Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the event of finding a security vulnerability in the Linux world, the procedure involved would be to report the vulnerability...

  • the developers or the maintainers of the package in a particular operating system.
  • the security team of that particular operating system.

Then patches are made and CVE's are released.

I'm curious about how does open source vulnerability reporting work in the OSX world? Do the developers release CVE's if a security issue is brought to their notice?

share|improve this question
up vote 7 down vote accepted

You can contact Apple about this at (or you can open a Radar report if you're a developer), or you contact the maintainer of the package.
Often the mail addresses can be found in the README (or AUTHORS) of the source code, or on the project's website.

Yes - both Apple (specifically) and the open source developers (in general) do reference CVE in patch and security emails and participate using that mechanism for tracking reported vulnerabilities.

share|improve this answer
Yes - making sure Apple is directly aware of problems in code they bundle is very important. I like the two pronged approach of letting Apple and the original maintainer of the open source know to reinforce the message and ensure both parties can evaluate your report. – bmike Feb 10 '12 at 18:02

Apples official security posture is Apple Product Security.

But I would say that your best bet would be to submit vulnerabilities via the Apple Bug Reporter and their product-security email address . Additionally, if the part with the vulnerability is an open-source project, you should also notify the open source project as well.

share|improve this answer

The procedure for reporting security vulnerabilities varies but the place to report would be directly to the open source project. If the application is hosted in the app store then you could report directly to Apple.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.