Description
wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | wwwoffle | 2.7a-1.2 | DSA-144 |
Advisories 1
- DSA-144 wwwoffle - improper input handling Debian Security (DSA / DLA) · Mar 9, 2026
References
- wwwoffle-neg-length-bo(9619) vdb-entry
- 5260 vdb-entry
- 20020718 wwwoffle-2.7b and prior segfaults with negative Content-Length value mailing-list
- DSA-144 vendor-advisory
- SuSE-SA:2002:029 vendor-advisory