anchor.diff:  debianutils,,debian-installer-utils,debianutils,, Miscellaneous utilities specific to Debian,Standard System Utilities,0,0,0,"Collection of small tools.The tempfile(1) command is security-relevant (temp file mistakes are a common security vulnerability) but is relatively small, and usually the problem is a failure to use tempfile(1) or similar.",,
   dictionaries-common,,dict-common,dict-common,, Common utilities for spelling dictionary tools,Standard System Utilities,0,0,0,,,
   diffutils,,diffutils,diffutils,, File comparison utilities,Standard System Utilities,0,0,0,,,
  +discover-data,,,discover-data,, Data lists for Discover hardware detection system,Standard System Utilities,0,0,0,,,
   discover,,,discover,, hardware identification system,Standard System Utilities,0,0,0,"Conceivably a local exploit opportunity, but not likely.",,
  -discover-data,,,discover-data,, Data lists for Discover hardware detection system,Standard System Utilities,0,0,0,,,
   dkms,,dkms-framework,dkms,, Dynamic Kernel Module Support Framework,Standard System Utilities,0,0,1,,,
   dmidecode,,dmidecode,dmidecode,, SMBIOS/DMI table decoder,Standard System Utilities,0,0,0,,,
   dmsetup,lvm2 (2.02.95-8),device-mapper,lvm2,, Linux Kernel Device Mapper userspace library,Standard System Utilities,0,0,0,,,
  +dnsmasq,,dnsmasq,dnsmasq,,Small caching DNS proxy and DHCP/TFTP server,,1,1,0,,,
   dnsutils,bind9,bind,bind9,, Clients provided with BIND,Standard System Utilities,1,0,0,Bind9 is critical for security. It does have active development. ++,,
   doc-debian,,doc-debian,doc-debian,, Debian Project documentation and other documents,Standard System Utilities,0,0,0,,,
   dpkg,,dpkg,dpkg,, Debian package management system,Standard System Utilities,1,0,0,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky.",,
   e2fslibs,e2fsprogs,e2fsprogs,e2fslibs,, ext2/ext3/ext4 file system libraries,Standard System Utilities,0,0,0,,,
   e2fsprogs,,e2fsprogs,e2fsprogs,, ext2/ext3/ext4 file system utilities,Standard System Utilities,0,0,0,,,
   eject,,eject,eject,, ejects CDs and operates CD-Changers under Linux,Standard System Utilities,0,0,0,,,
  -exim4,,exim,exim4,, metapackage to ease Exim MTA (v4) installation,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++",Exim may be used to contact network,
  +elasticsearch,elasticsearch,elasticsearch,elasticsearch,https://github.com/elastic/elasticsearch/issues,"Open Source, Distributed, RESTful Search Engine",web,1,1,1,,
  +emacs,Emacs-defaults,emacs,emacs,http://debbugs.gnu.org/,GNU Emacs editor,editors,1,1,1,,Markings based on a 2007 remote priv escation to Admin which is listed in emacs list of CVEs
  +encfs,,6347,encfs,https://github.com/vgough/encfs/issues,encrypted virtual filesystem,,0,0,0,,,
   exim4-base,exim4,exim,exim,, support files for all Exim MTA (v4) packages,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
   exim4-config,exim4,exim,exim,, configuration for the Exim MTA (v4),Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
   exim4-daemon-light,exim4,exim,exim,, lightweight Exim MTA (v4) daemon,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
  +exim4,,exim,exim4,, metapackage to ease Exim MTA (v4) installation,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++",Exim may be used to contact network,
  +fail2ban,fail2ban,fail2ban,fail2ban, https://api.github.com/repos/fail2ban/fail2ban/issues,ban hosts that cause multiple authentication errors,,0,1,1,"Used on 10% of Debian installations according to popcon thus millions of users,Monitors and parses log files and  executes commands to manipulate firewalls based on parsed logfiles (thus possibility of injection) usually runs as root",,
   fakeroot,,6854,fakeroot,, tool for simulating superuser privileges,Standard System Utilities,0,0,0,,,
  +ffmpeg,,ffmpeg,ffmpeg,https://trac.ffmpeg.org/query?status=new&status=open&status=reopened&col=id&col=summary&col=status&col=type&col=component&col=version&col=time&col=changetime&order=priority&report=1,"Tools for transcoding, streaming and playing of multimedia files",,0,1,0,,,
   file,,file,libmagic1,," Determines file type using ""magic"" numbers",Standard System Utilities,0,0,0,,,
   findutils,,findutils,findutils,," utilities for finding files--find, xargs",Standard System Utilities,0,0,0,,,
  +fonts-font-awesome,fonts-font-awesome,font-awesome,font-awesome,https://github.com/FontAwesome/Font-Awesome/issues,iconic font designed for use with Twitter Bootstrap,fonts,0,0,0,,
   ftp,netkit-ftp,,netkit-ftp,, classical file transfer client,Standard System Utilities,1,0,0,"Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet.",Extinct upstream per http://metadata.ftp-master.debian.org/changelogs//main/n/netkit-ftp/netkit-ftp_0.17-27_copyright and ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/,
  +gcc-4.6-base,gcc-4.6,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
  +gcc-4.6,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  +gcc-4.7-base,gcc-4.7,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
  +gcc-4.7,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
   gcc,gcc-defaults (1.120),gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  -gcc-4.6,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  -gcc-4.6-base,gcc-4.6,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
  -gcc-4.7,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  -gcc-4.7-base,gcc-4.7,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
   geoip-database,,geoipdb,geoipdb,, IP lookup command line tools that use the GeoIP library (country database),Standard System Utilities,1,0,0,,,
   gettext-base,gettext,gettext,gettext,, GNU Internationalization utilities for the base system,Standard System Utilities,0,0,0,,,
  +git,,git,,,,,0,1,0,,,
  +git,git,git,git,,"fast, scalable, distributed revision control system",vcs,1,1,0,,Does not appear to have an issue tracker
  +glib-networking,,glib-networking,glib-networking,"https://bugzilla.gnome.org/buglist.cgi?quicksearch=component:network product:""glib""", network-related giomodules for GLib,,1,0,0,"TLS API. Implements its own certificate verification. No support for certificate revocation. No active developers.,Implements GLib's TLS API, most notably used by libsoup (used by all GNOME applications, WebKitGTK+, etc.). It uses GnuTLS internally.",,
   gnupg,,gnupg,gnupg,, GNU privacy guard - a free PGP replacement,Standard System Utilities,0,1,0,Vital for protecting email (CII has already invested with a one-time investment) ++,,
  +gnutls-bin,,gnutls,gnutls-bin,,,,1,0,0,See GnuTLS.,,
   gpgv,gnupg,gnupg,gnupg,, GNU privacy guard - signature verification tool,Standard System Utilities,0,1,0,Vital for protecting email (CII has already invested with a one-time investment) ++,,
   grep,,grep,grep,," GNU grep, egrep and fgrep",Standard System Utilities,0,0,0,,,
   groff-base,groff,groff,groff,, GNU troff text-formatting system (base system components),Standard System Utilities,0,0,0,,,
  +grub2-common,grub2,grub,grub,, GRand Unified Bootloader (common files for version 2),Standard System Utilities,0,0,0,,,
   grub-common,grub2,grub,grub,, GRand Unified Bootloader (common files),Standard System Utilities,0,0,0,,,
  +grub-pc-bin,grub2,grub,grub,," GRand Unified Bootloader, version 2 (PC/BIOS binaries)",Standard System Utilities,0,0,0,,,
   grub-pc,grub2,grub,grub,," GRand Unified Bootloader, version 2 (PC/BIOS version)",Standard System Utilities,0,0,0,,,
  -grub-pc-bin,grub2,grub,grub,," GRand Unified Bootloader, version 2 (PC/BIOS binaries)",Standard System Utilities,0,0,0,,,
  -grub2-common,grub2,grub,grub,, GRand Unified Bootloader (common files for version 2),Standard System Utilities,0,0,0,,,
  +gunicorn,gunicorn,gunicorn,gunicorn,https://github.com/benoitc/gunicorn/issues,Event-based HTTP/WSGI server,httpd,1,1,1,,designed to be behind a buffering front end server (nginx)
   gzip,,gzip,gzip,, GNU compression utilities,Standard System Utilities,0,1,0,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. http://www.gnu.org/software/gzip/ Maintained on Savannah (http://savannah.gnu.org/projects/gzip/) using git. Last formal release was years ago (June 2013).  Multiple contributors, but not many. Current git contributions, but only a few a month (2015-02-08, 2015-01-02, 2014-11-10, 2014-10-10), and most seem to be small/trivial (document and syntax tweaks). +++",,
   hostname,,,,, utility to set/show the host name or domain name,Standard System Utilities,0,0,0,Relatively small functionality.,"originally FSF project, appears to be maintained separately",
  +hunspell,hunspell,hunspell,hunspell,http://sourceforge.net/p/hunspell/bugs,spell checker and morphological analyzer,text,0,0,0,,Lots of unprocessed bugs in the bug tracker
   iamerican,ispell,,ispell,, American English dictionary for ispell (standard version),Standard System Utilities,0,0,0,,,
   ibritish,ispell,,ispell,, British English dictionary for ispell (standard version),Standard System Utilities,0,0,0,,,
   ienglish-common,ispell,,ispell,, Common files for British and American ispell dictionaries,Standard System Utilities,0,0,0,,,
  
positive.code: libtinfo5,ncurses,ncurses,ncurses,, shared low-level terminfo library for terminal handling,Standard System Utilities,0,0,0,,,
  libtirpc1,libtirpc,libtirpc,libtirpc,, transport-independent RPC library,Standard System Utilities,1,0,0,"RPC library, used by NFS.",,
  libtokyocabinet9,tokyocabinet,tokyocabinet,tokyocabinet,, Tokyo Cabinet Database Libraries [runtime],Standard System Utilities,0,0,0,,,
  libudev0,udev,udev,udev,, libudev shared library,Standard System Utilities,0,0,0,,,
  libusb-0.1-4,libusb,libusb,libusb,, userspace USB programming library,Standard System Utilities,0,0,0,,,
  libusb-1.0-0,libusbx,libusbx,libusb,, userspace USB programming library,Standard System Utilities,0,0,0,,,
  libustr-1.0-1,ustr,10874,ustr,, Micro string library: shared library,Standard System Utilities,0,0,0,,,
  libuuid-perl,,data-uuid,libuuid, https://api.github.com/repos/rjbs/data-uuid/issues, Perl extension for using UUID interfaces as defined in e2fsprogs,Standard System Utilities,0,0,0,,,
  libuuid1,util-linux,util-linux-ng,util-linux,, Universally Unique ID library,Standard System Utilities,0,0,0,,,
  libwrap0,tcp-wrappers,,tcpwrapper,, Wietse Venema's TCP wrappers library,Standard System Utilities,0,1,0,Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.,,
  libx11-6,libx11,libx11,libx11, https://api.github.com/repos/mirror/libX11/issues, X11 client-side library,Standard System Utilities,0,0,0,,,
  libx11-data,libx11,libx11,libx11, https://api.github.com/repos/mirror/libX11/issues, X11 client-side library,Standard System Utilities,0,0,0,,,
  libxapian22,xapian-core,xapian,xapian,, Search engine library,Standard System Utilities,0,0,0,,,
  libxau6,libxau,xauthxx,libxau,, X11 authorisation library,Standard System Utilities,1,0,0,"X11 authorization.  Important, but X not typically network-exposed today, so expect reduced risk today compared to past.",http://xorg.freedesktop.org/releases/individual/lib/,
  libxaw7,libxaw,x,libxaw,, X11 Athena Widget library,Standard System Utilities,0,0,0,,,
  libxcb1,libxcb,xcb-libxcb,xcb-libxcb, https://github.com/bartsch/xcb-libxcb/issues, X C Binding,Standard System Utilities,0,0,0,,,
  libxcomposite1,libxcomposite,x,libxcomposite,, X11 Composite extension library,Standard System Utilities,0,0,0,,,
  libxdamage1,libxdamage,x,libxdamage,, X11 damaged region extension library,Standard System Utilities,0,0,0,,,
  libxdmcp6,libxdmcp,x,libxdmcp,, X11 Display Manager Control Protocol library,Standard System Utilities,0,0,0,,,
  
negative.code: laptop-detect,,,laptop-detect,, attempt to detect a laptop,Standard System Utilities,0,0,0,Unlikely to be a security vulnerability,,
  less,,,less,, pager program similar to more,Standard System Utilities,0,0,0,Less likely to be a security vulnerability :-).,,
  libacl1,acl,,libacl,, Access control list shared library,Standard System Utilities,0,0,1,"Access control-related, so of concern.",,
  libapache2-mod-gnutls ,mod-gnutls,mod_gnutls,,,,,1,0,0,"This is in widespread use for SSL/TLS on webservers; it uses GnuTLS instead of OpenSSL.  Old website http://www.outoforder.cc/projects/apache/mod_gnutls/ points to newer site ""https://mod.gnutls.org/?outoforder-ref"".  At newer site the mailing list has a few relevant postings/month, though the March 2015 postings raise concerns about dropped patches.  The bug tracker is badly spammed and one seems to be fixing/addressing it.  Last release 17-Feb-2014.  This looks like it badly needs help. +++ ",,
  libapr1,apr,apr,apr,, Apache Portable Runtime Library,Web Server,0,1,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++",,
  libaprutil1,apr-util,apr,apr,, Apache Portable Runtime Utility Library,Web Server,0,1,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++",,
  libaprutil1-dbd-sqlite3,apr-util,apr,apr,, Apache Portable Runtime Utility Library - SQLite3 Driver,Web Server,0,0,0,,,
  libaprutil1-ldap,apr-util,apr,apr,, Apache Portable Runtime Utility Library - LDAP Driver,Web Server,1,0,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  The LDAP driver is maintained as part of APR, http://apr.apache.org/ The APR-util version 1.5.4 was released September 22, 2014, so it is actively maintained. They use the apache.org repo and subversion; apr-util has been merged into main trunk, making it a little harder to see LDAP specifics to determine if the LDAP portion is active. Mailing list dev@apr.apache.org seems active. ++",,
  libapt-inst1.5,apt,apt,apt,, deb package format runtime library,Standard System Utilities,0,1,0,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky.",,
  libapt-pkg4.12,apt,apt,apt,, package managment runtime library,Standard System Utilities,0,1,0,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky.",,
  libasprintf0c2,gettext,gettext,gettext,, GNU library to use fprintf and friends in C++,Standard System Utilities,0,0,0,,,
  