Oracle, Alcatel, and nph-maillist, oh my

A trio of security announcements from SecurityFocus: “The shared library ‘ndwfn4.so’ that ships with Oracle Application Server is vulnerable to a buffer overflow (details)” … “Certain Alcatel ADSL-Ethernet bridge products feature an embedded TFTP server which can be used by remote users to make changes to configuration and firmware (details)” … For nph-maillist, “A hostile user can enter commands embedded in an email address via the subscription form, and then force a mailing which will execute the commands (details).”