The answers to this questions: Where are the Java 7 updates for OpenJDK? asserts that there are different update policies for OpenJDK and the Oracle JDK. Especially that security updates for the Oracle JDK are not always ported to OpenJDK. By looking at Oracles Release Notes for JDK7 u5 I didn’t get much wiser. One of the bugs listed there (7166687) which was relevant for OpenJDK too, could be found in a commit message for OpenJDK. But I couldn’t find any of the CVE numbers I searched for. Are they irrelevant for OpenJDK? Did I miss something?
To make a long story short: Do OpenJDK 7 and Oracle JDK 7 get the same updates?
My reading of the answers to the question you link to is that OpenJDK gets no updates.
Or at least, that Oracle will not make any new releases of OpenJDK unless the spec changes, and so, presumably, will not contribute any work on its source. Any work on OpenJDK will have to come from non-Oracle community contributions.