CWE-134
AllowedUse of Externally-Controlled Format String
Abstraction: Base · Status: Draft
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
530 vulnerabilities reference this CWE, most recent first.
GHSA-8JH7-G9VM-29CW
Vulnerability from github – Published: 2022-05-01 18:26 – Updated: 2022-05-01 18:26Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler.
{
"affected": [],
"aliases": [
"CVE-2007-4708"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-12-19T21:46:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler.",
"id": "GHSA-8jh7-g9vm-29cw",
"modified": "2022-05-01T18:26:28Z",
"published": "2022-05-01T18:26:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4708"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39092"
},
{
"type": "WEB",
"url": "http://docs.info.apple.com/article.html?artnum=307179"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28136"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1019106"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/26910"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/4238"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8JQ2-G365-87PP
Vulnerability from github – Published: 2022-05-02 03:58 – Updated: 2022-05-02 03:58VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\x90 sequence in the USER and PASS commands, a related issue to CVE-2009-3707. NOTE: some of these details are obtained from third party information.
{
"affected": [],
"aliases": [
"CVE-2009-4811"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-04-27T15:30:00Z",
"severity": "MODERATE"
},
"details": "VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \\x25\\x90 sequence in the USER and PASS commands, a related issue to CVE-2009-3707. NOTE: some of these details are obtained from third party information.",
"id": "GHSA-8jq2-g365-87pp",
"modified": "2022-05-02T03:58:28Z",
"published": "2022-05-02T03:58:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4811"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html"
},
{
"type": "WEB",
"url": "http://freetexthost.com/qr1tffkzpu"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2010/000090.html"
},
{
"type": "WEB",
"url": "http://pocoftheday.blogspot.com/2009/10/vmware-server-20x-remote-dos-exploit.html"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201209-25.xml"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36630"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2010-0007.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8P45-XMRJ-4V5C
Vulnerability from github – Published: 2022-05-03 03:14 – Updated: 2022-05-03 03:14Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.
{
"affected": [],
"aliases": [
"CVE-2005-3656"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.",
"id": "GHSA-8p45-xmrj-4v5c",
"modified": "2022-05-03T03:14:34Z",
"published": "2022-05-03T03:14:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3656"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10600"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/239-1"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18304"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18321"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18347"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18348"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18350"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18397"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18403"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18463"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18517"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1015446"
},
{
"type": "WEB",
"url": "http://www.debian.de/security/2006/dsa-935"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200601-05.xml"
},
{
"type": "WEB",
"url": "http://www.giuseppetanzilli.it/mod%5Fauth%5Fpgsql2"
},
{
"type": "WEB",
"url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=367"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:009"
},
{
"type": "WEB",
"url": "http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00015.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00016.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2006-0164.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/16153"
},
{
"type": "WEB",
"url": "http://www.trustix.org/errata/2006/0002"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/0070"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QH3-332V-CX7G
Vulnerability from github – Published: 2022-05-17 03:50 – Updated: 2022-05-17 03:50Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.
{
"affected": [],
"aliases": [
"CVE-2013-0929"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-01-21T21:55:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.",
"id": "GHSA-8qh3-332v-cx7g",
"modified": "2022-05-17T03:50:28Z",
"published": "2022-05-17T03:50:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0929"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-01/0078.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/57472"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QQ5-WPJC-V6G2
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.
{
"affected": [],
"aliases": [
"CVE-2026-15961"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T15:16:56Z",
"severity": "MODERATE"
},
"details": "IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.",
"id": "GHSA-8qq5-wpjc-v6g2",
"modified": "2026-08-19T15:32:37Z",
"published": "2026-08-19T15:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15961"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7283228"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QVM-3V5H-74QX
Vulnerability from github – Published: 2022-05-02 03:43 – Updated: 2022-05-02 03:43The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.
{
"affected": [],
"aliases": [
"CVE-2009-3294"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-09-22T10:30:00Z",
"severity": "MODERATE"
},
"details": "The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) \"e\" or (2) \"er\" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.",
"id": "GHSA-8qvm-3v5h-74qx",
"modified": "2022-05-02T03:43:40Z",
"published": "2022-05-02T03:43:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3294"
},
{
"type": "WEB",
"url": "http://bugs.php.net/bug.php?id=44683"
},
{
"type": "WEB",
"url": "http://news.php.net/php.announce/79"
},
{
"type": "WEB",
"url": "http://svn.php.net/viewvc?view=revision\u0026revision=287779"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/09/20/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/20/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/20/3"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/58188"
},
{
"type": "WEB",
"url": "http://www.php.net/ChangeLog-5.php"
},
{
"type": "WEB",
"url": "http://www.php.net/ChangeLog-5.php#5.2.11"
},
{
"type": "WEB",
"url": "http://www.php.net/releases/5_2_11.php"
},
{
"type": "WEB",
"url": "http://www.php.net/releases/5_3_1.php"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8R3H-PVPJ-HHCG
Vulnerability from github – Published: 2022-05-02 00:05 – Updated: 2022-05-02 00:05Format string vulnerability in the finger client in HP TCP/IP Services for OpenVMS 5.x allows local users to gain privileges via format string specifiers in a (1) .plan or (2) .project file.
{
"affected": [],
"aliases": [
"CVE-2008-3940"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-09-05T15:08:00Z",
"severity": "MODERATE"
},
"details": "Format string vulnerability in the finger client in HP TCP/IP Services for OpenVMS 5.x allows local users to gain privileges via format string specifiers in a (1) .plan or (2) .project file.",
"id": "GHSA-8r3h-pvpj-hhcg",
"modified": "2022-05-02T00:05:07Z",
"published": "2022-05-02T00:05:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3940"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44752"
},
{
"type": "WEB",
"url": "http://deathrow.vistech.net/DEFCON16/VMS.PDF"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31587"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30948"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2463"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8R7Q-R9MX-35RH
Vulnerability from github – Published: 2021-08-25 20:47 – Updated: 2021-08-19 21:18An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "rusqlite"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-35869"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:18:40Z",
"nvd_published_at": "2020-12-31T10:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.",
"id": "GHSA-8r7q-r9mx-35rh",
"modified": "2021-08-19T21:18:40Z",
"published": "2021-08-25T20:47:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35869"
},
{
"type": "WEB",
"url": "https://github.com/rusqlite/rusqlite/commit/2327d3b774927fdf48903c0bdc1ca7ec93c7c8d0"
},
{
"type": "PACKAGE",
"url": "https://github.com/rusqlite/rusqlite"
},
{
"type": "WEB",
"url": "https://github.com/rusqlite/rusqlite/releases/tag/0.23.0"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0014.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Mishandling of format strings in rusqlite"
}
GHSA-8WG2-73CR-JV3Q
Vulnerability from github – Published: 2022-05-17 01:43 – Updated: 2022-05-17 01:43Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.
{
"affected": [],
"aliases": [
"CVE-2012-3569"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-11-14T12:30:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.",
"id": "GHSA-8wg2-73cr-jv3q",
"modified": "2022-05-17T01:43:39Z",
"published": "2022-05-17T01:43:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3569"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79922"
},
{
"type": "WEB",
"url": "http://osvdb.org/87117"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/120101/VMWare-OVF-Tools-Format-String.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51240"
},
{
"type": "WEB",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr13-002"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2012-0015.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-946W-FC5X-GQQM
Vulnerability from github – Published: 2022-05-01 18:21 – Updated: 2022-05-01 18:21IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a "crafted localized message file" that enables a format string attack, possibly involving the (1) OSSEMEMDBG or (2) TRC_LOG_FILE environment variable in db2licd (db2licm).
{
"affected": [],
"aliases": [
"CVE-2007-4273"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-08-18T21:17:00Z",
"severity": "MODERATE"
},
"details": "IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a \"crafted localized message file\" that enables a format string attack, possibly involving the (1) OSSEMEMDBG or (2) TRC_LOG_FILE environment variable in db2licd (db2licm).",
"id": "GHSA-946w-fc5x-gqqm",
"modified": "2022-05-01T18:21:56Z",
"published": "2022-05-01T18:21:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4273"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36106"
},
{
"type": "WEB",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=581"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26471"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1018581"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98011"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98101"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255352"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255607"
},
{
"type": "WEB",
"url": "http://www.attrition.org/pipermail/vim/2007-August/001765.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25339"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/2912"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Choose a language that is not subject to this flaw.
Mitigation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
Mitigation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
CAPEC-135: Format String Injection
An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.
CAPEC-67: String Format Overflow in syslog()
This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter leading to a format string injection attack. Adversaries can then inject malicious format string commands into the function call leading to a buffer overflow. There are many reported software vulnerabilities with the root cause being a misuse of the syslog() function.