* Jeff Law: > On 11/01/2017 03:22 AM, Florian Weimer wrote: >> * Charo: >> >>> Is there any private list or something like that to report it >>> or should I use the GCC bug tracker? >> >> You could pick one of the distributions and let them handle this: >> >> * Debian <secur...@debian.org> >> * Red Hat <secal...@redhat.com> >> * SUSE <secur...@suse.com> >> >> Just contacting one distribution is sufficient.
> Or he could just report them into the GCC bugzilla. Sure, it's the likely outcome of contacting the distros first, assuming the issue is not critical. If it is critical (which admittedly is unlikely), then giving distros time to prepare fixes might be warranted. The distro security teams usually can make this determination quickly, so contacting them is just a minor detour.
