CWE-134
AllowedUse of Externally-Controlled Format String
Abstraction: Base · Status: Draft
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
500 vulnerabilities reference this CWE, most recent first.
GHSA-539Q-24VG-QFM4
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2024-03-21 03:34** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crated file. NOTE: multiple third parties dispute the significance of this finding.
{
"affected": [],
"aliases": [
"CVE-2021-35331"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-05T15:15:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crated file. NOTE: multiple third parties dispute the significance of this finding.",
"id": "GHSA-539q-24vg-qfm4",
"modified": "2024-03-21T03:34:05Z",
"published": "2022-05-24T19:06:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35331"
},
{
"type": "WEB",
"url": "https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222"
},
{
"type": "WEB",
"url": "https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2"
},
{
"type": "WEB",
"url": "https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280"
},
{
"type": "WEB",
"url": "https://sqlite.org/forum/info/7dcd751996c93ec9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-53JQ-RCH4-W6WR
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-05-24 17:39A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.
{
"affected": [],
"aliases": [
"CVE-2020-29018"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-14T16:15:00Z",
"severity": "HIGH"
},
"details": "A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.",
"id": "GHSA-53jq-rch4-w6wr",
"modified": "2022-05-24T17:39:17Z",
"published": "2022-05-24T17:39:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29018"
},
{
"type": "WEB",
"url": "https://www.fortiguard.com/psirt/FG-IR-20-123"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-54P2-QQ73-F565
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2023-02-23 03:30An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.
{
"affected": [],
"aliases": [
"CVE-2019-18420"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-31T14:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.",
"id": "GHSA-54p2-qq73-f565",
"modified": "2023-02-23T03:30:15Z",
"published": "2022-05-24T17:00:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18420"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2020/Jan/21"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-56"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4602"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/10/31/1"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-296.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-54QP-XM8V-H899
Vulnerability from github – Published: 2025-08-13 21:30 – Updated: 2025-08-13 21:30ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.
{
"affected": [],
"aliases": [
"CVE-2012-10055"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-13T21:15:29Z",
"severity": "CRITICAL"
},
"details": "ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.",
"id": "GHSA-54qp-xm8v-h899",
"modified": "2025-08-13T21:30:30Z",
"published": "2025-08-13T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-10055"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/comsnd_ftpd_fmtstr.rb"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120317214524/http://ftp.comsnd.com"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/19024"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/19177"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/comsndftp-user-format-string-rce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-56V6-7JGH-2F7R
Vulnerability from github – Published: 2024-10-22 18:32 – Updated: 2024-10-22 18:32In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered.
Reported by Dylan Marino
{
"affected": [],
"aliases": [
"CVE-2024-9129"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-22T17:15:06Z",
"severity": "CRITICAL"
},
"details": "In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. \n\nReported by Dylan Marino",
"id": "GHSA-56v6-7jgh-2f7r",
"modified": "2024-10-22T18:32:12Z",
"published": "2024-10-22T18:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9129"
},
{
"type": "WEB",
"url": "https://portal.perforce.com/s/detail/a91PA000001SYZFYA4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-57PF-F69P-P222
Vulnerability from github – Published: 2024-02-15 15:30 – Updated: 2025-10-22 00:32A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
{
"affected": [],
"aliases": [
"CVE-2024-23113"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-15T14:15:46Z",
"severity": "CRITICAL"
},
"details": "A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.",
"id": "GHSA-57pf-f69p-p222",
"modified": "2025-10-22T00:32:59Z",
"published": "2024-02-15T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23113"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-24-029"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-57XX-RXXV-4566
Vulnerability from github – Published: 2022-05-01 07:41 – Updated: 2022-05-01 07:41Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. NOTE: It was later reported that 5.3.0 is also vulnerable.
{
"affected": [],
"aliases": [
"CVE-2006-6751"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-12-27T00:28:00Z",
"severity": "MODERATE"
},
"details": "Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. NOTE: It was later reported that 5.3.0 is also vulnerable.",
"id": "GHSA-57xx-rxxv-4566",
"modified": "2022-05-01T07:41:08Z",
"published": "2022-05-01T07:41:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-6751"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31140"
},
{
"type": "WEB",
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/18632.txt"
},
{
"type": "WEB",
"url": "http://downloads.securityfocus.com/vulnerabilities/exploits/22747.pl"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/18632"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/22747"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/0786"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-599V-778R-52J4
Vulnerability from github – Published: 2022-05-02 06:18 – Updated: 2022-05-02 06:18Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.
{
"affected": [],
"aliases": [
"CVE-2010-1039"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-05-20T17:30:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name.",
"id": "GHSA-599v-778r-52j4",
"modified": "2022-05-02T06:18:20Z",
"published": "2022-05-02T06:18:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1039"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58718"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11986"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12103"
},
{
"type": "WEB",
"url": "http://aix.software.ibm.com/aix/efixes/security/pcnfsd_advisory.asc"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=127428077629933\u0026w=2"
},
{
"type": "WEB",
"url": "http://osvdb.org/64729"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39835"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39911"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1024016"
},
{
"type": "WEB",
"url": "http://www.checkpoint.com/defense/advisories/public/2010/cpai-13-May.html"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ73590"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ73599"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ73681"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ73757"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ73874"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ75369"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ75440"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IZ75465"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/511405/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40248"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023994"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1199"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1211"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1212"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1213"
},
{
"type": "WEB",
"url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=5088"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5FR6-V2FQ-5JCC
Vulnerability from github – Published: 2022-05-17 05:42 – Updated: 2022-05-17 05:42Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.
{
"affected": [],
"aliases": [
"CVE-2011-0173"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-03-23T02:00:00Z",
"severity": "MODERATE"
},
"details": "Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.",
"id": "GHSA-5fr6-v2fq-5jcc",
"modified": "2022-05-17T05:42:26Z",
"published": "2022-05-17T05:42:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0173"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4581"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5G4W-M5HX-7HW6
Vulnerability from github – Published: 2022-05-01 23:32 – Updated: 2022-05-01 23:32Format string vulnerability in the logging function in Larson Network Print Server (LstNPS) 9.4.2 build 105 and earlier for Windows might allow remote attackers to execute arbitrary code via format string specifiers in a USEP command on TCP port 3114.
{
"affected": [],
"aliases": [
"CVE-2008-0764"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-02-13T21:00:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in the logging function in Larson Network Print Server (LstNPS) 9.4.2 build 105 and earlier for Windows might allow remote attackers to execute arbitrary code via format string specifiers in a USEP command on TCP port 3114.",
"id": "GHSA-5g4w-m5hx-7hw6",
"modified": "2022-05-01T23:32:58Z",
"published": "2022-05-01T23:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0764"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40420"
},
{
"type": "WEB",
"url": "http://aluigi.altervista.org/adv/lstnpsx-adv.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28890"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/487956/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/27732"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/0500"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Choose a language that is not subject to this flaw.
Mitigation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
Mitigation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
CAPEC-135: Format String Injection
An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.
CAPEC-67: String Format Overflow in syslog()
This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter leading to a format string injection attack. Adversaries can then inject malicious format string commands into the function call leading to a buffer overflow. There are many reported software vulnerabilities with the root cause being a misuse of the syslog() function.