Where should I report security related issues?

[Florian Weimer]

* Jeff Law:

> On 11/01/2017 03:22 AM, Florian Weimer wrote:
>> * Charo:
>> 
>>> Is there any private list or something like that to report it
>>> or should I use the GCC bug tracker?
>> 
>> You could pick one of the distributions and let them handle this:
>> 
>> * Debian <security@debian.org>
>> * Red Hat <secalert@redhat.com>
>> * SUSE <security@suse.com>
>> 
>> Just contacting one distribution is sufficient.

> Or he could just report them into the GCC bugzilla.

Sure, it's the likely outcome of contacting the distros first,
assuming the issue is not critical.

If it is critical (which admittedly is unlikely), then giving distros
time to prepare fixes might be warranted.  The distro security teams
usually can make this determination quickly, so contacting them is
just a minor detour.