That would only be accurate if you could trigger one of these bugs remotely.

...or if you can trick the user into opening a malicious file. An exploit in ls? Send them a zip, tarball, etc. with a maliciously named file.