Today Alex let me know that Oracle released a note on the knowledge base on Metalink that details an unfixed security vulnerablity (0-day), including test cases (exploit code) that affects all versions of Oracle from 220.127.116.11 to 10.2.0.3. The note has now been removed but was in the headlines section and was titled "363848.1 ? A User with SELECT Object Privilege on Base Tables Can Delete Rows from a View". Alex has informed Oracle that it is not a good idea to release this sort of information on unfixed security bugs.
There is a detailed discussion of the issue on Alex's site in a page titled "Read-only user can modify data via views". This page details the issue and also includes exploit code (the actual method of exploit is censored out).
Dr. Christian Kleinew?chter and Swen Th?mmler from infinity3 GmbH found the issue.