Description
Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | oops | 1.5.19.cvs.20010818-0.1woody1 | DSA-726-1 |
Advisories 1
- DSA-726-1 oops - format string vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200505-02 vendor-advisory
- DSA-726 vendor-advisory
- http://rst.void.ru/papers/advisory24.txt
- oops-format-string(20191) vdb-entry
- 13172 vdb-entry