Issues concerning the distribution of vulnerability information