Re: CVE Information Sources & Scope

["Steven M. Christey" <coley@rcf-smtp.mitre.org>]

On Tue, 4 Oct 2011, Adam Shostack wrote:

> ?  Solaris  (Isn't Solaris now part of Oracle, a CNA?)

Yes, though it seems that Solaris issues are covered both in Oracle CPUs 
(sometimes), and a separate blog which includes multiple-OS issues that 
aren't covered in the CPUs (usually the blog-announced ones are just added 
to existing CVEs, but we might only see them through "patch-oriented" VDBs 
like Secunia.)

- Steve