CVE-2015-5185 lists two particular versions, "1.3.4 and 1.3.18" as being vulnerable. If I use 1.3.11, what's the next action for determining vulnerability?

I think this question is partially about convention. Would a CVE author specify two particular versions like this to indicate an "if and only if" relationship, or a "if, and possibly others" relationship?

1 Answer 1


The researcher may only have been able to test those two versions, there isn't much point in speculating. Depending on which distro you use the patch may have been back ported without a change in version numbers.

The next step is to make sure you use the latest version supported by your distro and check their change logs for the package to see if it has been patched. If you want to verify the patch as effective you would have to attempt exploitation. As there is no readily public exploit you can use to test you would have to invest time to try to develop a poc or reverse engineer the patch.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .