Format string bugs exist in neon versions 0.19.0 and below when ne_set_error is changed from taking a single char to taking printf-style varargs. Release 0.24.5 fixes this problem.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33111/vsa0401.html
Source: https://packetstormsecurity.com/files/33111/vsa0401.html.html