Martin Schulze

**Name of the Vulnerable Software and Affected Versions** Mailman versions prior to 2.1.9 **Description** A format string issue allows attackers to execute arbitrary code. The vendor has disputed this issue, stating it is unexploitable. **Recommendations** For versions prior to 2.1.9, update to version 2.1.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MiMMS version 0.0.9 xine-lib versions 1.1.0 and earlier **Description** The issue is a stack-based buffer overflow in libmms, which can be exploited by remote attackers to cause a denial of service, potentially leading to application crashes, and possibly allowing the execution of arbitrary code. This can occur through various functions, including `send command()`, `string utf16()`, `get data()`, and `get media packet()`, as well as possibly other functions. **Recommendations** For MiMMS version 0.0.9, consider disabling the `send command()`, `string utf16()`, `get data()`, and `get media packet()` functions as a temporary workaround until a patch is available. For xine-lib versions 1.1.0 and earlier, restrict access to the vulnerable libmms module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: xmcd version 2.6-17.1 Description: The issue concerns the xmcdconfig in xmcd, which creates directories with world-writable permissions, allowing local users to cause a denial of service by consuming disk space. Multiple vulnerabilities in the cddb package of Debian GNU/Linux can lead to disruption of protected information availability, exploitable by local attackers. Recommendations: For version 2.6-17.1, consider changing the permissions of the /var/lib/cddb and /var/lib/xmcd/discog directories to prevent world-writable access as a temporary workaround. Restrict access to these directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.