[Xen-users] [RESEARCH] Security patch delivery delay

[Stefan GeiÃler <info@xxxxxxxxxxxxxxxxxxx>]

Hello xen-users,

I am currently analyzing the delay between vulnerability disclosure (CVE 
release) and the release of a corresponding patch.
First, i noticed that some vulnerabilities are patched before the CVE 
was assigned. How is that possible? Was the vulnerability "accitendally" 
fixed? (Example: According to NVD CVE-2011-2519 was fixed on 2008-02-05)
Second, does someone know why some vulnerabilities get a fix on CVE 
release day while some only recieve a fix after weeks or even month? 
(Maximum delay I observed is 241 days)
Regards,
Stefan

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users