...
| CERT Oracle Secure Coding Standard for Java | IDS06-J. Exclude unsanitized user input from format strings |
| CERT Perl Secure Coding Standard | IDS30-PL. Exclude user input from format strings |
| ISO/IEC TR 24772:2013 | Injection [RST] |
| ISO/IEC TS 17961:2013 | Including tainted or out-of-domain input in a format string [usrfmt] |
| MITRE CWE | CWE-134, Uncontrolled Format String CWE-20, Improper Input Validation |
Bibliography
| [IEEE Std 1003.1:2013] | XSH, System Interfaces, syslog |
| [Seacord 2013b] | Chapter 6, "Formatted Output" |
| [Viega 2005] | Section 5.2.23, "Format String Problem" |
...