Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary c…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 2

• DSA-930-2 smstools - format string attack Debian Security (DSA / DLA) · Mar 9, 2026
• DSA-930-1 smstools - format string error Debian Security (DSA / DLA) · Mar 9, 2026

References

• smstools-logging-format-string(24034) vdb-entry
• 18343 third-party-advisory
• 18357 third-party-advisory
• 16188 vdb-entry
• 22287 vdb-entry
• DSA-930 vendor-advisory