CVE-2009-3547
chain: race condition might allow resource to be released before operating on it, leading to NULL dereference
CVE-2006-5051
Chain: Signal handler contains too much functionality (CWE-828), introducing a race condition (CWE-362) that leads to a double free (CWE-415).