Fink

Security Policy - 3. Incident Sources

3.1 Acceptable Incident Sources.

As submitter of a security incident in Fink-packaged software you have to ensure that the vulnerability of the software also exists on Mac OS X. It is the responsibility of the notifying party to ensure that one of the following sources reinforces the reported issue for the particular software in question.

  1. AIXAPAR: AIX APAR (Authorised Problem Analysis Report)
  2. APPLE: Apple Security Update
  3. ATSTAKE: @stake security advisory
  4. AUSCERT: AUSCERT advisory
  5. BID: Security Focus Bugtraq ID database entry
  6. BINDVIEW: BindView security advisory
  7. BUGTRAQ: Posting to Bugtraq mailing list
  8. CALDERA: Caldera security advisory
  9. CERT: CERT/CC Advisories
  10. CERT-VN: CERT/CC vulnerability note
  11. CIAC: DOE CIAC (Computer Incident Advisory Center) bulletins
  12. CONECTIVA: Conectiva Linux advisory
  13. CONFIRM: URL to location where vendor confirms that the problem exists
  14. DEBIAN: Debian Linux Security Information
  15. EEYE: eEye security advisory
  16. EL8: EL8 advisory
  17. ENGARDE: En Garde Linux advisory
  18. FEDORA: Fedora Project security advisory
  19. FULLDISC: Full-Disclosure mailing list
  20. FreeBSD: FreeBSD security advisory
  21. GENTOO: Gentoo Linux security advisory
  22. HERT: HERT security advisory
  23. HP: HP security advisories
  24. IBM: IBM ERS/BRS advisories
  25. IMMUNIX: Immunix Linux advisory
  26. INFOWAR: INFOWAR security advisory
  27. ISS: ISS Security Advisory
  28. KSRT: KSR[T] Security Advisory
  29. L0PHT: L0pht Security Advisory
  30. MANDRAKE: Linux-Mandrake advisory
  31. MISC: generic reference from an URL
  32. MLIST: generic reference form for miscellaneous mailing lists
  33. NAI: NAI Labs security advisory
  34. NETECT: Netect security advisory
  35. NetBSD: NetBSD Security Advisory
  36. OPENBSD: OpenBSD Security Advisory
  37. REDHAT: Security advisories
  38. RSI: Repent Security, Inc. security advisory
  39. SEKURE: Sekure security advisory
  40. SF-INCIDENTS: posting to Security Focus Incidents mailing list
  41. SGI: SGI Security Advisory
  42. SLACKWARE: Slackware security advisory
  43. SNI: Secure Networks, Inc. security advisory
  44. SUN: Sun security bulletin
  45. SUNALERT: Sun security alert
  46. SUNBUG: Sun bug ID
  47. SUSE: SuSE Linux: Security Announcements
  48. TRUSTIX: Trustix Security Advisory
  49. TURBO: TurboLinux advisory
  50. VULN-DEV: Posting to VULN-DEV mailing list
  51. VULNWATCH: VulnWatch mailing list
  52. XF: X-Force Vulnerability Database
  53. CVE: CVE Candidates

The above keywords are in full compliance with the CVE recommended keyword list found here.

Next: 4. Security update procedure.