CVE writers make me cry sometimes. The original advisory is incredibly light on details, like, what software actually has the bug. The CVEs themselves also fail to adequately describe <i>what</i> is vulnerable. E.g., CVE-2019-9516 “0-Length Headers Leak”, the CVE implicates "Ubuntu". Ubuntu (probably) can't be vulnerable to this CVE, some piece of software <i>on</i> Ubuntu must be; and indeed clicking through to the USN shows that it's nginx. But then, why only single out Ubuntu, Debian and Fedora? Surely the others are equally vulnerable?<p>It was the same way w/ the recent VLC vuln. where the researcher just kinda dumped an ASan output into a bug tracker and "I has a working exploit" and <i>no additional details</i>.