370
Research Gap
Format string issues are under-studied for languages other than C. Memory or disk consumption,
control flow or variable alteration, and data corruption may result from format string exploitation in
applications written in other languages such as Perl, PHP, Python, etc.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Format string vulnerability
7 Pernicious Kingdoms Format String
CLASP Format string problem
CERT C Secure Coding FIO30-C Exact Exclude user input from format strings
CERT C Secure Coding FIO47-C CWE More Specific Use valid format strings
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
WASC 6 Format String
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS06-J Exclude user input from format strings
SEI CERT Perl Coding
Standard
IDS30-
PL
Exact Exclude user input from format strings
Software Fault Patterns SFP24 Tainted input to command
OMG ASCSM ASCSMCWE-