Their earlier comment said
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
Their earlier comment said
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
Good point, at least now Debian has shipped the patched packages.