Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Just a couple quick questions. Hope a couple wise owls might be able to answer ; )

I used to apply updates through the terminal without any care, since I don't use any ppa's or use any untrusted apps but lately I became interested in Ubuntu bugs, their fixes and most importantly the changes that would be made to my system. So, I found it easier to use the 'Update Manager' so I could use the link in the 'Changes' section to access the 'launchpad' page that discusses these issues.

Today when prompted for some specific updates, instead of being directed to a 'launchpad' page that I was accustomed to, I was directed to an unknown 'mitre.org' page.

Screenshots:

Update Manager - Changes

Mitre

I've searched the askubuntu site, as well as others, yet I've only found 1 thread that can come close to answering my questions. It was marked as [SOLVED], yet the OP's original question was never answered.

http://ubuntuforums.org/showthread.php?t=1586903&s=e92cb71ffd1f1299c25cb407f5a4ff6e

So to my questions...

What are CVE security updates and who issues them?

Why am I directed to an unknown website (to me anyways), that is funded by a government agency (look closely on the bottom of the 'Mitre' screenshot), when inquiring about the aforementioned updates?

share|improve this question
    
The CVE and MITRE tags don't exist, hence why you couldn't create them because you don't have the rep. I would suggest you select one of the answers below as "accepted" as otherwise this question will remain open. I created a Community Wiki'd answer that takes both parts of my answer and Henning's answer, if you would like to choose an answer that answers both parts of your question. –  Thomas W. Sep 20 '13 at 17:39
    
Thanks @ThomasW. Wasn't sure on which answer I should mark as best. As well, forgot to say thanks to the both of you for your time. –  Dave.M. Sep 22 '13 at 22:11
    
Any time! I noticed you had the two separate questions anyways, so by combining both answers you can still upvote both mine and Henning's answers, and still accept a question that answers both parts of your questions. :) –  Thomas W. Sep 23 '13 at 1:49

3 Answers 3

up vote 0 down vote accepted

This answer is a combination of the two answers the original poster said helped them. They answer both parts of the questions asked by the asker. This answer was created so they could accept an answer that has both parts.


"CVE" stands for "Common Vulnerabilities and Exposures". It is an industry standard for the notation, especially for the naming, of security vulnerabilities. The list of CVEs ist maintained by the MITRE Corporation. This non-profit company has been branched of the Massachusetts Institute of Technology (MIT) as a service for US research institutions. For more information, see CVE and MITRE Corporation on Wikipedia.

(originally by Henning Kockerbeck)


Fixes for CVEs are either fixed upstream by the developers of a given program and then are either SRU'd (Stable Release Update) or uploaded to the latest development release of Ubuntu by either the developers of the upstream program, the Ubuntu Security Team, or are uploaded when sponsored by a member of the security team if the community helped to develop the patch for the package.

For programs that are in Main, and maintained by the developers for Canonical, the Ubuntu Security Team will typically update a package and place it in the RELEASE-security repository (where RELEASE is precise, quantal, raring, etc.).

For programs that are in Universe, those are typically community maintained, and anyone in the community can prepare an SRU or a patch to include the CVE fixes. Those fixes are then sponsored by the Security Team for uploading and inclusion into Ubuntu.

(originally by Thomas W.)

share|improve this answer

"CVE" stands for "Common Vulnerabilities and Exposures", explained in Henning Kockerbeck's answer here.

Fixes for CVEs are either fixed upstream by the developers of a given program and then are either SRU'd (Stable Release Update) or uploaded to the latest development release of Ubuntu by either the developers of the upstream program, the Ubuntu Security Team, or are uploaded when sponsored by a member of the security team if the community helped to develop the patch for the package.

For programs that are in Main, and maintained by the developers for Canonical, the Ubuntu Security Team will typically update a package and place it in the RELEASE-security repository (where RELEASE is precise, quantal, raring, etc.).

For programs that are in Universe, those are typically community maintained, and anyone in the community can prepare an SRU or a patch to include the CVE fixes. Those fixes are then sponsored by the Security Team for uploading and inclusion into Ubuntu.

share|improve this answer
    
That answers my concern on who is issuing the updates. –  Dave.M. Sep 20 '13 at 13:43

"CVE" stands for "Common Vulnerabilities and Exposures". It is an industry standard for the notation, especially for the naming, of security vulnerabilities. The list of CVEs ist maintained by the MITRE Corporation. This non-profit company has been branched of the Massachusetts Institute of Technology (MIT) as a service for US research institutions. For more information, see CVE and MITRE Corporation on Wikipedia.

share|improve this answer
    
Your answer and the links provided, certainly answered my question on what CVE is.For a "not-for-profit" organization, they sure can generate revenue. –  Dave.M. Sep 20 '13 at 13:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.