Looks like the news isn't good. If your software has been running everywhere for the past 20 years, you have a terrible responsibility to own and fix your bugs instead of using various excuses to explain to whoever reported them how wrong they are, even if they provide one PoC after another and proves his assumptions in a software. This particular one is extremely bad for the Linux community and Open Source in general.
It was discovered a critical unauthenticated remote code execution vulnerability (RCE from unauthenticated Remote Code Execution), which affects all GNU/Linux systems.
According to the developers, the flaw, which has existed for over a decade, will be fully disclosed in less than two weeks.
Despite the seriousness of the issue, no vulnerability identifiers (CVEs from Common Vulnerabilities and Exposures) have yet been assigned, and experts say there should be at least three to six.
Leading Linux distributions such as Canonical and RedHat have confirmed the severity of the flaw, rating it 9,9 out of 10.
This shows that some expoit could cause very serious damage.
However, despite this admission, there is still no working fix available. The developers they are still discussing the problem whether certain aspects of this vulnerability affect security.
Always right useful information