Yes, but in practice they are extremely hard to exploit. It has been discussed extensively here on HN and in other forums.