cve.bz

CWE-134: Use of Externally-Controlled Format String, page 5

Filter

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

What the weakness is: CWE-134 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-67 String Format Overflow in syslog() Likelihood: High · Severity: Very High
  • CAPEC-135 Format String Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-134, as MITRE names them. Credits.

Ask an AI about CWE-134

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-134: Use of Externally-Controlled Format String and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/134.html and https://cve.bz/cve/cwe/134?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2019-15546EPSS 1.1%

    An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.

  2. 8.8CVE-2016-10773EPSS 1.1%

    cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).

  3. 3.3CVE-2019-14412EPSS 0.4%

    Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).

  4. 3.3CVE-2019-14410EPSS 0.4%

    Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).

  5. 8.1CVE-2019-1579KEVEPSS 44%

    Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arb…

  6. 8.8CVE-2019-7228EPSS 3.7%

    The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server. Sending %08x.AAAA.%08x.%08x will log memory …

  7. 8.8CVE-2019-7230EPSS 3.7%

    The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the st…

  8. 9.8CVE-2019-12297EPSS 1.7%

    An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080.

  9. 8.1CVE-2018-14713EPSS 3.7%

    Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter.

  10. 8.6CVE-2016-10745EPSS 3.5%

    In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

  11. 7.5CVE-2019-7715EPSS 1.5%

    An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf(). Setti…

  12. 7.5CVE-2019-7712EPSS 1.5%

    An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() with…

  13. 7.5CVE-2019-7711EPSS 1.5%

    An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to print…

  14. 9.8CVE-2018-1352EPSS 1.2%

    A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable.

  15. 6.5CVE-2018-14661EPSS 2.7%

    It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to …

  16. 7.8CVE-2018-17336EPSS 0.6%

    UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact …

  17. 7.8CVE-2018-16554EPSS 1.8%

    The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a s…

  18. 5.5CVE-2018-15749EPSS 0.3%

    The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.

  19. 3.7CVE-2018-14799EPSS 0.5%

    In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.

  20. 4.4CVE-2017-7519EPSS 0.5%

    In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

  21. 7.8CVE-2018-1566EPSS 0.5%

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023.

  22. 7.2CVE-2018-12590EPSS 1.6%

    Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrator…

  23. 5.3CVE-2015-9238EPSS 1.4%

    secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

  24. 7.5CVE-2018-8778EPSS 7.5%

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#un…

  25. 8.0CVE-2018-0175KEVEPSS 3.5%

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) …

  26. 9.1CVE-2018-7544EPSS 1.8%

    A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can exec…

  27. 7.5CVE-2018-6875EPSS 1.1%

    Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to text containing characters that the device's font lacks.

  28. 5.5CVE-2017-17132EPSS 0.2%

    Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service.

  29. 7.5CVE-2018-1000052EPSS 1.4%

    fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack…

  30. 8.0CVE-2018-6508EPSS 1.9%

    Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if y…

  31. 9.1CVE-2018-6317ExploitEPSS 44%

    The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.

  32. 9.8CVE-2017-17407EPSS 3.9%

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exi…

  33. 9.8CVE-2017-16608EPSS 4.2%

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within exec.jsp. The iss…

  34. 8.8CVE-2017-16602EPSS 3.2%

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing auth…

  35. 9.6CVE-2018-5704EPSS 4.6%

    Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands…

  36. 7.5CVE-2018-5207EPSS 1.9%

    When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.

  37. 7.5CVE-2018-5205EPSS 2.4%

    When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.

  38. 7.5CVE-2017-16516EPSS 3.8%

    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process …

  39. 7.5CVE-2017-15191EPSS 2.7%

    In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.

  40. 8.8CVE-2014-8170EPSS 3.5%

    ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users …

  41. 9.1CVE-2017-0898EPSS 9.7%

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an inform…

  42. 6.5CVE-2016-1895EPSS 1.5%

    NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input string handling.

  43. 8.8CVE-2017-12702EPSS 2.3%

    An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute …

  44. 8.8CVE-2016-5716EPSS 1.8%

    The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.

  45. 9.8CVE-2017-12588EPSS 2.8%

    The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.

  46. 9.8CVE-2017-10685EPSS 4.3%

    In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

  47. 7.5CVE-2017-9212EPSS 1.1%

    The Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via %x or %c format string specifiers in a device name.

  48. 7.5CVE-2016-4864EPSS 1.8%

    H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.

  49. 7.8CVE-2015-8107EPSS 2.8%

    Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.

  50. 9.8CVE-2016-5074EPSS 1.3%

    CloudView NMS before 2.10a has a format string issue exploitable over SNMP.