[pca] Quarterly CPU and the xref

[Martin Paul]

Craig Bell wrote:
> Is it reasonable to expect transparent documentation?

Definitely. I wasn't aware of that problem, as I don't have to do 
audits, but I see no reason why we can't get ..

   .. a publically available list with CVEs -> patch ID-REVISION
   .. the CVE listed with the CR/bugfix number in the patch README

Even though the general recommendation from Oracle/Sun seems to be 
"install all patches or use patch clusters, but not single patches" 
nowadays, I don't see any harm caused by including this information, and 
let admins/sites work with the patch/change policy they prefer.

Martin.