Does Ubuntu generally post timely security updates?
- by Jo Liss
Concrete issue: The Oneiric nginx package is at version 1.0.5-1, released in July 2011 according to the changelog.
The recent memory-disclosure vulnerability (advisory page, CVE-2012-1180, DSA-2434-1) isn't fixed in 1.0.5-1. If I'm not misreading the Ubuntu CVE page, all Ubuntu versions seem to ship a vulnerable nginx.
Is this true?
If so: I…