Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2007-0017

Summary
Assigner-mitre
Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At-03 Jan, 2007 | 02:00
Updated At-07 Aug, 2024 | 12:03
Rejected At-
Credits

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mitre
Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At:03 Jan, 2007 | 02:00
Updated At:07 Aug, 2024 | 12:03
Rejected At:
▼CVE Numbering Authority (CNA)

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
http://www.securityfocus.com/bid/21852
vdb-entry
x_refsource_BID
http://www.vupen.com/english/advisories/2007/0026
vdb-entry
x_refsource_VUPEN
http://secunia.com/advisories/23971
third-party-advisory
x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/31226
vdb-entry
x_refsource_XF
http://osvdb.org/31163
vdb-entry
x_refsource_OSVDB
http://www.novell.com/linux/security/advisories/2007_13_xine.html
vendor-advisory
x_refsource_SUSE
http://securitytracker.com/id?1017464
vdb-entry
x_refsource_SECTRACK
http://secunia.com/advisories/23829
third-party-advisory
x_refsource_SECUNIA
http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
x_refsource_CONFIRM
http://secunia.com/advisories/23592
third-party-advisory
x_refsource_SECUNIA
http://secunia.com/advisories/23910
third-party-advisory
x_refsource_SECUNIA
http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
x_refsource_MISC
http://security.gentoo.org/glsa/glsa-200701-24.xml
vendor-advisory
x_refsource_GENTOO
http://projects.info-pull.com/moab/MOAB-02-01-2007.html
x_refsource_MISC
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313
vdb-entry
signature
x_refsource_OVAL
http://www.videolan.org/sa0701.html
x_refsource_CONFIRM
http://trac.videolan.org/vlc/changeset/18481
x_refsource_CONFIRM
http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
mailing-list
x_refsource_MLIST
http://www.debian.org/security/2007/dsa-1252
vendor-advisory
x_refsource_DEBIAN
http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
x_refsource_MISC
Hyperlink: http://www.securityfocus.com/bid/21852
Resource:
vdb-entry
x_refsource_BID
Hyperlink: http://www.vupen.com/english/advisories/2007/0026
Resource:
vdb-entry
x_refsource_VUPEN
Hyperlink: http://secunia.com/advisories/23971
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/31226
Resource:
vdb-entry
x_refsource_XF
Hyperlink: http://osvdb.org/31163
Resource:
vdb-entry
x_refsource_OSVDB
Hyperlink: http://www.novell.com/linux/security/advisories/2007_13_xine.html
Resource:
vendor-advisory
x_refsource_SUSE
Hyperlink: http://securitytracker.com/id?1017464
Resource:
vdb-entry
x_refsource_SECTRACK
Hyperlink: http://secunia.com/advisories/23829
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
Resource:
x_refsource_CONFIRM
Hyperlink: http://secunia.com/advisories/23592
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://secunia.com/advisories/23910
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
Resource:
x_refsource_MISC
Hyperlink: http://security.gentoo.org/glsa/glsa-200701-24.xml
Resource:
vendor-advisory
x_refsource_GENTOO
Hyperlink: http://projects.info-pull.com/moab/MOAB-02-01-2007.html
Resource:
x_refsource_MISC
Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313
Resource:
vdb-entry
signature
x_refsource_OVAL
Hyperlink: http://www.videolan.org/sa0701.html
Resource:
x_refsource_CONFIRM
Hyperlink: http://trac.videolan.org/vlc/changeset/18481
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.debian.org/security/2007/dsa-1252
Resource:
vendor-advisory
x_refsource_DEBIAN
Hyperlink: http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
http://www.securityfocus.com/bid/21852
vdb-entry
x_refsource_BID
x_transferred
http://www.vupen.com/english/advisories/2007/0026
vdb-entry
x_refsource_VUPEN
x_transferred
http://secunia.com/advisories/23971
third-party-advisory
x_refsource_SECUNIA
x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/31226
vdb-entry
x_refsource_XF
x_transferred
http://osvdb.org/31163
vdb-entry
x_refsource_OSVDB
x_transferred
http://www.novell.com/linux/security/advisories/2007_13_xine.html
vendor-advisory
x_refsource_SUSE
x_transferred
http://securitytracker.com/id?1017464
vdb-entry
x_refsource_SECTRACK
x_transferred
http://secunia.com/advisories/23829
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
x_refsource_CONFIRM
x_transferred
http://secunia.com/advisories/23592
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://secunia.com/advisories/23910
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
x_refsource_MISC
x_transferred
http://security.gentoo.org/glsa/glsa-200701-24.xml
vendor-advisory
x_refsource_GENTOO
x_transferred
http://projects.info-pull.com/moab/MOAB-02-01-2007.html
x_refsource_MISC
x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313
vdb-entry
signature
x_refsource_OVAL
x_transferred
http://www.videolan.org/sa0701.html
x_refsource_CONFIRM
x_transferred
http://trac.videolan.org/vlc/changeset/18481
x_refsource_CONFIRM
x_transferred
http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
mailing-list
x_refsource_MLIST
x_transferred
http://www.debian.org/security/2007/dsa-1252
vendor-advisory
x_refsource_DEBIAN
x_transferred
http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
x_refsource_MISC
x_transferred
Hyperlink: http://www.securityfocus.com/bid/21852
Resource:
vdb-entry
x_refsource_BID
x_transferred
Hyperlink: http://www.vupen.com/english/advisories/2007/0026
Resource:
vdb-entry
x_refsource_VUPEN
x_transferred
Hyperlink: http://secunia.com/advisories/23971
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/31226
Resource:
vdb-entry
x_refsource_XF
x_transferred
Hyperlink: http://osvdb.org/31163
Resource:
vdb-entry
x_refsource_OSVDB
x_transferred
Hyperlink: http://www.novell.com/linux/security/advisories/2007_13_xine.html
Resource:
vendor-advisory
x_refsource_SUSE
x_transferred
Hyperlink: http://securitytracker.com/id?1017464
Resource:
vdb-entry
x_refsource_SECTRACK
x_transferred
Hyperlink: http://secunia.com/advisories/23829
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://secunia.com/advisories/23592
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://secunia.com/advisories/23910
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
Resource:
x_refsource_MISC
x_transferred
Hyperlink: http://security.gentoo.org/glsa/glsa-200701-24.xml
Resource:
vendor-advisory
x_refsource_GENTOO
x_transferred
Hyperlink: http://projects.info-pull.com/moab/MOAB-02-01-2007.html
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313
Resource:
vdb-entry
signature
x_refsource_OVAL
x_transferred
Hyperlink: http://www.videolan.org/sa0701.html
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://trac.videolan.org/vlc/changeset/18481
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.debian.org/security/2007/dsa-1252
Resource:
vendor-advisory
x_refsource_DEBIAN
x_transferred
Hyperlink: http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cve@mitre.org
Published At:03 Jan, 2007 | 02:28
Updated At:11 Oct, 2017 | 01:31

Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.06.8MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Type: Primary
Version: 2.0
Base score: 6.8
Base severity: MEDIUM
Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
CPE Matches

VideoLAN
videolan
>>vlc_media_player>>0.7.0
cpe:2.3:a:videolan:vlc_media_player:0.7.0:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.7.1
cpe:2.3:a:videolan:vlc_media_player:0.7.1:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.7.2
cpe:2.3:a:videolan:vlc_media_player:0.7.2:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.0
cpe:2.3:a:videolan:vlc_media_player:0.8.0:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.1
cpe:2.3:a:videolan:vlc_media_player:0.8.1:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.2
cpe:2.3:a:videolan:vlc_media_player:0.8.2:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.4
cpe:2.3:a:videolan:vlc_media_player:0.8.4:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.4a
cpe:2.3:a:videolan:vlc_media_player:0.8.4a:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.5
cpe:2.3:a:videolan:vlc_media_player:0.8.5:*:*:*:*:*:*:*
VideoLAN
videolan
>>vlc_media_player>>0.8.6
cpe:2.3:a:videolan:vlc_media_player:0.8.6:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-134Primarynvd@nist.gov
CWE ID: CWE-134
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.htmlcve@mitre.org
N/A
http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.htmlcve@mitre.org
N/A
http://osvdb.org/31163cve@mitre.org
N/A
http://projects.info-pull.com/moab/MOAB-02-01-2007.htmlcve@mitre.org
Exploit
Vendor Advisory
http://secunia.com/advisories/23592cve@mitre.org
Vendor Advisory
http://secunia.com/advisories/23829cve@mitre.org
Vendor Advisory
http://secunia.com/advisories/23910cve@mitre.org
Vendor Advisory
http://secunia.com/advisories/23971cve@mitre.org
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200701-24.xmlcve@mitre.org
N/A
http://securitytracker.com/id?1017464cve@mitre.org
N/A
http://trac.videolan.org/vlc/changeset/18481cve@mitre.org
N/A
http://www.debian.org/security/2007/dsa-1252cve@mitre.org
N/A
http://www.novell.com/linux/security/advisories/2007_13_xine.htmlcve@mitre.org
N/A
http://www.securityfocus.com/bid/21852cve@mitre.org
N/A
http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.htmlcve@mitre.org
N/A
http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patchcve@mitre.org
Patch
http://www.videolan.org/sa0701.htmlcve@mitre.org
Vendor Advisory
http://www.vupen.com/english/advisories/2007/0026cve@mitre.org
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/31226cve@mitre.org
N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313cve@mitre.org
N/A
Hyperlink: http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://osvdb.org/31163
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://projects.info-pull.com/moab/MOAB-02-01-2007.html
Source: cve@mitre.org
Resource:
Exploit
Vendor Advisory
Hyperlink: http://secunia.com/advisories/23592
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: http://secunia.com/advisories/23829
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: http://secunia.com/advisories/23910
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: http://secunia.com/advisories/23971
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: http://security.gentoo.org/glsa/glsa-200701-24.xml
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://securitytracker.com/id?1017464
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://trac.videolan.org/vlc/changeset/18481
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.debian.org/security/2007/dsa-1252
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.novell.com/linux/security/advisories/2007_13_xine.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.securityfocus.com/bid/21852
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html
Source: cve@mitre.org
Resource: N/A
Hyperlink: http://www.videolan.org/patches/vlc-0.8.6-MOAB-02-01-2007.patch
Source: cve@mitre.org
Resource:
Patch
Hyperlink: http://www.videolan.org/sa0701.html
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: http://www.vupen.com/english/advisories/2007/0026
Source: cve@mitre.org
Resource:
Vendor Advisory
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/31226
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14313
Source: cve@mitre.org
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

72Records found

CVE-2015-8107
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-1.72% / 81.64%
||
7 Day CHG~0.00%
Published-13 Apr, 2017 | 14:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.

Action-Not Available
Vendor-n/aGNU
Product-a2psn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2008-1705
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-5.22% / 89.57%
||
7 Day CHG~0.00%
Published-09 Apr, 2008 | 19:00
Updated-07 Aug, 2024 | 08:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fields.

Action-Not Available
Vendor-n/aIBM Corporation
Product-soliddbn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2008-2310
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.86% / 74.12%
||
7 Day CHG~0.00%
Published-01 Jul, 2008 | 18:00
Updated-07 Aug, 2024 | 08:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_x_servermac_os_xn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2008-1206
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-5.57% / 89.92%
||
7 Day CHG~0.00%
Published-08 Mar, 2008 | 00:00
Updated-07 Aug, 2024 | 08:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.

Action-Not Available
Vendor-linux_kiss_servern/a
Product-linux_kiss_servern/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2008-0072
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-13.41% / 93.92%
||
7 Day CHG~0.00%
Published-06 Mar, 2008 | 00:00
Updated-07 Aug, 2024 | 07:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

Action-Not Available
Vendor-n/aThe GNOME ProjectLinux Kernel Organization, Inc
Product-linux_kernelevolutionn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2007-6183
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-2.54% / 84.88%
||
7 Day CHG~0.00%
Published-30 Nov, 2007 | 00:00
Updated-07 Aug, 2024 | 15:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.

Action-Not Available
Vendor-ruby_gnome2n/a
Product-ruby_gnome2n/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2021-35331
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.75% / 72.11%
||
7 Day CHG~0.00%
Published-05 Jul, 2021 | 14:59
Updated-04 Aug, 2024 | 01:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

Action-Not Available
Vendor-n/aTCL
Product-tcln/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2007-5396
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-6.8||MEDIUM
EPSS-2.64% / 85.15%
||
7 Day CHG~0.00%
Published-10 Nov, 2007 | 00:00
Updated-07 Aug, 2024 | 15:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in the ext_yahoo_contact_added function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo! handle (who).

Action-Not Available
Vendor-miranda-imn/a
Product-miranda_imn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2021-30145
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-4.48% / 88.66%
||
7 Day CHG~0.00%
Published-18 May, 2021 | 13:34
Updated-03 Aug, 2024 | 22:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.

Action-Not Available
Vendor-mpvn/a
Product-mpvn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2017-12702
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-8.8||HIGH
EPSS-0.43% / 61.84%
||
7 Day CHG~0.00%
Published-30 Aug, 2017 | 18:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.

Action-Not Available
Vendor-n/aAdvantech (Advantech Co., Ltd.)
Product-webaccessAdvantech WebAccess
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2007-0051
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-34.88% / 96.89%
||
7 Day CHG+0.83%
Published-04 Jan, 2007 | 18:00
Updated-07 Aug, 2024 | 12:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.

Action-Not Available
Vendor-n/aApple Inc.
Product-iphoton/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2014-8625
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-2.46% / 84.62%
||
7 Day CHG~0.00%
Published-20 Jan, 2015 | 15:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.

Action-Not Available
Vendor-n/aDebian GNU/Linux
Product-dpkgn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2014-1683
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-78.53% / 99.00%
||
7 Day CHG~0.00%
Published-29 Jan, 2014 | 18:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.

Action-Not Available
Vendor-skybluecanvasn/a
Product-skybluecanvasn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2017-2403
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-8.8||HIGH
EPSS-1.02% / 76.33%
||
7 Day CHG~0.00%
Published-02 Apr, 2017 | 01:36
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Printing" component. A format-string vulnerability allows remote attackers to execute arbitrary code via a crafted ipp: or ipps: URL.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2014-1315
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-6.8||MEDIUM
EPSS-1.26% / 78.54%
||
7 Day CHG~0.00%
Published-23 Apr, 2014 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2012-4426
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-14.86% / 94.27%
||
7 Day CHG~0.00%
Published-21 Nov, 2012 | 23:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.

Action-Not Available
Vendor-mcryptn/a
Product-mcryptn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2004-0179
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-7.83% / 91.61%
||
7 Day CHG~0.00%
Published-16 Apr, 2004 | 04:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.

Action-Not Available
Vendor-webdavn/aDebian GNU/LinuxThe Apache Software Foundation
Product-openofficecadaverdebian_linuxsubversionneonn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2018-16554
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.30% / 52.39%
||
7 Day CHG~0.00%
Published-16 Sep, 2018 | 02:00
Updated-05 Aug, 2024 | 10:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling.

Action-Not Available
Vendor-jhead_projectn/a
Product-jheadn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2003-1381
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-4.25% / 88.35%
||
7 Day CHG~0.00%
Published-19 Oct, 2007 | 10:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.

Action-Not Available
Vendor-amxmod.netn/a
Product-amx_modn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2010-2950
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.43% / 61.60%
||
7 Day CHG~0.00%
Published-28 Sep, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

Action-Not Available
Vendor-n/aThe PHP Group
Product-phpn/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2019-1579
Matching Score-4
Assigner-Palo Alto Networks, Inc.
ShareView Details
Matching Score-4
Assigner-Palo Alto Networks, Inc.
CVSS Score-8.1||HIGH
EPSS-92.44% / 99.72%
||
7 Day CHG~0.00%
Published-19 Jul, 2019 | 21:12
Updated-30 Jul, 2025 | 01:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2022-07-10||Apply updates per vendor instructions.

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Action-Not Available
Vendor-n/aPalo Alto Networks, Inc.
Product-pan-osPalo Alto Networks GlobalProtect Portal/Gateway InterfacePAN-OS
CWE ID-CWE-134
Use of Externally-Controlled Format String
CVE-2017-5613
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.53% / 66.26%
||
7 Day CHG~0.00%
Published-03 Mar, 2017 | 15:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.

Action-Not Available
Vendor-n/acPanel (WebPros International, LLC)
Product-cgiemailcgiechon/a
CWE ID-CWE-134
Use of Externally-Controlled Format String
  • Previous
  • 1
  • 2
  • Next
Details not found