Description
Format string vulnerability in Brian Wotring Osiris before 4.2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified attack vectors related to the logging functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | osiris | 4.0.6-1sarge1 | DSA-1129 |
Advisories 1
- DSA-1129 osiris - format string Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1129 vendor-advisory
- http://osiris.shmoo.com/ChangeLog
- ADV-2006-3072 vdb-entry
- 19213 vdb-entry
- 21265 third-party-advisory
- 27645 vdb-entry
- 21257 third-party-advisory
- http://osiris.shmoo.com/download.html