What do statuses of Ubuntu and Debian security trackers mean exactly in plain of definitely vulnerable\definitely not vulnerable\unknown?

I have found this answer How to read CVE - 2016 - 5696 correctly about ubuntu tracker, but its missing the "deferred" status.

I could not find any documentation about any statuses of debian security tracker.


1 Answer 1


I found this in a README from the link that schroeder referenced

deferred    The package (for the given release) is vulnerable, the problem
        is understood, but has been deferred for some reason. The
        "notes" need to explain further. If a date was specified eg
        "deferred (2012-01-01)" the date indicates the date the CVE
        was put in the deferred state.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .