Description
Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dillo | 0.8.3-1 | — |
| Debian 13 | dillo | 0.8.3-1 | — |
| Debian 12 | dillo | 0.8.3-1 | — |
References
- GLSA-200501-11 vendor-advisory
- 13760 third-party-advisory
- 12203 vdb-entry
- dillo-capi-format-string(18807) vdb-entry
- 13764 third-party-advisory