[tptacek]

It may have been, it may not have been (we don't know the terms), but it was a clientside driveby RCE, not a web app bug.