The last report to come out of Microsoft comparing Windows XP's and Windows Vista's security encompassed the first year year after their respective release. The conclusion was that Vista was more secure as it had fewer vulnerabilities. Additionally, more of the Vista vulnerabilities discovered were rated less severely when weighed against Windows XP.
Now, Jeff Jones, a Security Strategy Director in Microsoft’s Trustworthy Computing group, has released a similar report. This one takes the last calendar year as its time frame, which shows how both operating systems have been doing most recently.
As can be seen from the chart above, Windows Vista has again trumped Windows XP in 2007 when directly comparing the number of vulnerabilities disclosed in both operating systems. The number breakdown of the report is shown in the chart below:
|
Microsoft's rating system
|
Windows Vista
|
Windows XP
|
|
Critical
|
17
|
35
|
|
Important
|
19
|
15
|
|
Moderate
|
7
|
4
|
|
Low
|
2
|
2
|
|
CVSSv2's rating system
|
Windows Vista
|
Windows XP
|
|
High
|
27
|
42
|
|
Medium
|
18
|
14
|
Notice that according to the Microsoft's rating system chart, Windows XP SP2 had 66 vulnerabilities, while the CVSSv2 row shows 56 vulnerabilities. This is an error in the report and there were in fact 56 vulnerabilities for XP SP2 in 2007. Both products had 10 Patch Tuesdays in 2007, but Windows XP SP2 was affected by 11 more vulnerabilities. In other words, XP SP2 had 24 percent more vulnerabilities than Vista did in 2007.
Neither Windows XP SP3 nor Windows Vista SP1 is mentioned due to the fact that both were released in 2008.
Update
Jeff Jones was kind enough to e-mail me back with the correction: there were actually 4 "Moderate" updates for XP SP2, and not 14. I have updated the chart above and Jeff has uploaded an updated PDF.
http://arstechnica.com/journals/microsoft.ars/2008/05/15/microsoft-xp-had-24-more-vulnerabilities-than-vista-in-2007