Collecting data on vulnerabilities and exposing fragile platforms is a job that might make more than one's blood boil but that doesn't change the fact that the problems are there. 2014 was a true security chaos, with old bugs and terrible gaps in supposedly secure applications. The folks at GFI Software prepared a ranking of the most vulnerable operating systems and programs of the past year, and at the top of the list, it's not Windows...
Recently we saw up close the 'disagreement' between Google and Microsoft when it comes to reporting bugs. The Redmond giant needed a year to fix a complex vulnerability that had been in Windows for a decade and a half, and to this we must add things like Heartbleed in OpenSSL and Shellshock in Bash. From a certain point of view, it is possible to see a general deterioration in software security, and a decline in the quality of its fixes. This is reflected in the number of vulnerabilities registered in the US NVD. Last year, that number rose to 7,038, a considerable increase compared to the 4,794 vulnerabilities of 2013. But how are those seven thousand entries distributed? Which programs and operating systems have the most problems? GFI Software decided to make a list...
The first thing to highlight is that only 13 percent of vulnerabilities were attributable to an operating system. Most security holes are found in external applications, and only 4 percent can be linked to a hardware failure. The most controversial point of the study is undoubtedly the ranking of operating systems. Apple's two platforms, OS X and iOS, lead with 147 and 127 vulnerabilities, followed by the Linux kernel with 119. The rest of the entries are divided among multiple versions of Windows. I imagine many will wonder why GFI Software does not count all Windows bugs together. The main reason is that these bugs are 'shared', meaning that the same bug cannot be counted six or seven times, however, the same criterion could be applied to other systems. OS X Yosemite and Mavericks have separate support, while the Linux kernel has two mainline versions, one stable, and six longterm.
In the case of applications, web browsers take the podium. With a total of 242 vulnerabilities, Internet Explorer has a huge lead over Google Chrome with 124, and Mozilla Firefox with 117. GFI Software indicates that browsers have remained at the top for the last six years, and that both Flash Player and Java are the main opponents. However... I think GFI's work is incomplete. Android and Windows Phone do not appear in the list of operating systems, and Safari is conspicuous by its absence. Perhaps these omissions are due to the fact that they used the NVD records as the only source, but if iOS is not compared to other mobile operating systems, all they do is compare apples and oranges.
GFI Software
