Uncontrolled format string
Format string attacks are a new class of vulnerbilities discovered in June of 2000 previously thought harmless. The problem exists in the %n format token for C's printf() format strings that commands printf() to write back the number of bytes formatted to the same argument to printf(), assuming that the corresponding argument exists, and is of type int * . Software that allows unfiltered user input as the first argument to printf() is vulnerable to format string attacks.
This is a common vulnerability due to the fact that format bugs were previously thought harmless and resulted in vulnerabilites in many common tools. MITRE's CVE project list roughly 150 vulnerable programs.
Format bugs are because C's argument passing conventions are type-unsafe. In particular, the varargs mechanism allows functions to accept any number of arguments (e.g. printf) by "popping" as many [Argument|arguments] off the call stack as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what type.