← Back
CWE-134

423 CVEs • Abstraction: Base • Likelihood of Exploit: High

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

JSON object

Loading...

CVEs (423)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-12702
1Advantech
1Webaccess
May 13, 2026
Aug 30, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an a...Show more
An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.Show less
CVE-2016-5716
1Puppet
1Puppet Enterprise
May 13, 2026
Aug 9, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.
CVE-2017-12588
1Rsyslog
1Rsyslog
May 13, 2026
Aug 6, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.
CVE-2017-10685
2Gnu
Invisible Island
2Ncurses
Ncurses
Jul 23, 2026
Jun 29, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.
CVE-2017-9212
1Bavarian Motor Works
1Bluetooth Stack
May 13, 2026
May 23, 2017
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
The Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via %x or %c format string specifiers in a device name.
CVE-2016-4864
1Dena
1H2o
May 13, 2026
May 12, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
CVE-2015-8107
1Gnu
1A2ps
May 13, 2026
Apr 13, 2017
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
CVE-2016-5074
1Cloudviewnms
1Cloudview Nms
May 13, 2026
Apr 10, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
CloudView NMS before 2.10a has a format string issue exploitable over SNMP.
CVE-2015-7271
1Dell
1Integrated Remote Access Controller Firmware
May 13, 2026
Apr 10, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.
CVE-2017-2403
1Apple
1Mac Os X
May 13, 2026
Apr 2, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Printing" component. A format-string vulnerability allows remote attackers to execute arbitrary code via a craf...Show more
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Printing" component. A format-string vulnerability allows remote attackers to execute arbitrary code via a crafted ipp: or ipps: URL.Show less
CVE-2017-5524
1Plone
1Plone
May 13, 2026
Mar 23, 2017
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
CVE-2017-3859
1Cisco
1Ios Xe
May 13, 2026
Mar 22, 2017
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vul...Show more
A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted DHCP packet for Zero Touch Provisioning. An attacker could exploit this vulnerability by sending a specially crafted DHCP packet to an affected device. An exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco ASR 920 Series Aggregation Services Routers that are running an affected release of Cisco IOS XE Software (3.13 through 3.18) and are listening on the DHCP server port. By default, the devices do not listen on the DHCP server port. Cisco Bug IDs: CSCuy56385.Show less
CVE-2017-5613
1Cpanel
2Cgiecho
Cgiemail
May 13, 2026
Mar 3, 2017
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
CVE-2016-4448
8Apple
HpMcafee+5 more
19Enterprise Linux Desktop
Enterprise Linux ServerEnterprise Linux Server Aus+16 more
May 6, 2026
Jun 9, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVE-2015-8106
2Fedoraproject
Latex2rtf Project
2Fedora
Latex2rtf
May 6, 2026
Apr 18, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file...Show more
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.Show less
CVE-2015-8617
1Php
1Php
May 6, 2026
Jan 19, 2016
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misuse...Show more
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.Show less
CVE-2015-2894
1Idera
1Uptime Infrastructure Monitor
May 6, 2026
Dec 31, 2015
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
CVE-2015-6285
1Cisco
1Email Security Appliance
May 6, 2026
Sep 14, 2015
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP reques...Show more
Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug21497.Show less
CVE-2014-8625
1Debian
1Dpkg
May 6, 2026
Jan 20, 2015
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format stri...Show more
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.Show less
CVE-2013-2131
1Rrdtool Project
1Rrdtool
May 6, 2026
Jan 4, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.