Hi Steven,
For example, there appears to be distinct difference in editorial policy between Oracle and Microsoft in terms of publishing vulnerabilities that the vendors discovered themselves, instead of third parties. This might produce larger numbers for Oracle, which appears to include internally discovered vulnerabilities in their advisories, whereas this is not necessarily the case for Microsoft [2], [3].
Oracle do not report issues they've found internally in their alerts. Every DBn in their alerts marries up to "public" flaws.
In both cases, the lack of details can mean that multiple issues wind up with one public identifier; for example, Oracle Vuln# DB01 from CPU Jul 2006 (CVE-2006-3698) might involve 10 different issues, and this is not an isolated case. This can further muddy the waters.
...which is why I broke every actual flaw down in the document. For example the following flaws are all covered by CVE-2002-0154
xp_proxiedmetadata overflow CAN-2002-0154 MS02-020 xp_mergelineages overflow CAN-2002-0154 MS02-020 xp_controlqueueservice overflow CAN-2002-0154 MS02-020 xp_createprivatequeue overflow CAN-2002-0154 MS02-020 xp_createqueue overflow CAN-2002-0154 MS02-020 xp_decodequeuecmd overflow CAN-2002-0154 MS02-020 xp_deleteprivatequeue overflow CAN-2002-0154 MS02-020 xp_deletequeue overflow CAN-2002-0154 MS02-020 xp_displayqueuemesgs overflow CAN-2002-0154 MS02-020 xp_oledbinfo overflow CAN-2002-0154 MS02-020 xp_readpkfromqueue overflow CAN-2002-0154 MS02-020 xp_readpkfromvarbin overflow CAN-2002-0154 MS02-020 xp_repl_encrypt overflow CAN-2002-0154 MS02-020 xp_resetqueue overflow CAN-2002-0154 MS02-020 xp_unpackcab overflow CAN-2002-0154 MS02-020If someone is willing to sit down and do the research the details are "out there" and in a paper such as the comparison it was imperative to have these details.
Cheers, David Litchfield