Comment by JohnFen

> it really wasn't their fault -- it was a quite-bad bug in a very fundamental library.

It's still their fault. When you ship code, you are responsible for how that code behaves regardless of where the code came from.