[binutils-gdb] gdb: in SECURITY.txt, add notes on reporting exec and debug bugs

[Andrew Burgess]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e737ca2937be2acc22ac5e84b328689d698ce5d0

commit e737ca2937be2acc22ac5e84b328689d698ce5d0
Author: Andrew Burgess <aburgess@redhat.com>
Date:   Mon Oct 12 11:16:05 2026 +0100

    gdb: in SECURITY.txt, add notes on reporting exec and debug bugs
    
    The previous commit clarified the wording about bugs related to
    parsing malformed executables and debug information.  Bugs in this
    area can be security bugs, but will not be treated with high priority
    by the GDB project.
    
    Given this, it does not seem sensible to me that these bugs should be
    reported via the more secret bug reporting path.  At the end of the
    day fixing these bugs is unlikely to be a priority, so the bugs will
    likely end up in the public bugzilla anyway.
    
    I propose that we advise that these bugs just be added to the public
    bugzilla from the start.
    
    I'm aware that this advice might be a little contentious, and that is
    why I've carved this change out from the previous one.  This makes it
    easier for people to agree with the previous commit, but disagree with
    this one.
    
    Approved-By: Tom Tromey <tom@tromey.com>

Diff:
---
 gdb/SECURITY.txt | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt
index 2911e7c38da..0574b3a5934 100644
--- a/gdb/SECURITY.txt
+++ b/gdb/SECURITY.txt
@@ -248,6 +248,13 @@ Reporting Non-Security Bugs
 
     https://sourceware.org/bugzilla/
 
+  Bugs related to parsing malformed executables and debug information
+  should be reported through the public bugzilla.  This is an area of
+  GDB containing known bugs, and as discussed above, it is advised
+  that users mitigate these bugs by running within a sandboxed
+  environment.  As such, these bugs are considered to pose limited
+  risk to users.
+
 Reporting Security Bugs
 -----------------------