Bug#508031: Tracking vulnerabilities that have already been patched in other distributions

["Richard Hartmann" <richih.mailinglist@gmail.com>]

On Mon, Dec 8, 2008 at 09:32, Nico Golde <nion@debian.org> wrote:

> I think your imagination of the process is way to easy,
> it's more than reading and directly editing the tracker, the
> same process like the one for new CVE ids apply, checking if
> the package is in Debian, if not checking if there is an itp
> or if it's NFU,

Can be done with a script of a few lines (unless the whole
thing has been renamed).


> check other packages embedding this source
> code,

Should be do-able with a few more lines, but will probably
need manual verification.


> check other packages having similar code...

Needs manual verification & work.


Yet, none of these speak against a pointer of the fix already
being available once the above steps have been finished. And
that is what Michael is offering.
It will certainly not make every issue disappear magically. But
it may help in quite a few cases.


Richard