Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay or a spoofed eBay server to cause a denial of service and possibly execute arbitrary code via certain responses.