Skip to content

CWE-134: Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

A kind of CWE-668 Exposure of Resource to Wrong Sphere.

From the CWE List. © The MITRE Corporation.

Newest

samba, debian linux, mandrakesoft mandrake linux +2 more +4 moreFormat string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows...CVE-2007-0454Fix available7.5 HighFebruary 5, 2007
apple imovie, mac os x, safari +2 moreFormat string vulnerability in iMovie HD 6.0.3, and Safari in Apple Mac OS X 10.4 through 10.4.10...CVE-2007-0646Public exploitEPSS 10.4%7.1 HighFebruary 1, 2007
colloquyMultiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in...CVE-2007-0344Public exploit7.5 HighJanuary 18, 2007
apple iphotoFormat string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows...CVE-2007-0051Public exploit6.8 MediumJanuary 4, 2007
videolan vlc media playerMultiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access...CVE-2007-0017Public exploitFix availableEPSS 12.4%6.8 MediumJanuary 3, 2007
w3mFormat string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run...CVE-2006-6772Fix available9.3 HighDecember 27, 2006
dxmsoft xm easy personal ftp serverFormat string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause...CVE-2006-6751Public exploit5.0 MediumDecember 27, 2006
ethereal group ethereal, wireshark +1 moreMultiple format string vulnerabilities in Wireshark (aka Ethereal) 0.10.x to 0.99.0 allow remote...CVE-2006-3628Fix available10.0 HighJuly 18, 2006
mysqlFormat string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April...CVE-2006-3469Public exploitEPSS 31.1%4.0 MediumJuly 18, 2006
milan mimica sparkletFormat string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0...CVE-2006-357310.0 HighJuly 13, 2006
apple mac os x, mac os x server +1 moreFormat string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6...CVE-2006-14714.6 MediumJune 27, 2006
diaMultiple unspecified format string vulnerabilities in Dia have unspecified impact and attack...CVE-2006-2453Fix available7.5 HighMay 28, 2006
diaFormat string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of...CVE-2006-2480Public exploitFix available5.1 MediumMay 19, 2006
raydiumFormat string vulnerability in the raydium_log function in console.c in Raydium before SVN...CVE-2006-2409Public exploit4.6 MediumMay 16, 2006
empire server serverMultiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a...CVE-2006-18406.4 MediumApril 19, 2006
clamavMultiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88...CVE-2006-1615Fix availableEPSS 11.6%10.0 HighApril 5, 2006
apache log4netApache log4net format string vulnerability causes DoSCVE-2006-0743Fix available5.0 MediumMarch 9, 2006
even balance punkbusterFormat string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and...CVE-2006-07716.4 MediumFebruary 18, 2006
f-secure ssh server, attachmatewrq reflection for secure it server +1 moreFormat string vulnerability in a logging function as used by various SFTP servers, including (1)...CVE-2006-0705EPSS 10.2%6.5 MediumFebruary 15, 2006
phpFormat string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0...CVE-2006-0200EPSS 20.0%9.3 HighJanuary 13, 2006
dave carrigan auth ldapMultiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1...CVE-2006-0150Fix available7.5 HighJanuary 9, 2006
imagemagickFormat string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and...CVE-2006-0082Fix available5.1 MediumJanuary 4, 2006
guiseppe tanzilli and matthias eckermann mod auth pgsqlMultiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when...CVE-2005-3656Fix available10.0 HighDecember 31, 2005
softwin bitdefenderFormat string vulnerability in the logging functionality in BitDefender AntiVirus 7.2 through 9...CVE-2005-31547.5 HighOctober 5, 2005
esri arcinfo workstationFormat string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain...CVE-2005-1394Public exploit7.2 HighMay 2, 2005
monkey-project monkeyFormat string vulnerability in cgi.c for Monkey daemon (monkeyd) before 0.9.1 allows remote...CVE-2005-11227.5 HighApril 14, 2005
windowmakerUnspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown...CVE-2004-2714Fix available6.0 MediumDecember 31, 2004
denis sbragion sredird, peter astrand sercd +1 moreFormat string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and...CVE-2004-2386Fix available7.5 HighDecember 31, 2004
pizzashack rsshFormat string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to...CVE-2004-16289.0 HighOctober 23, 2004
inter7 courier-imapFormat string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3...CVE-2004-0777Public exploitFix availableEPSS 10.9%7.5 HighAugust 19, 2004
webdav neon, debian linux +1 moreMultiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that...CVE-2004-0179Public exploitFix availableEPSS 11.1%6.8 MediumApril 16, 2004
amxmod.net amx modFormat string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life...CVE-2003-1381Public exploit6.8 MediumDecember 31, 2003
phpwebsiteThe calendar module in phpWebSite 0.9.x and earlier allows remote attackers to cause a denial of...CVE-2003-07387.8 HighSeptember 4, 2003
cisco secure access control serverFormat string vulnerability in the administration function in Cisco Secure Access Control Server ...CVE-2002-01597.5 HighApril 22, 2002