Comment by stavros
10 hours ago
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
10 hours ago
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.