Updating risk assessment to match CERT's language

The existing characterization doesn't match the CERT page it was linking to. There is a long history of security bugs in high-profile code from either compiled out or otherwise unseafe mem_set, eg: http://www.viva64.com/en/examples/v597/
If there is honest disagreement with CERT's assessment, fair enough, but we shouldn't cite CERT as saying this is a "low severity" issue.