CWE-134

High likelihood

Use of Externally-Controlled Format String

Parent: CWE-668 - Exposure of Resource to Wrong Sphere

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

399 vulnerabilities with CWE-134
CVE-2015-6285
Cisco Email Security Appliance 7.6.0 and 8.0.0 - Denial of Service via Format String Specifiers
CVE-2014-6262 HIGH
Zenoss Core < 4.2.5 - Remote Code Execution via RRDtool Python Module Format String
CVSS 7.5
CVE-2014-8170 HIGH
ovirt-node 3.0.0-474-gb852fd7 - Authenticated Command Injection via Unquoted Input String
CVSS 8.8
CVE-2014-8625
dpkg < 1.17.21 - Use-After-Free via Format String Specifiers in Package or Architecture Name
CVE-2014-9157
Graphviz - Format String
CVE-2014-1315
Apple OS X 10.9.x-10.9.2 - Remote Code Execution via Format String Specifiers in URL
CVE-2014-1683
SkyBlueCanvas CMS <1.1 r248-04 - RCE
CVE-2013-2131
rrdtool 1.4.7 - Denial of Service via Format String Specifiers in rrdtool.graph
CVE-2013-7386
BOINC - Use-After-Free via Format String Specifiers in Account File
CVE-2013-1886
Red Hat Certificate System 8.1 - Authenticated Format String Vulnerability in Token Processing System
CVE-2013-6809
Tftpd32 < 4.50 - Remote Code Execution via Format String in Remote File Field
CVE-2013-5135
Apple Remote Desktop < 3.5.4 - Remote Code Execution via VNC Username Format String
CVE-2013-4389
Ruby on Rails 3.0.0-3.2.14 - Denial of Service via Format String in Action Mailer Log Subscriber
CVE-2013-4258
Network Audio System 1.9.3 - Format String Vulnerability in osLogMsg Function
CVE-2013-4147
YARD RADIUS 1.1.2 - Format String Vulnerability in Log and Version Functions
CVE-2013-2852
Linux kernel <3.9.4 - Privilege Escalation
CVE-2013-2851
Linux kernel <3.9.4 - Privilege Escalation
CVE-2013-3560
Debian Linux - Format String Vulnerability
CVE-2013-0929
EMC AlphaStor 4.0 - Remote Code Execution via Format String in rrobotd.exe
CVE-2012-10055 CRITICAL
ComSndFTP FTP Server <1.3.7 Beta - Code Injection
CVE-2012-0824 CRITICAL
gnusound 0.7.5 - Format String Vulnerability
CVSS 9.8
CVE-2012-4426
mcrypt < 2.6.8 - Format String Vulnerability in errors.c and mcrypt.c
CVE-2012-3569
VMware OVF Tool 2.1 - Remote Code Execution via Crafted OVF File
CVE-2012-1152
YAML::LibYAML 0.38 - Denial of Service via Format String Specifiers in Error Reporting
CVE-2012-1151
Perl < 2.18.1 - Format String Vulnerability
Details
Vulnerabilities 399
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits