&gt; All in all it&#x27;s pretty irresponsible to allow the current situation in the first place. Don&#x27;t ship vulnerability-prone internet-facing C apps that you can&#x27;t patch.<p>I think it&#x27;s even worse because they <i>won&#x27;t</i> patch or remove it. They could, but they do not consider it a problem. Ubuntu just imports everything from Debian. Things not relevant to the core team at Canonical are just thrown at the community basically saying &quot;if you want a safe OS, you have to support this by yourself now&quot;. All the while Canonical is building their in-house, partly closed-source solutions to already solved problems.