anchor.diff: -project_name,debian_source,debian_version,debian_desc,debian_home,CVE_since_2010,CVE_page,openhub_page,openhub_name,openhub_desc,openhub_home,openhub_download,twelve_month_contributor_count,total_contributor_count,total_code_lines,main_language_name,licenses,fact_activity,fact_age,fact_comments,fact_team_size,package_popularity,implemented_in,role,direct_network_exposure,process_network_data,potential_privilege_escalation,risk_index(max = 16),risk_index components,comment_on_priority
  -libexpat1,expat,2.1.0-1+deb7u1,XML parsing C library - runtime library,http://expat.sourceforge.net,5,https://security-tracker.debian.org/tracker/source-package/expat,https://www.openhub.net/projects/expat,Expat XML Parser,"Expat is a fast, non-validating, stream-oriented XML parsing library.",http://expat.sourceforge.net,http://sourceforge.net/project/showfiles.php?group_id=10127,0,10,22710,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,153025,c,shared-lib,0,1,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Parses potentially-dangerous data. This is an XML parser library written in C. Maintenance appears to have effectively halted after its 2012 release. Project at: http://www.libexpat.org/ (It was at, http://expat.sourceforge.net/ and its movement is not obvious, so some may be using an older version; this was follow-on from James Clark's original Expat). On 24 March 2012 Expat 2.1.0 released, it includes security vulnerability fixes for 5 CVEs; Previous release was 2007. ""Bug reports"" produces error page - tracking does not seem to work.  No public mailing list. CVS browsing suggests little or no activity after 2012 (and little before that). Many systems build on top of this library. Note that this doesn't support XML 1.1. +++"
  -procmail,,3.22-20+deb7u1,Versatile e-mail processor,http://www.procmail.org/,2,https://security-tracker.debian.org/tracker/source-package/procmail,https://www.openhub.net/projects/8853,procmail,"Procmail can be used to create mail-servers, mailing lists, sort your incoming mail into separate folders/files (real convenient when subscribing to one or more mailing lists or for prioritising your mail), preprocess your mail, start any programs upon mail arrival (e.g. to generate different chimes on your workstation for different types of mail) or selectively forward certain incoming mail automatically to someone.",http://www.procmail.org/,http://www.procmail.org/,0,4,15536,C,artistic gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,133372,c,program,1,0,0,12,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Processes email passed in, so it does process untrusted data from the network."
  -unzip,,6.0-8,De-archiver for .zip files,http://www.info-zip.org/UnZip.html,5,https://security-tracker.debian.org/tracker/source-package/unzip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,119577,c,program,0,1,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Download Binaries, NO issue tracker. +++"
  +project_name,debian_source,debian_version,debian_desc,debian_home,CVE_since_2010,CVE_page,openhub_page,openhub_name,openhub_desc,openhub_home,openhub_download,twelve_month_contributor_count,total_contributor_count,total_code_lines,main_language_name,licenses,fact_activity,fact_age,fact_comments,fact_team_size,package_popularity,implemented_in,role,direct_network_exposure,process_network_data,potential_privilege_escalation,risk_index(max = 15),risk_index components,comment_on_priority
  +libexpat1,expat,2.1.0-1+deb7u1,XML parsing C library - runtime library,http://expat.sourceforge.net,5,https://security-tracker.debian.org/tracker/source-package/expat,https://www.openhub.net/projects/expat,Expat XML Parser,"Expat is a fast, non-validating, stream-oriented XML parsing library.",http://expat.sourceforge.net,http://sourceforge.net/project/showfiles.php?group_id=10127,0,10,22710,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,174625,c,shared-lib,0,1,0,13,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Parses potentially-dangerous data. This is an XML parser library written in C. Maintenance appears to have effectively halted after its 2012 release. Project at: http://www.libexpat.org/ (It was at, http://expat.sourceforge.net/ and its movement is not obvious, so some may be using an older version; this was follow-on from James Clark's original Expat). On 24 March 2012 Expat 2.1.0 released, it includes security vulnerability fixes for 5 CVEs; Previous release was 2007. ""Bug reports"" produces error page - tracking does not seem to work.  No public mailing list. CVS browsing suggests little or no activity after 2012 (and little before that). Many systems build on top of this library. Note that this doesn't support XML 1.1. +++"
  +procmail,,3.22-20+deb7u1,Versatile e-mail processor,http://www.procmail.org/,2,https://security-tracker.debian.org/tracker/source-package/procmail,https://www.openhub.net/projects/8853,procmail,"Procmail can be used to create mail-servers, mailing lists, sort your incoming mail into separate folders/files (real convenient when subscribing to one or more mailing lists or for prioritising your mail), preprocess your mail, start any programs upon mail arrival (e.g. to generate different chimes on your workstation for different types of mail) or selectively forward certain incoming mail automatically to someone.",http://www.procmail.org/,http://www.procmail.org/,0,4,15536,C,artistic gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,153379,c,program,1,0,0,13,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Processes email passed in, so it does process untrusted data from the network."
  +unzip,,6.0-8,De-archiver for .zip files,http://www.info-zip.org/UnZip.html,5,https://security-tracker.debian.org/tracker/source-package/unzip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,137931,c,program,0,1,0,13,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Download Binaries, NO issue tracker. +++"
   bsd-mailx,,8.1.2-0.20111106cvs-1,simple mail user agent,,1,https://security-tracker.debian.org/tracker/source-package/bsd-mailx,https://www.openhub.net/projects/nail,mailx,"Heirloom mailx (previously known as nail) is a mail user agent (MUA) for Unix systems. 
   
   Highlights are:
   
       * Derived from Berkeley Mail 8.1. An interface like the original Berkeley one is still optionally available.
   
  -    * Is a free implementation of the System V mailx command and features an interface like that by default.",http://heirloom.sourceforge.net/mailx.html,http://sourceforge.net/project/showfiles.php?group_id=106236&package_id=182246,0,1,29957,C,BSD-3-Clause common_development_and_distribution gpl lgpl zlib_libpng,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,131188,c,program,1,0,0,11,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This does take data from untrusted sources, but many systems won't actively use it (there are many mail clients)."
  -libc-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,147399,c,program,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libc-dev-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,97940,c,program,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libc6,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Shared libraries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,153844,c,shared-lib,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libc6-dev,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development Libraries and Header Files,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,101621,c,devel-lib,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libpcre3,pcre3,1:8.30-5,Perl 5 Compatible Regular Expression Library - runtime files,,6,https://security-tracker.debian.org/tracker/source-package/pcre3,https://www.openhub.net/projects/pcre,PCRE,"The PCRE (Perl Compatible Regular Expressions) library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE has its own native API, as well as a set of wrapper functions that correspond to the POSIX regular expression API. The PCRE library is free, even for building commercial software.",http://www.pcre.org/,,2,4,96755,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,153063,c,shared-lib,0,1,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++"
  -locales,eglibc,2.13-38+deb7u6,Embedded GNU C Library: National Language (locale) data [support],http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,152762,c,program,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -multiarch-support,eglibc,2.13-38+deb7u6,Transitional package to ensure multiarch compatibility,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,128499,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libjpeg8,,8d-1+deb7u1,Independent JPEG Group's JPEG runtime library,,2,https://security-tracker.debian.org/tracker/source-package/libjpeg8,https://www.openhub.net/projects/libjpeg,libjpeg,A widely used free library for JPEG image compression.,http://www.ijg.org,http://www.ijg.org,0,5,58006,C,IJG,Stable Y-O-Y development activity,Well-established codebase,Very well-commented source code,No recent development activity,80870,c,shared-lib,0,1,0,11,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++"
  -postfix,,2.9.6-2,High-performance mail transport agent,http://www.postfix.org,3,https://security-tracker.debian.org/tracker/source-package/postfix,https://www.openhub.net/projects/postfix,Postfix,"Postfix is Wietse Venema's mailer that started life as an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users. Thus, the outside has a sendmail-ish flavor, but the inside is completely different.",http://www.postfix.org/,http://www.postfix.org/download.html,2,3,217169,C,ibm_public,Stable Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,29166,c,program,1,0,0,11,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is a widely-used mail transfer agent (MTA).
  -Postfix was created by Wietse Venema, main site www.postfix.org.  On February 8, 2015 Postfix released 3.0.0, so currently active.  Developer mailing list postfix-devel has activity. (e.g., http://news.gmane.org/gmane.mail.postfix.devel/cutoff=2948).  There is no public repo; Wietse (the lead developer) does not want to allow any external review before formal release, as noted in https://groups.google.com/forum/#!topic/mailing.postfix.users/6Kkel3J_nv4 (The Debian package may be an obsolete fork; the Debian package has been assembled by LaMont Jones from sources available from http://www.postfix.org, and can be cloned from git via: git clone git://git.debian.org/~lamont/postfix.git.  Changes on http://anonscm.debian.org/cgit/users/lamont/postfix.git/log/ in git stop in 2011.) ++"
  -rsync,,3.0.9-4,"fast, versatile, remote (and local) file-copying tool",http://rsync.samba.org/,3,https://security-tracker.debian.org/tracker/source-package/rsync,https://www.openhub.net/projects/rsync,rsync,rsync is an open source utility that provides fast incremental file transfer.,http://samba.anu.edu.au/rsync/,,3,15,48806,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,92701,c,program,1,0,0,11,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  -acpi-support-base,acpi-support,0.140-5+deb7u3,scripts for handling base ACPI events such as the power button,,2,https://security-tracker.debian.org/tracker/source-package/acpi-support,https://www.openhub.net/projects/acpi-support,acpi-support,,,,0,24,228,shell script,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,139659,shell,program,0,0,1,10,"Website points: 1, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 0, Exposure: 1 , Data only: 0",
  -acpid,,1:2.0.16-1+deb7u1,Advanced Configuration and Power Interface event daemon,http://www.tedfelix.com/linux/acpid-netlink.html,3,https://security-tracker.debian.org/tracker/source-package/acpid,https://www.openhub.net/projects/acpid,ACPI Daemon,"ACPID is a completely flexible, totally extensible daemon for delivering ACPI events. It listens on netlink interface (or on the deprecated file /proc/acpi/event), and when an event occurs, executes programs to handle the event.",http://sourceforge.net/projects/acpid2/,,2,6,4787,C,GNU_General_Public_License_v2_0_only,Decreasing Y-O-Y development activity,Well-established codebase,Well-commented source code,Small development team,144163,c,program,0,0,1,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Provides data on local hardware. Conceivably might allow local raise in privilege.
  +    * Is a free implementation of the System V mailx command and features an interface like that by default.",http://heirloom.sourceforge.net/mailx.html,http://sourceforge.net/project/showfiles.php?group_id=106236&package_id=182246,0,1,29957,C,BSD-3-Clause common_development_and_distribution gpl lgpl zlib_libpng,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,151075,c,program,1,0,0,12,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","This does take data from untrusted sources, but many systems won't actively use it (there are many mail clients)."
  +libc-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,168914,c,program,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libc-dev-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,110459,c,program,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libc6,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Shared libraries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,175713,c,shared-lib,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libc6-dev,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development Libraries and Header Files,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,114278,c,devel-lib,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libjpeg8,,8d-1+deb7u1,Independent JPEG Group's JPEG runtime library,,2,https://security-tracker.debian.org/tracker/source-package/libjpeg8,https://www.openhub.net/projects/libjpeg,libjpeg,A widely used free library for JPEG image compression.,http://www.ijg.org,http://www.ijg.org,0,5,58006,C,IJG,Stable Y-O-Y development activity,Well-established codebase,Very well-commented source code,No recent development activity,89506,c,shared-lib,0,1,0,12,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++"
  +libpcre3,pcre3,1:8.30-5,Perl 5 Compatible Regular Expression Library - runtime files,,6,https://security-tracker.debian.org/tracker/source-package/pcre3,https://www.openhub.net/projects/pcre,PCRE,"The PCRE (Perl Compatible Regular Expressions) library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE has its own native API, as well as a set of wrapper functions that correspond to the POSIX regular expression API. The PCRE library is free, even for building commercial software.",http://www.pcre.org/,,2,4,96755,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,174907,c,shared-lib,0,1,0,12,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++"
  +locales,eglibc,2.13-38+deb7u6,Embedded GNU C Library: National Language (locale) data [support],http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,174513,c,program,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +multiarch-support,eglibc,2.13-38+deb7u6,Transitional package to ensure multiarch compatibility,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,148819,,,0,0,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +rsync,,3.0.9-4,"fast, versatile, remote (and local) file-copying tool",http://rsync.samba.org/,3,https://security-tracker.debian.org/tracker/source-package/rsync,https://www.openhub.net/projects/rsync,rsync,rsync is an open source utility that provides fast incremental file transfer.,http://samba.anu.edu.au/rsync/,,3,15,48806,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,102393,c,program,1,0,0,12,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",
  +acpi-support-base,acpi-support,0.140-5+deb7u3,scripts for handling base ACPI events such as the power button,,2,https://security-tracker.debian.org/tracker/source-package/acpi-support,https://www.openhub.net/projects/acpi-support,acpi-support,,,,0,24,228,shell script,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,160013,shell,program,0,0,1,11,"Website points: 1, CVE: 2, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 1 , Data only: 0",
  +acpid,,1:2.0.16-1+deb7u1,Advanced Configuration and Power Interface event daemon,http://www.tedfelix.com/linux/acpid-netlink.html,3,https://security-tracker.debian.org/tracker/source-package/acpid,https://www.openhub.net/projects/acpid,ACPI Daemon,"ACPID is a completely flexible, totally extensible daemon for delivering ACPI events. It listens on netlink interface (or on the deprecated file /proc/acpi/event), and when an event occurs, executes programs to handle the event.",http://sourceforge.net/projects/acpid2/,,2,6,4787,C,GNU_General_Public_License_v2_0_only,Decreasing Y-O-Y development activity,Well-established codebase,Well-commented source code,Small development team,164723,c,program,0,0,1,11,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Provides data on local hardware. Conceivably might allow local raise in privilege.
   bash,,4.2+dfsg-0.1+deb7u3,GNU Bourne Again SHell,http://tiswww.case.edu/php/chet/bash/bashtop.html,8,https://security-tracker.debian.org/tracker/source-package/bash,https://www.openhub.net/projects/bash,Bash,"Bash is an sh-compatible command language interpreter that executes commands read from the standard input or from a file.  Bash also incorporates useful features from the Korn and C shells (ksh and csh).
   
  -Bash is ultimately intended to be a conformant implementation of the IEEE POSIX Shell and Tools specification (IEEE Working Group 1003.2).",http://www.gnu.org/software/bash/,http://ftp.gnu.org/gnu/bash/,1,2,175812,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,153953,c,program,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -cpio,,2.11+dfsg-0.1,GNU cpio -- a program to manage archives of files,http://www.gnu.org/software/cpio/,3,https://security-tracker.debian.org/tracker/source-package/cpio,https://www.openhub.net/projects/cpio,GNU cpio,GNU cpio is an archiver program that handles cpio and tar archives.,http://savannah.gnu.org/projects/cpio/,,1,5,6843,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,153841,c,program,0,1,0,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Decompression software. Isolated cpio format uncommon today, but RPMs are based on it."
  +Bash is ultimately intended to be a conformant implementation of the IEEE POSIX Shell and Tools specification (IEEE Working Group 1003.2).",http://www.gnu.org/software/bash/,http://ftp.gnu.org/gnu/bash/,1,2,175812,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,175842,c,program,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +cpio,,2.11+dfsg-0.1,GNU cpio -- a program to manage archives of files,http://www.gnu.org/software/cpio/,3,https://security-tracker.debian.org/tracker/source-package/cpio,https://www.openhub.net/projects/cpio,GNU cpio,GNU cpio is an archiver program that handles cpio and tar archives.,http://savannah.gnu.org/projects/cpio/,,1,5,6843,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,175720,c,program,0,1,0,11,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Decompression software. Isolated cpio format uncommon today, but RPMs are based on it."
   file,,5.11-2+deb7u6,"Determines file type using ""magic"" numbers",http://www.darwinsys.com/file/,24,https://security-tracker.debian.org/tracker/source-package/file,https://www.openhub.net/projects/file,file,"File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. The first test that succeeds causes the file type to be printed.
  -Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,151465,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  -libcap2,,1:2.22-1.2,support for getting/setting POSIX.1e capabilities,http://sites.google.com/site/fullycapable/,1,https://security-tracker.debian.org/tracker/source-package/libcap2,https://www.openhub.net/projects/libcap,libcap,libcap implements the user-space interfaces to the POSIX 1003.1e capabilities available in Linux kernels. These capabilities are a partitioning of the all powerful root privilege into a set of distinct privileges.,https://sites.google.com/site/fullycapable/,,0,19,3461,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,151247,c,shared-lib,0,0,1,10,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Implemented by kernel.  Less likely to have issues here.
  -libfuse2,fuse,2.9.0-2+deb7u1,Filesystem in Userspace (library),http://fuse.sourceforge.net/,6,https://security-tracker.debian.org/tracker/source-package/fuse,https://www.openhub.net/projects/fuse,FUSE,Filesystem in Userspace is a simple interface for userspace programs to export a virtual filesystem to the Linux kernel. It also aims to provide a secure method for non privileged users to create and mount their own filesystem implementations.,http://fuse.sourceforge.net,,2,44,33588,C,gpl lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,133468,c,shared-lib,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,173048,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libcap2,,1:2.22-1.2,support for getting/setting POSIX.1e capabilities,http://sites.google.com/site/fullycapable/,1,https://security-tracker.debian.org/tracker/source-package/libcap2,https://www.openhub.net/projects/libcap,libcap,libcap implements the user-space interfaces to the POSIX 1003.1e capabilities available in Linux kernels. These capabilities are a partitioning of the all powerful root privilege into a set of distinct privileges.,https://sites.google.com/site/fullycapable/,,0,19,3461,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,173018,c,shared-lib,0,0,1,11,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Implemented by kernel.  Less likely to have issues here.
  +libfuse2,fuse,2.9.0-2+deb7u1,Filesystem in Userspace (library),http://fuse.sourceforge.net/,6,https://security-tracker.debian.org/tracker/source-package/fuse,https://www.openhub.net/projects/fuse,FUSE,Filesystem in Userspace is a simple interface for userspace programs to export a virtual filesystem to the Linux kernel. It also aims to provide a secure method for non privileged users to create and mount their own filesystem implementations.,http://fuse.sourceforge.net,,2,44,33588,C,gpl lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,154195,c,shared-lib,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
   libmagic1,file,5.11-2+deb7u6,"File type determination library using ""magic"" numbers",http://www.darwinsys.com/file/,24,https://security-tracker.debian.org/tracker/source-package/file,https://www.openhub.net/projects/file,file,"File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. The first test that succeeds causes the file type to be printed.
  -Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,152165,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,173808,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
   libxau6,libxau,1:1.0.7-1,X11 authorisation library,,0,https://security-tracker.debian.org/tracker/source-package/libxau,https://www.openhub.net/projects/xauthxx,xauthxx,"DescriptionXauth++ provides a C++ interface to Xauthority by wrapping libXau. 
   
   FeaturesXauthority file I/O Automatic generation of MIT Magic Cookies Easy-to-use object-oriented API LicensingAll source files are distributed under the GNU LGPL except the example file, testxauth.cc, which is distributed under the GNU GPL. 
  
positive.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",91824,,app-data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 0 , Data only: -3",
  tasksel-data,tasksel,3.14.1,Official tasks used for installation of Debian systems,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",148804,,app-data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 0, Popularity: 1, Language: 0, Exposure: 0 , Data only: -3",
  tzdata,,2014h-0wheezy1,time zone and daylight-saving time data,http://www.iana.org/time-zones,0,https://security-tracker.debian.org/tracker/source-package/tzdata,,,,,,,,,,,,,,,153882,,app-data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 0, Exposure: 0 , Data only: -3",
  wamerican,scowl,7.1-1,American English dictionary words for /usr/share/dict,http://wordlist.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/scowl,https://www.openhub.net/projects/scowl,SCOWL (and friends),"SCOWL (Spell Checker Oriented Word Lists) is a database of English words that can be used to create word lists suitable for use in spell checkers of various sizes and dialects (America, British (both -ise and -ize) and Canadian). However, I am sure it will have numerous other uses as well.
  
  The main product of SCOWL are spell checker dictionaries for Hunspell and Aspell.
  
negative.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",140936,c,program,1,0,0,9,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",Vital for security. CII already investing in this. ++
  openssl,,1.0.1e-2+deb7u13,Secure Socket Layer (SSL) binary and related cryptographic tools,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",173279,,,1,0,0,9,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Critical, in wide use.  OpenSSL is already funded by CII. ++"
  procps,,1:3.3.3-3,/proc file system utilities,http://gitorious.org/procps,0,https://security-tracker.debian.org/tracker/source-package/procps,https://www.openhub.net/projects/procps,Procps - The /proc file system utilities,"procps is the package that has a bunch of small useful utilities that give information about processes using the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill, free, slabtop, and skill.
  
  Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,175830,c,program,0,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  reportbug,,6.4.4+deb7u1,reports bugs in the Debian distribution,http://alioth.debian.org/projects/reportbug/,1,https://security-tracker.debian.org/tracker/source-package/reportbug,https://www.openhub.net/projects/reportbug,reportbug,,http://alioth.debian.org/projects/reportbug,,1,23,8566,Python,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Only a single active developer,155143,python,program,1,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 2, Language: 0, Exposure: 2 , Data only: 0",
  rsyslog,,5.8.11-3+deb7u2,reliable system and kernel logging daemon,http://www.rsyslog.com/,9,https://security-tracker.debian.org/tracker/source-package/rsyslog,https://www.openhub.net/projects/rsyslog,rsyslog,"Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MySQL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock sysklogd and can be used as a drop-in replacement. Its advanced features make it suitable for enterprise-class, encryption protected syslog relay chains while at the same time being very easy to setup for the novice user. 
  
  Over time, rsyslog has become the default syslogd for the many distributions.",http://www.rsyslog.com/,http://www.rsyslog.com/Downloads-index-req-viewdownload-cid-1-orderby-dateD.phtml,52,160,196201,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",168299,c,program,1,0,0,9,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Processes data from untrusted users.  Important today; as systemd becomes more used, its use may lessen but still important for merging data sources. Project page http://www.rsyslog.com/ Official repo on GitHub, https://github.com/rsyslog This is an active multi-person project; in the one-month period February 12, 2015     March 12, 2015, excluding merges, 7 authors have pushed 27 commits to master and 40 commits to all branches. On master, 37 files have changed and there have been 677 additions and 216 deletions. ++"
  sysvinit,,2.88dsf-41+deb7u1,System-V-like init utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,129859,c,program,0,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  sysvinit-utils,sysvinit,2.88dsf-41+deb7u1,System-V-like utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,175762,c,program,0,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  tcpd,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrapper utilities,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,167875,c,program,1,0,0,9,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  time,,1.7-24,GNU time program for measuring CPU resource usage,http://www.gnu.org/software/time,0,https://security-tracker.debian.org/tracker/source-package/time,https://www.openhub.net/projects/time,OpenTimeCE,An implementation of the full set of time_t functions in time.h from the C Standard Library for Windows CE.,http://time.codeplex.com,,0,3,1637,XAML,mit,Stable Y-O-Y development activity,"Young, but established codebase",Very few source code comments,No recent development activity,155115,c,program,0,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  vim-tiny,vim,2:7.3.547-7,Vi IMproved - enhanced vi editor - compact version,http://www.vim.org/,1,https://security-tracker.debian.org/tracker/source-package/vim,https://www.openhub.net/projects/vim,Vim,"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. It's useful whether you're already using vi or using a different editor.",http://www.vim.org/,http://www.vim.org/download.php,1,12,844733,C,Vim_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,170043,c,program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  whois,,5.1.1~deb7u1,intelligent WHOIS client,,0,https://security-tracker.debian.org/tracker/source-package/whois,,,,,,,,,,,,,,,161782,c,program,1,0,0,9,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",Less commonly used.
  apache2-mpm-worker,apache2,2.2.22-13+deb7u3,Apache HTTP Server - high speed threaded model,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",12488,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vitally important.  Note, however, that there's already large development & review team in place."
  apt,,0.9.7.9+deb7u6,commandline package manager,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175847,c++,program,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  apt-utils,apt,0.9.7.9+deb7u6,package managment related utility programs,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175598,c++,program,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  aptitude,,0.6.8.2-1,terminal-based package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,172539,c++,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  aptitude-common,aptitude,0.6.8.2-1,architecture indepedent files for the aptitude package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,144321,,,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  at,,3.1.13-2+deb7u1,Delayed job execution and batch processing,,0,https://security-tracker.debian.org/tracker/source-package/at,https://www.openhub.net/projects/at,,,,,,,,,,,,,,155868,c,program,0,0,1,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Could potentially enable local privilege escalation.
  binutils,,2.22-8,"GNU assembler, linker and binary utilities",,9,https://security-tracker.debian.org/tracker/source-package/binutils,https://www.openhub.net/projects/binutils,GNU binutils,"The GNU linker and related programs and libraries: ar, as, gprof, ld, nm, ranlib, strip, libbfd.  You depend on this utterly.",http://www.gnu.org/software/binutils/,http://ftp.gnu.org/gnu/binutils/,173,569,4635179,C,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",130637,c,program,0,0,1,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Vital software for a running system.  Active maintenance.  Includes many subcomponents; some components might need review, but hard to tell because they're managed as a group."
  bzr,,2.6.0~bzr6526-1,easy to use distributed version control system,http://bazaar-vcs.org,1,https://security-tracker.debian.org/tracker/source-package/bzr,https://www.openhub.net/projects/bzr-svn,Bazaar Subversion Plugin,Plugin that provides support for Subversion branches to Bazaar.,http://bazaar-vcs.org/BzrSvn,https://launchpad.net/bzr-svn,0,37,27434,Python,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,4891,python,program,0,1,0,8,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 0, Exposure: 1 , Data only: 0",
  clamav,,0.98.5+dfsg-0+deb7u1,anti-virus utility for Unix - command-line interface,http://www.clamav.net/,33,https://security-tracker.debian.org/tracker/source-package/clamav,https://www.openhub.net/projects/clamav,Clam AntiVirus,"Clam AntiVirus (ClamAV) is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a commandline scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use in your own software.",https://github.com/vrtadmin/clamav-devel,https://github.com/vrtadmin/clamav-devel/downloads,8,163,2910592,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",13527,c,program,1,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  coreutils,,8.13-3.5,GNU core utilities,http://gnu.org/software/coreutils,7,https://security-tracker.debian.org/tracker/source-package/coreutils,https://www.openhub.net/projects/coreutils,GNU Core Utilities,"The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU Operating System.
  
  Specifically, this package includes:
  