How do you rate TPA patches' severity?
I would like to know how you rate them because when I take the example Foxit reader, which is a PDF reader so very much used, you rate the update 7.2.8 with a low severity, while when I checked that release's changelog I noticed many serious risks:
Brief |
Acknowledgement |
Fixed a security issue where the application could be exposed to the Font Parsing Use-After-Free Remote Code Execution Vulnerability. |
Mario Gomes(@NetFuzzer), working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to the Global setPersistent Use-After-Free Remote Code Execution Vulnerability. |
AbdulAziz Hariri, HPE Zero Day Initiative, working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to the WillClose Action Use-After-Free Remote Code Execution Vulnerability. |
AbdulAziz Hariri, HPE Zero Day Initiative, working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to remote code execution vulnerability when opening certain PDF file with images. |
Rocco Calvi, working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to XFA FormCalc Replace Integer Overflow Vulnerability. |
HPE Zero Day Initiative, working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to Remote Code Execution Vulnerability due to JBIG2 Out-of-Bounds Read. |
kdot, working with HP's Zero Day Initiative |
Fixed a security issue where the application could crash unexpectedly when parsing certain PDF files that contain malformed images. |
Francis Provencher, COSIG |
Fixed a security issue where the application could crash unexpectedly when converting certain image with incorrect image data. |
kdot, working with HP's Zero Day Initiative |
Fixed the Microsoft Windows Gdiplus GpRuntime::GpLock::GpLock Use-After-Free Remote Code Execution Vulnerability. |
Jaanus Kp, Clarified Security, working with HP's Zero Day Initiative |
Fixed a security issue where the application could be exposed to DLL hijacking vulnerability when trying to load xpsp2res.dll or phoneinfo.dll. |
Ke Liu of Tencent’s Xuanwu LAB |
You also rated the latest update with a low severity. I can understand that since the security issues that have been fixed in that version are not really much of a security risk, they're more stability risks for as much as I can understand from the brief descriptions. But I would like to know what kind of mechanism you're using to rate the severities of TPA patches.
I noticed that for Adobe reader for example, the severity rating is more often higher than "low". So I assume this is checked properly, or maybe Adobe rates the severity themselves like Microsoft does, which makes it easier for you to rate them correctly.
It's really important to know that they are rated correctly in order to do automated deployment properly and efficiently.