Description
Multiple buffer overflows in apcupsd before 3.8.6, and 3.10.x before 3.10.5, may allow attackers to cause a denial of service or execute arbitrary code, related to usage of the vsprintf function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apcupsd | 3.8.5-1.2 | — |
| Debian 13 | apcupsd | 3.8.5-1.2 | — |
| Debian 12 | apcupsd | 3.8.5-1.2 | — |
| Debian 3.0 | apcupsd | 3.8.5-1.1.1 | DSA-277 |
Advisories 1
- DSA-277 apcupsd - buffer overflows, format string Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://sourceforge.net/project/shownotes.php?release_id=137900
- 1006108 vdb-entry
- MDKSA-2003:018 vendor-advisory
- apcupsd-vsprintf-multiple-bo(11491) vdb-entry
- 7200 vdb-entry
- SuSE-SA:2003:022 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=137892
- DSA-277 vendor-advisory