Description
Format string vulnerability in the printlog function in log2mail before 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | log2mail | 0.2.5.2 | DSA-513 |
Advisories 1
- DSA-513 log2mail - format string Debian Security (DSA / DLA) · Mar 9, 2026
References
- 10460 vdb-entry
- DSA-513 vendor-advisory
- http://felinemenace.org/~jaguar/advisories/log2mail.txt
- 6711 vdb-entry
- 11769 third-party-advisory
- log2mail-syslog-format-string(16311) vdb-entry
- 11768 third-party-advisory