Description
Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | ez-ipupdate | 3.0.11b8-8 | — |
| Debian 3.0 | ez-ipupdate | 3.0.11b5-1woody2 | DSA-592-1 |
Advisories 1
- DSA-592-1 ez-ipupdate - format string Debian Security (DSA / DLA) · Mar 9, 2026
References
- eziupdate-showmessage-format-string(18032) vdb-entry
- DSA-592 vendor-advisory
- 13167 third-party-advisory
- 11657 vdb-entry
- GLSA-200411-20 vendor-advisory
- MDKSA-2004:129 vendor-advisory
- 20041111 ez-ipupdate format string bug mailing-list