365
[REF-1336]D3FEND. "Process Segment Execution Prevention (D3-PSEP)". 2023. < https://
d3fend.mitre.org/technique/d3f:ProcessSegmentExecutionPrevention/ >.2023-04-26.
[REF-1337]Alexander Sotirov and Mark Dowd. "Bypassing Browser Memory Protections: Setting
back browser security by 10 years". 2008. < https://www.blackhat.com/presentations/bh-usa-08/
Sotirov_Dowd/bh08-sotirov-dowd.pdf >.2023-04-26.
CWE-134: Use of Externally-Controlled Format String
Weakness ID : 134
Structure : Simple
Abstraction : Base
Description
The product uses a function that accepts a format string as an argument, but the format string
originates from an external source.
Extended Description
When an attacker can modify an externally-controlled format string, this can lead to buffer
overflows, denial of service, or data representation problems.
It should be noted that in some circumstances, such as internationalization, the set of format
strings is externally controlled by design. If the source of these format strings is trusted (e.g. only
contained in library files that are only modifiable by the system administrator), then the external
control might not itself pose a vulnerability.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
CanPrecede 123 Write-what-where Condition 323
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 133 String Errors 2310
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Often)
CWE Version 4.14
CWE-134: Use of Externally-Controlled Format String
CWE-134: Use of Externally-Controlled Format String