CVE writers make me cry sometimes. The original advisory is incredibly light on details, like, what software actually has the bug. The CVEs themselves also fail to adequately describe
what is vulnerable. E.g., CVE-2019-9516 “0-Length Headers Leak”, the CVE implicates "Ubuntu". Ubuntu (probably) can't be vulnerable to this CVE, some piece of software
on Ubuntu must be; and indeed clicking through to the USN shows that it's nginx. But then, why only single out Ubuntu, Debian and Fedora? Surely the others are equally vulnerable?
It was the same way w/ the recent VLC vuln. where the researcher just kinda dumped an ASan output into a bug tracker and "I has a working exploit" and no additional details.
