Security Advisories

#### Gaming Linux® From Scratch - Version 13.0

### Chapter 1. Welcome to GLFS

- Prev

  Conventions Used in this Book

- Next

  Change Log

- Up
- Home

# Security Advisories

## Security Vulnerabilities

A security vulnerability, or a CVE, is a flaw in source code that can be used to harm the user(s) and/or the system in use, sometimes by abusing buffer overflows to achieve privilege escalation, modifying generated build scripts to use ssh at startup, or even messing with stale memory.

There are many packages that push out updates that fix vulnerabilities, and some packages fix CVEs pretty often. GLFS will occasionally have an update that upgrades a package that fixes a CVE. It's important to always upgrade packages on your system that contain security vulnerabilities, and there is a way for checking for those updates.

## Checking for Security Updates

To check for packages that have had a CVE fixed, go to the GLFS Advisories page. It both covers broken changes and security information for each release.

You can also go to the GLFS issue page that has a filter enabled (`is:closed is:issue label:security`). All packages listed there that have the `security` label are packages that fixed a CVE in the version listed. Newer versions will be at the top of the list. When there are two versions of the same package, always go with the one that appears first in the list, or the top of it. Newer doesn't always mean safer, and it may sometimes be necessary to use an older version of a package, plus maybe a patch or two.

Take note that in the latter method, the packages listed there are issues that have already been closed and are now in the book. You can go to the open section of the page to see if there are packages there that are still having details worked out and have yet to be fixed in the book.

- Prev

  Conventions Used in this Book

- Next

  Change Log

- Up
- Home