You should submit patches and contact the vendors. But history has shown that many vendors will, in general, ignore you until a demonstrated exploit is availabl

You should submit patches and contact the vendors. But history has shown that many vendors will, in general, ignore you until a demonstrated exploit is available. They still believe that security by obscurity is a valid way to protect their customers. I should say that I am not a fan of 0-day exploit releases. You should at least try to convince the vendor to do the right thing. But failing that, a full disclosure release is the only way to force them to act. And by full disclosure I do mean a detailed description of the problem, with code demonstrating the exploit.