fixes to the main code base, both of which are then used to inform revisions to
Oracle’s security standards in orderto reflecttheirlessons learned from vulnerability
discoveries and security incidentreports.Indeed,the main emphasis ofthe Software
Security Assurance Process appears to be on security patch distribution.