Alexander Gromnitsky's Blog<br>:: 2026-07-30<br>:: Debian CVE fixes over time

Debian CVE fixes over time

Latest update: 2026-07-30 11:36:22

For each version, starting with 9 (2017), Debian provides a big<br>ChangeLog file that lists fixes included in periodic updates. If one<br>looks at the changelog for the current release (13), the number of CVE<br>mentions may astonish an unsuspecting reader.

While I wasn't going to waste space here explaining the obvious reason<br>for such an explosion, I got curious about how it had changed over<br>time.

If we extract CVE names & group them by the dates on which they appear<br>in a file, like, for example, in v9:

2017-07-22 44<br>2017-10-07 348<br>2017-12-09 301<br>2018-03-10 280<br>2018-07-14 331<br>2018-11-10 766<br>2019-02-16 206<br>2019-04-27 214<br>2019-09-07 250<br>2020-02-08 424<br>2020-07-18 434

& do the same for all subsequent Debian versions, we get a quite<br>expected, but still dreadful, picture nevertheless:

(An archive with the data & scripts: debian-cve.tar.xz.)

Tags: ойті

Authors: ag