As there&#x27;s already automatic(?) tracking for unfixed CVEs in &quot;universe&quot; at <a href="https:&#x2F;&#x2F;people.canonical.com&#x2F;~ubuntu-security&#x2F;cve&#x2F;universe.html" rel="nofollow">https:&#x2F;&#x2F;people.canonical.com&#x2F;~ubuntu-security&#x2F;cve&#x2F;universe.h...</a>, it would be a short step to a local tool that disables and&#x2F;or warns users about running the programs when there are remote vulnerabilities.<p>All in all it&#x27;s pretty irresponsible to allow the current situation in the first place. Don&#x27;t ship vulnerability-prone internet-facing C apps that you can&#x27;t patch.<p>I wonder what the patch situation in practice is with CentOS installs that enable EPEL?