Linux Kernel approach of "just publish fix without fanfare" seems to be least compromising way to do it. Every bug can be security bug