Security Vulnerabilities in Third Party Code: FIX ALL THE THINGS!
summary
Third‑party libraries routinely introduce real, measurable risk: OpenSSL shows 47 publicly documented CVEs since Heartbleed with average CVSS ~5.23, FreeType ~50 CVEs (avg CVSS 7.43) including CVE‑2011‑226 (9.3), libpng appears in 130+ products, Flash ~522 CVEs (avg 8.96) and Java ~539. Practical fixes: consume NVD or vendor feeds, run static analysis, fuzzing and crash‑log mining, use scanners like BlackDuck/Palamita/Sonatype or RiskBased VDB, prioritize exploitable CVEs, and require library approval and staged rollups — a VMware case reduced surprise patches and successfully upstreamed fixes.
AI-written summary · about
chapters (7)
- 0:00Introduction and background
- 10:02Third-party libraries risks
- 23:12Real-world library vulnerabilities
- 32:31Managing library vulnerabilities
- 41:05Secure development lifecycle
- 53:01Case study VMware
- 1:00:02Q&A session
related talks
28mEpidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
49mSecurity Vulnerabilities in OpenSource Java Libraries
50mDrinking From The CVE Firehose: Or How To Ensure Your Open Source Product Survives
39mCVE 101: The Unfolding Of A Zero Day Attack
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
25mOWASP Top 10 Risks for Open Source Software
32mBuilding a secure future using DEVSECOPS practices and technologies
23mSecure Code, Safe Future: Mastering Security in Critical Software Development