This post is Alex's original announcement in the Bugtraq mailing list and David Litchfield’s reply to him and the list and Alex's subsequent reply. Basically the DAV_PUBLIC bug was fixed in "Alert 52, Security Vulnerabilities in Oracle9i Application Server" (dated 2003) and this is what David was reporting to the list and Alex. So at least this bug was not fixed silently after all.
OK, so the DAV_PUBLIC bug was found by Mark and David Litchfield and fixed two years ago in a previous patch. So maybe I am missing the point but why is it mentioned again (at least in the patch readme files) for CPU July 2005 two years later?