Description
Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | webmin | 1.180-3sarge1 | DSA-1199-1 |
Advisories 1
- DSA-1199-1 webmin Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.webmin.com/security.html
- 17749 third-party-advisory
- GLSA-200512-02 vendor-advisory
- [Dailydave] 20051129 Webmin miniserv.pl format string vulnerability mailing-list
- DSA-1199 vendor-advisory
- http://www.webmin.com/changes-1.250.html
- 18101 third-party-advisory
- ADV-2005-2660 vdb-entry
- SUSE-SR:2005:030 vendor-advisory
- 17878 third-party-advisory
- http://www.dyadsecurity.com/webmin-0001.html
- 20051129 Webmin miniserv.pl format string vulnerability mailing-list
- http://www.webmin.com/uchanges-1.180.html
- 22556 third-party-advisory
- MDKSA-2005:223 vendor-advisory
- 17942 third-party-advisory
- 17817 third-party-advisory