<p>Vendor promises fix for separate privilege-escalation flaw in the coming weeks</p>