1 of 2
Thomas Ward Mod
  • 74.4k
  • 2
  • 57
  • 113

I think that you would have better luck specifically reaching out to the Ubuntu Security Team than asking here on Ask Ubuntu. The Ubuntu Security Team who maintains the pages you're asking about are going to be the best way to get the answers you're after.

And while your question is technically related to Ubuntu, the specific naming conventions are not within scope here.


To answer your question though, the CVEs list all known or assumed affected packages. This is the CVE tracker, and is used to identify what CVEs exist, are acknowledged by the Security team, and list the status of all affected packages and whether or not they have patched versions released to the repositories or not yet. It's just a status tracker for the given CVEs.

The USNs however are the official announcements that patches have been released for a given package affecting a given CVE. In your specific case here, though, that notice is for eglibc. You also missed USN-3534-1 which also covers glibc. USNs are for individual notices about the individual packages which had a vulnerability and are patched, so while related to the CVE, these are only really as useful to identify whether the Ubuntu Security Team has released some type of patch to fix the problem, and not a CVE tracker (that's why I usually point people at CVE tracker links)

Thomas Ward Mod
  • 74.4k
  • 2
  • 57
  • 113