Ok but as long as those security bugs are not remote execute bugs there is little to nothing to worry about. Even if some of them are from remote vector does it mean that standard TCL installation with Xorg-7.7.tcz installed from repo will be exploitable? See, many features are disabled in order to lower depends for packages and in order to save space, memory etc. And I think Xorg doen't listen on 0.0.0.0 by default.
But keep an eye on tools that listens on network interfaces. There was some bugs in busybox dhcp client. Busybox is core of every tcl and other embedded tiny linux distros.
The other thing is there is no LTS (older and mature) kernel to select from and I understand supporting another kernel may cost more but I think LTS are just more secure and more stable (don't comes with regressions). I am going to say the first thing to protect is kernel because Linux is monolithic and single bug in kernel leads to code execution in kernel mode. There are some apis for user space drivers (EL0 drivers in arm) but make rare use of. I suggest 'git clone'ing linux repo, select lts branch, make olddefconfig, and then build kernel Image.gz and you can compile with modules built-in or without. And if single new release comes to world you just do 'git pull' and make recompiles only files that were modified or files that depend on files that were modified by recent release. By making dirty builds you save time and stay secure.
Welcome
FAQ
Downloads
Wiki
