Format string vulnerability in gxine 0.4.1 through 0.4.4 and other versions down to 0.3 allows remote attackers to execute arbitrary code via a ram file with a URL whose hostname contains format string specifiers.