Two of the flaws were in Internet Explorer. It's plausible that IE7 has shared code between the XP and Vista versions of it, so the two could share a flaw.

As for the OS base patches, I'd be surprised if the exact same patch was used on both or all three NT-based systems. Same flaw != same code necessarily.

There's a case for retiring XP, and for that matter, retiring 2K. MS has to write, very likely, three different versions of the same patch to address how the same flaw affects two or three differing systems. They're not using up manpower to fix the same browser flaws in Windows 98, ME, or NT4, and they're not using up manpower to fix the same OS flaw in NT4.

I have further commentary about how impatient the user base is regarding OS releases, and how that encourages copy/paste of code, but I'll save that for another rant.

And finally, I like seeing how El Reg is spreading the patch love. Nice to see Apple and the makers of Opera tossed into the same bin these days.