Doesn't that make the mere act of updating a newly installed Linux instance unsafe, since the initially installed package manager is vulnerable? Am I missing something?
For example, the current Ubuntu 15.10 image dates 21 Oct (http://releases.ubuntu.com/15.10) and the Fedora 23 image dates 30 Oct (http://mirror.cc.vt.edu/pub/fedora/linux/releases/23/Workstation/x86_64/iso). Why is that?
This Ubuntu security advisory says that the 15.10 release is affected: http://www.ubuntu.com/usn/usn-2900-1, but the install image doesn't seem to have been updated ever since it was first released.
My concern is this: as far as I have understood, any application that uses glibc to perform DNS queries is vulnerable, the package manager has to perform DNS queries to find mirrors and runs as root, and the vulnerability has already been known for a while.
Do apt and RPM use a different library for performing their DNS queries, or are there some defenses in place to prevent this vulnerability from being exploited?
Is it that the distros' security teams simply can't cope with the amount of vulnerabilities discovered every day, i.e. "Using a computer? Expect trojans/rootkits!" is the reality of computer security that has to be accepted?