Patchwire CVEs, their patch status, and feeds to follow them

Time to fix by vendor

The median number of days from the publication of a CVE to its first fixed package in Debian (DSA, DLA) or Ubuntu (USN), for the CVEs of each vendor. These advisories carry the true day of the fixed package. A fix before the publication, as after an embargo, counts as 0 days. The 25 vendors with the most dated fixes are below.

Median days from disclosure to the first fix, by vendorLinux: median 52 days over 9816 CVEsLinux52 dGoogle: median 0 days over 2138 CVEsGoogle0 dSiemens: median 32 days over 1960 CVEsSiemens32 dMozilla: median 0 days over 1360 CVEsMozilla0 dOracle Corporation: median 12 days over 1094 CVEsOracle Corporation12 dRed Hat: median 21 days over 1026 CVEsRed Hat21 dApple: median 9 days over 403 CVEsApple9 dApache Software Foundation: median 14 days over 347 CVEsApache Software Foundation14 dvim: median 44 days over 206 CVEsvim44 dFreeRDP: median 33 days over 152 CVEsFreeRDP33 dOpenSSL: median 0 days over 123 CVEsOpenSSL0 dMicrosoft: median 2 days over 114 CVEsMicrosoft2 dimagemagick: median 13 days over 108 CVEsimagemagick13 dISC: median 0 days over 102 CVEsISC0 dCanonical: median 0 days over 95 CVEsCanonical0 dPHP Group: median 5 days over 94 CVEsPHP Group5 dGTKWave: median 86 days over 82 CVEsGTKWave86 dXen: median 12 days over 79 CVEsXen12 dCURL: median 0 days over 74 CVEsCURL0 dWireshark Foundation: median 33 days over 71 CVEsWireshark Foundation33 dGNU: median 40 days over 65 CVEsGNU40 dGStreamer: median 7 days over 59 CVEsGStreamer7 dGo standard library: median 125 days over 59 CVEsGo standard library125 dFedora: median 24 days over 57 CVEsFedora24 dNodeJS: median 56 days over 57 CVEsNodeJS56 d

Table

VendorMedian daysCVEs with a dated fix
Linux529816
Google02138
Siemens321960
Mozilla01360
Oracle Corporation121094
Red Hat211026
Apple9403
Apache Software Foundation14347
vim44206
FreeRDP33152
OpenSSL0123
Microsoft2114
imagemagick13108
ISC0102
Canonical095
PHP Group594
GTKWave8682
Xen1279
CURL074
Wireshark Foundation3371
GNU4065
GStreamer759
Go standard library12559
Fedora2457
NodeJS5657