The average zero-day (0day) bug has a lifespan of 348 days before it
is discovered or patched, and some vulnerabilities live on for much
longer, according to security vendor Immunity Inc.’s chief executive

Zero-day bugs are vulnerabilities that have not been patched or
made public. When discovered and not disclosed, these bugs can be used
by hackers and criminals to break into corporate systems to steal or
change data. As a result, there is a thriving market for zero-day bugs.

“Huge amounts of money are being offering to zero-day
discoverers for their zero-days,” said Justine Aitel, Immunity’s CEO,
speaking in Singapore at the SyScan ’07 security conference.

Continues at