CWE-134— Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.— MITRE CWE catalog

369 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-134page 2 of 8

CVE-2007-5265HIGHCVSS v2 7.5EG 7.5
2007-10-08
Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) password fields when accessing certain "r…
CVE-2007-5396MEDIUMCVSS v2 6.8EG 6.8
2007-11-10
Format string vulnerability in the ext_yahoo_contact_added function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo! h…
CVE-2007-5545HIGHCVSS v2 7.5EG 7.5
2007-10-18
Format string vulnerability in TIBCO SmartPGM FX allows remote attackers to execute arbitrary code via format string specifiers in unspecified vectors. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable i…
CVE-2007-5561HIGHCVSS v2 10.0EG 10.0
2007-10-18
Format string vulnerability in the logging function in the Oracle OPMN daemon, as used on Oracle Enterprise Grid Console server 10.2.0.1, allows remote attackers to execute arbitrary code via format string specifiers in the URI in an HTTP …
CVE-2007-5740HIGHCVSS v2 7.5EG 7.5
2007-10-31
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not coun…
CVE-2007-5825HIGHCVSS v2 7.5EG 7.5
2007-11-05
Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifier…
CVE-2007-6273HIGHCVSS v2 9.3EG 9.3
2007-12-07
Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in the (1) Hostname tag or th…
CVE-2007-6625MEDIUMCVSS v2 5.0EG 5.0
2008-01-04
The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog m…
CVE-2008-0072MEDIUMCVSS v2 6.8EG 6.8
2008-03-06
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version fi…
CVE-2008-0755HIGHCVSS v2 7.5EG 7.5
2008-02-13
Format string vulnerability in the ReportSysLogEvent function in the LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and…
CVE-2008-0764HIGHCVSS v2 10.0EG 10.0
2008-02-13
Format string vulnerability in the logging function in Larson Network Print Server (LstNPS) 9.4.2 build 105 and earlier for Windows might allow remote attackers to execute arbitrary code via format string specifiers in a USEP command on TC…
CVE-2008-0945LOWCVSS v2 3.5EG 3.5
2008-02-25
Format string vulnerability in the logging function in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to cause a denial of service (daemon crash) and possibl…
CVE-2008-0963HIGHCVSS v2 9.0EG 9.0
2008-04-14
Format string vulnerability in EMC DiskXtender MediaStor 6.20.060 allows remote authenticated users to execute arbitrary code via a crafted message to the RPC interface.
CVE-2008-0965HIGHCVSS v2 9.3EG 9.3
2008-08-08
Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.
CVE-2008-0989MEDIUMCVSS v2 6.9EG 6.9
2008-03-18
Format string vulnerability in mDNSResponderHelper in Apple Mac OS X 10.5.2 allows local users to execute arbitrary code via format string specifiers in the local hostname.
CVE-2008-1055HIGHCVSS v2 7.5EG 7.5
2008-02-27
Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format …
CVE-2008-1120HIGHCVSS v2 9.3EG 9.3
2008-03-03
Format string vulnerability in the embedded Internet Explorer component for Mirabilis ICQ 6 build 6043 allows remote servers to execute arbitrary code or cause a denial of service (crash) via unspecified vectors related to HTML code genera…
CVE-2008-1127MEDIUMCVSS v2 6.0EG 6.0
2008-03-03
Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute arbitrary code via format string specifiers in the user name, which is triggered when the game character is killed.
CVE-2008-1206MEDIUMCVSS v2 6.8EG 6.8
2008-03-08
Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string …
CVE-2008-1333MEDIUMCVSS v2 5.8EG 5.8
2008-03-20
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astm…
CVE-2008-1357MEDIUMCVSS v2 5.4EG 5.4
2008-03-17
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of ser…
CVE-2008-1401MEDIUMCVSS v2 4.3EG 4.3
2008-03-20
Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded …
CVE-2008-1658MEDIUMCVSS v2 4.6EG 4.6
2008-04-11
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
CVE-2008-1705MEDIUMCVSS v2 6.8EG 6.8
2008-04-09
Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fi…
CVE-2008-2310MEDIUMCVSS v2 6.8EG 6.8
2008-07-01
Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.
CVE-2008-3116HIGHCVSS v2 10.0EG 10.0
2008-07-10
Format string vulnerability in dx8render.dll in Snail Game (aka Suzhou Snail Electronic Company) 5th street (aka Hot Step or High Street 5) allows remote attackers to execute arbitrary code via format string specifiers in a chat message.
CVE-2008-3533HIGHCVSS v2 10.0EG 10.0
2008-08-18
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, …
CVE-2008-3734HIGHCVSS v2 9.3EG 9.3
2008-08-20
Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in…
CVE-2008-3871HIGHCVSS v2 9.3EG 9.3
2009-04-01
Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.
CVE-2008-3940MEDIUMCVSS v2 4.4EG 4.4
2008-09-05
Format string vulnerability in the finger client in HP TCP/IP Services for OpenVMS 5.x allows local users to gain privileges via format string specifiers in a (1) .plan or (2) .project file.
CVE-2008-3963MEDIUMCVSS v2 4.0EG 4.0
2008-09-11
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash)…
CVE-2008-5660MEDIUMCVSS v2 6.8EG 6.8
2008-12-17
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted…
CVE-2008-5982HIGHCVSS v2 10.0EG 10.0
2009-01-27
Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log m…
CVE-2008-6395HIGHCVSS v2 7.8EG 7.8
2009-03-04
The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service (device crash) via a malformed HTTP POST request.
CVE-2008-6441HIGHCVSS v2 9.3EG 9.3
2009-03-09
Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) …
CVE-2008-6519HIGHCVSS v2 10.0EG 10.0
2009-03-25
Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Lon…
CVE-2008-6520HIGHCVSS v2 10.0EG 10.0
2009-03-25
Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2, and possibly other versions, allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string spec…
CVE-2008-7074HIGHCVSS v2 9.3EG 9.3
2009-08-25
Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response,…
CVE-2008-7159MEDIUMCVSS v2 5.8EG 5.8
2009-09-10
The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID v…
CVE-2008-7160MEDIUMCVSS v2 5.8EG 5.8
2009-09-10
The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly e…
CVE-2008-7228HIGHCVSS v2 10.0EG 10.0
2009-09-14
Multiple format string vulnerabilities in White_Dune before 0.29beta851 have unspecified impact and attack vectors, a different vulnerability than CVE-2008-0101.
CVE-2009-0364HIGHCVSS v2 7.5EG 7.5
2009-03-26
Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2009-0538MEDIUMCVSS v2 4.6EG 4.6
2009-03-18
Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format st…
CVE-2009-0601LOWCVSS v2 2.1EG 2.1
2009-02-16
Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.
CVE-2009-0754LOWCVSS v2 2.1EG 2.1
2009-03-03
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to…
CVE-2009-1210HIGHCVSS v2 10.0EG 10.0
2009-04-01
Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these…
CVE-2009-1262HIGHCVSS v2 7.2EG 7.2
2009-04-07
Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.
CVE-2009-1886HIGHCVSS v2 9.3EG 9.3
2009-06-25
Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.
CVE-2009-2191HIGHCVSS v2 7.5EG 7.5
2009-08-06
Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name.
CVE-2009-2446HIGHCVSS v2 8.5EG 8.5
2009-07-13
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspec…

Map vulnerabilities like CWE-134 to your infrastructure

EchelonGraph correlates every CVE — across CWE-134 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →