checking for vulnerabilities?

[Ryan Schmidt]

On Dec 3, 2007, at 16:54, George Georgalis wrote:

> With in my root crontab (sudo crontab -e) I run:
>  port selfupdate
>  port sync && port outdated

FYI, "selfupdate" includes "sync" so if you just did "selfupdate" you  
don't need to "sync" also; it's already been done for you.

> which is handy to identify when I need to upgrade.
> but what about when a vulnerability is known for
> which a port upgrade is not yet available? Is
> there any way to query installed ports for known
> vulnerabilities?

There is absolutely nothing in place to separately deal with  
vulnerabilities. They would be handled like any other problem with a  
port. Someone would file a ticket in Trac and assign it to the  
maintainer and the maintainer would deal with it. If the port has no  
maintainer, someone would have to notice the ticket and deal with it.  
If you're interested in seeing if there are any open issues with  
ports you use, search for the port name in Trac.