[jo_]

Perhaps they were fixed as part of unrelated bug fixes? That would explain why they didn't credit anyone as having reported them. Something like, "Fixed bad return value leak," or "refactoring old method" could break the exploits.