The value of a vulnerability is linked to its usefulness in accomplishing the goals held by those paying for the exploit. Based on that information, it should b

The value of a vulnerability is linked to its usefulness in accomplishing the goals held by those paying for the exploit. Based on that information, it should become obvious that the only bugs worth large sums of money are bugs that result in escalated privileges on the system or arbitrary code execution. Bugs that crash services also have value for DDoS attacks, but they're not as valuable as the two previously mentioned types. While 1.2k bugs sounds like a lot, we can't make an inference about the severity of the bugs based solely on the number of them. Also keep in mind that the Debian repository contains thousands of packages. From the Debian 7.0 Wheezy release page: "* more than 36,000 other ready-to-use software packages, built from nearly 17,500 source packages" http://www.debian.org/News/2013/20130504 http://www.debian.org/News/2013/20130504 The best we can infer that given 1.2k bugs, there is some statistical probability that any number of them may be severe. Without studying the data, we can't say what that probability might be though.