4 ms·
How can this be a 9.6 when heartbleed was a 7.5, how can it be just 0.4 below the xz thing
by mort96 2y ago
How can this be a 9.6 when heartbleed was a 7.5, how can it be just 0.4 below the xz thing
- Ekaros 2y agoBecause scores are kinda bullshit. But real answer is well if you have arbitrary remote code execution you can also read memory, where as heartbleed only read memory... And the reality is same, you were safe from heartbleed if you did not use openssl, you are safe from this if you do not use cups. CVSS score does not take into account if the software is used or not.
- mort96 2y agoI guess a part of the issue is that it was reported as a "9.9 severity vulnerability in Linux" in a bunch of places, which makes it sound incredibly severe, whereas a "9.9 severity vulnerability in CUPS" doesn't