Description
Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.11-1 | — |
| Debian 13 | glibc | 2.11-1 | — |
| Debian 12 | glibc | 2.11-1 | — |
| Debian 5.0 | glibc | 2.7-18lenny4 | DSA-2058-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- BSD (Multiple Distributions) - 'strfmon()' Integer Overflow EDB-31550 · dos · Mar 27, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2058-1 glibc - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 28479 vdb-entry
- 20080327 [securityreason] *BSD libc (strfmon) Multiple vulnerabilities mailing-list
- ADV-2008-3444 vdb-entry
- TA08-350A third-party-advisory
- bsd-strfmon-overflow(41504) vdb-entry
- 33179 third-party-advisory
- 3770 third-party-advisory
- SUSE-SA:2010:052 vendor-advisory
- http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c
- 20080325 *BSD libc (strfmon) Multiple vulnerabilities third-party-advisory
- http://support.apple.com/kb/HT3338
- DSA-2058 vendor-advisory
- APPLE-SA-2008-12-15 vendor-advisory
- 1019722 vdb-entry
- 29574 third-party-advisory