Description
Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | neon | 0.19.3-2woody3 | DSA-487 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | openoffice.org +2 | 1.1.0-15.EL | RHSA-2004:160 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Neon WebDAV Client Library 0.2x - Format String EDB-23999 · dos · Apr 14, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- DSA-487 neon - format string Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2004:160 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 10136 vdb-entry
- GLSA-200405-04 vendor-advisory
- RHSA-2004:157 vendor-advisory
- 20040416 [OpenPKG-SA-2004.016] OpenPKG Security Advisory (neon) mailing-list
- GLSA-200405-01 vendor-advisory
- RHSA-2004:160 vendor-advisory
- MDKSA-2004:032 vendor-advisory
- DSA-487 vendor-advisory
- oval:org.mitre.oval:def:1065 vdb-entry signature
- oval:org.mitre.oval:def:10913 vdb-entry signature
- SuSE-SA:2004:009 vendor-advisory
- RHSA-2004:158 vendor-advisory
- RHSA-2004:159 vendor-advisory
- 20040416 void.at - neon format string bugs mailing-list
- 11363 third-party-advisory
- SuSE-SA:2004:008 vendor-advisory
- FEDORA-2004-1552 vendor-advisory
- 5365 vdb-entry