Jens Steube

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue is related to the lack of protection for internal data in the Tcl component of the operating system. It can be exploited by a remote attacker to obtain sensitive information by leveraging SSLv2 support. **Recommendations** For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider disabling SSLv2 support to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** masqmail versions prior to 0.2.18 **Description** The issue allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message. **Recommendations** For versions prior to 0.2.18, update to version 0.2.18 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** masqmail versions prior to 0.2.18 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on a log file. **Recommendations** For masqmail versions prior to 0.2.18, update to version 0.2.18 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** qpopper versions 4.0.5 and earlier **Description** The issue arises from improper privilege handling when processing certain user-supplied files, allowing local users to overwrite or create arbitrary files as root. **Recommendations** For qpopper versions 4.0.5 and earlier, update to a version that properly drops privileges before processing user-supplied files to prevent arbitrary file creation or overwrite as root.

**Name of the Vulnerable Software and Affected Versions** remstats versions 1.0.13 and earlier **Description** The issue affects the remstats package in Debian GNU/Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Local users can create or overwrite arbitrary files via a symlink attack on temporary files when processing uptime data. **Recommendations** For remstats versions 1.0.13 and earlier, consider restricting access to the uptime data processing functionality until a patch is available. As a temporary workaround, monitor temporary files for potential symlink attacks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** remstats versions 1.0.13 and earlier remstats-bintools (affected versions not specified) remstats-doc (affected versions not specified) remstats-servers (affected versions not specified) **Description** The issue concerns multiple vulnerabilities in the remstats package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The remoteping service in remstats is specifically mentioned as having an unknown vulnerability that allows remote attackers to execute arbitrary commands due to missing input sanitizing. **Recommendations** For remstats versions 1.0.13 and earlier, consider updating to a version later than 1.0.13 as a fix. For remstats-bintools, remstats-doc, and remstats-servers, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to these components to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ppxp-tcltk versions (affected versions not specified) ppxp versions (affected versions not specified) ppxp-dev versions (affected versions not specified) ppxp-x11 versions (affected versions not specified) **Description** The issue concerns multiple vulnerabilities in the ppxp package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker. Specifically, ppxp does not drop root privileges before opening log files, allowing local users to execute arbitrary commands. **Recommendations** For ppxp-tcltk, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ppxp, consider restricting access to the log files until a patch is available. For ppxp-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ppxp-x11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.