cve.bz

CWE-134: Use of Externally-Controlled Format String, page 4

Filter

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

What the weakness is: CWE-134 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-134, as MITRE names them. Credits.

Ask an AI about CWE-134

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-134: Use of Externally-Controlled Format String and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/134.html and https://cve.bz/cve/cwe/134?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2022-40604EPSS 2.1%

    In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

  2. 8.1CVE-2022-26393EPSS 0.7%

    The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.

  3. 6.5CVE-2022-26392EPSS 0.7%

    The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to…

  4. 9.8CVE-2022-34747EPSS 1.8%

    A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.

  5. 7.8CVE-2022-22299EPSS 0.2%

    A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy…

  6. 6.0CVE-2022-2652EPSS 0.3%

    Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request …

  7. 7.5CVE-2022-31753EPSS 0.7%

    The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.

  8. 7.8CVE-2022-1215EPSS 0.4%

    A format string vulnerability was found in libinput

  9. 9.8CVE-2022-26674EPSS 2.8%

    ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.

  10. 9.8CVE-2022-27177EPSS 2.3%

    A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2

  11. 9.8CVE-2021-42911EPSS 3.5%

    A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could …

  12. 9.8CVE-2021-41193EPSS 2.5%

    wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. …

  13. 7.8CVE-2022-24051EPSS 0.7%

    MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerabilit…

  14. 8.8CVE-2021-43041EPSS 2.4%

    An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application.

  15. 5.3CVE-2021-37735EPSS 1.3%

    A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.10 and below; Aruba Instant 8.6.x.x: 8.6.0.4 and below. Aruba has released patches…

  16. 5.5CVE-2021-25489KEVEPSS 0.5%

    Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

  17. 9.8CVE-2021-36161EPSS 2.5%

    Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout,…

  18. 8.8CVE-2021-33886EPSS 0.8%

    An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statement…

  19. 6.5CVE-2021-28846EPSS 0.8%

    A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40d…

  20. 7.5CVE-2021-32785EPSS 2.7%

    mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2…

  21. 7.8CVE-2021-35331EPSS 1.7%

    In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

  22. 8.8CVE-2021-33535EPSS 1.6%

    In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server bu…

  23. 7.8CVE-2021-29740EPSS 0.3%

    IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context of process memory, potentially escalati…

  24. 7.8CVE-2021-30145EPSS 2.4%

    A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.

  25. 8.2CVE-2020-36323EPSS 2.0%

    In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

  26. 9.8CVE-2021-20307EPSS 1.9%

    Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.

  27. 8.8CVE-2020-29018EPSS 2.1%

    A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.

  28. 9.8CVE-2020-35869EPSS 1.7%

    An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.

  29. 7.1CVE-2020-27524EPSS 1.2%

    On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the ser…

  30. 7.5CVE-2020-27523EPSS 2.0%

    Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_system parameter during the authentication process. This may crash the server and…

  31. 9.8CVE-2020-27853EPSS 3.9%

    Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wir…

  32. 7.5CVE-2020-15203EPSS 1.0%

    In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use i…

  33. 3.5CVE-2020-16142EPSS 0.8%

    On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.

  34. 6.3CVE-2020-15634EPSS 1.4%

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific fl…

  35. 9.8CVE-2020-13160ExploitEPSS 81%

    AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.

  36. 9.8CVE-2020-1992EPSS 3.5%

    A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a denial of service condition or potentially execute code with ro…

  37. 7.8CVE-2020-1979EPSS 1.0%

    A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the r…

  38. 8.8CVE-2019-5143EPSS 4.5%

    An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the time server buffer, resulting …

  39. 7.5CVE-2014-6262EPSS 7.2%

    Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…

  40. 8.8CVE-2020-3118KEVEPSS 12%

    A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to impro…

  41. 9.8CVE-2018-10389EPSS 2.3%

    Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.

  42. 9.8CVE-2018-10388EPSS 4.4%

    Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.

  43. 7.5CVE-2019-11287EPSS 4.4%

    Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a deni…

  44. 9.8CVE-2012-0824EPSS 1.8%

    gnusound 0.7.5 has format string issue

  45. 7.8CVE-2011-1588EPSS 1.1%

    Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.

  46. 9.8CVE-2010-3438EPSS 1.7%

    libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the cli…

  47. 6.5CVE-2019-18420EPSS 2.9%

    An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to i…

  48. 5.5CVE-2019-13318EPSS 5.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o…

  49. 9.8CVE-2019-6840EPSS 1.1%

    A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touc…

  50. 7.5CVE-2019-15547EPSS 1.2%

    An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.