Epidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
summary
Study shows third-party libraries spread single bugs across products: OpenSSL has 45 vulnerabilities and a 5.39 average CVSS with 1–6 releases/year; FreeType (CVE-2011-0226) yields remote RCE with CVSS 9.3 and appears in billions of devices; FFmpeg lists 64 vulns, average CVSS 8.35 and complex integration pain; one flaw hits 100+ vendors and 300,000 servers remain unpatched two months after Heartbleed. Practical controls are inventory your libraries, vendor security testing and incident response, track release cadence and prioritize fixes based on exploitability and pervasiveness.
AI-written summary · about
chapters (3)
- 0:00EPIDEMIOLOGY OF SOFTWARE VULNERABILITIES: A STUDY OF ATTACK SURFACE SPREAD
- 4:11Third-Party Libraries To The Rescue • Developers using established third-party libraries to - Speed up the development process - Realize quality improvements over creating an in- house proprietary solution from the ground up.
- 21:07Money That's What We Need! Many projects are not well funded or resourced Bug bounty programs - Crowd source more eye on critical software or websites Code audit initiatives - TrueCrypt
related talks
01h 04mSecurity Vulnerabilities in Third Party Code: FIX ALL THE THINGS!
50mDrinking From The CVE Firehose: Or How To Ensure Your Open Source Product Survives
39mCVE 101: The Unfolding Of A Zero Day Attack
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
38mApplication Security in the age of Open Source
39mOpen source security: who’s responsible?
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026