Comment Re:Thanks again ADOBE (Score 1) 153
You can't show a list of zero day exploits, by definition.
Zero day exploits are exploits for vulnerabilities that have been public knowledge for, wait for it, zero days. In other words, a '0day' is a piece of exploit code or vulnerabilty information that has not been diclosed. So, it is impossible to list the number of Linux, or any other operating system, zero day exploits in the wild.
The important metrics for risk analysis of a particular system are:
1. The number of disclosed vulnerabilities $V_d$
2. The number of those that have mitigating patches available $V_p$
3. The number of said patches that are actually deployed on the system of interest $P$
4. The total number of vulnerabilities on that class of system $V_t$
These numbers are related as follows, with the actual values left as an exercise for the risk analyst:
$V_t > V_d > V_p > P$
However, this relationship implies that every real system, consisting of some type of operating system with installed application software, has a non-zero attack surface.
Based on the number of publicly known exploits, both patched and unpatched, there must be a non-zero number number of '0day' vulnerabilities in existance, which will be in use by black-hat hackers, penetration testers and national security or intelligence agencies. This number $V_0$ is simply $V_t - V_d$ and attempts have been made to estimate this based on trends in public disclosures of vulnerabilities [1].
[1] Exposing Vendors (In)security Performance
grkvlt.
