A framework for a systematic survey of known software defects

It is common practice to use third-party software in projects, which can lead to security problems. There are numerous cases when the known vulnerability was fixed in the upstream repository of the project but still exists in other projects. We present a framework for systematic analysis and detection of publicly known vulnerabilities in a large codebase. On the first stage, the vast codebase of open-source projects and known vulnerabilities are collected. On the second stage, for each known vulnerability, we try to find the corresponding source repository and extract the fixing patch. Based on extracted patches we construct possible vulnerable code fragments and try to find all their clones in the collected codebase. During the experimental setup, we have collected more than 42k open-source packages from Debian OS distribution. Analysis of these packages allowed us to detect more than four hundred copies of unfixed vulnerabilities, seven of them have already been approved and fixed by the vendors.