which is very misleading since it's really distros that most users need to be concerned with.
- ernesth 8y ago> You added [...] I did not, I just reported the numbers given at the bottom of benaadams' linked page.
- agnsaft 8y agoNumber of fixed vulnerabilities does not equal number of times exploited. A vulnerability may be exploited many times by many different people.