Ralf Wildenhues

**Name of the Vulnerable Software and Affected Versions** GNU Automake versions 1.11.1, 1.10.3 GNU Automake release branches branch-1-4 through branch-1-9 **Description** The issue in GNU Automake allows local users to introduce a race condition, enabling them to modify package files, introduce Trojan horse programs, or conduct other attacks before the build is complete. This is due to insecure permissions (777) being assigned to directories in the build tree when producing a distribution tarball for a package that uses Automake. **Recommendations** For GNU Automake versions 1.11.1 and 1.10.3, consider updating to a version that does not assign insecure permissions to directories in the build tree. For GNU Automake release branches branch-1-4 through branch-1-9, consider updating to a version that does not assign insecure permissions to directories in the build tree. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fnord version 1.6 **Description** The issue allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the `do cgi` function. **Recommendations** For fnord version 1.6, consider restricting access to the `do cgi` function until a patch is available. As a temporary workaround, avoid using long CGI requests to minimize the risk of exploitation.