A general question here. Our customers often fire over these reports that they have been sent and ask us to see if they are vulnerable.
These reports list an affected version of the software, and a fixed release version.
My question is, most of the time the version we are running falls after the affected version, but before the fixed(as fixed is usually always the most recent patch). So are vulnerable in this case?
For example, if a bug states that the affected version is CUCM 9x, and we are running 11x, are we ok to assume no action is required?
