I found this in another thread (the Stcky concerning Yast):
blue: there is a newer version of your installed package available on the FTP server
red: the package that you have installed is newer than the version on the FTP server
black: this is the same version as on the server
as referring to the color-coding for YOU Security Updates.
I have just installed Suse 9.3. SuseWatcher ran and found new security updates that it wants me to do, but half are red and half are blue. Why would it want me to update the red ones, if red means that I have a package that is newer?