Description

Clasp uses printf() to log errors and useful information, in one instance of this logging - the printf() call specifies format operators but lacks the appropriate arguments - leading to unrelated bytes being included in the output.

Impact

This vulnerability is capable of allowing an attacker to receive bytes from the memory of the clang process. It should be noted that printf() only logs to the local console so exploiting this would require a very unlikely configuration.