(This vulnerability has been fixed, but there wasn't enough space in the title field to say so.)