Tracking base system and kernel updates/vulnerabilities

[Anselm Strauss]

Hi,

is there a tool, like portaudit for the ports tree, to track updates  
and/or vulnerabilities for the base system and the kernel? What I'm  
looking for is a tool that will check my current installation against  
a specific checkout of the CVS source and kernel trees considering a  
specific CVS tag and inform me where my system is outdated and  
vulnerable. I don't know if this is even possible by just having the  
CVS trees ...

For the kernel, is there something like a linear version number in the  
-STABLE branches? I noticed there's a pX in the kernel version for  
release kernels. How do I for example compare the currentness of two  
7.0-STABLE kernels if I don't know from what source they were build?

Cheers,
Anselm