Description
Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dillo | 3.0-1 | — |
| Debian 13 | dillo | 3.0-1 | — |
| Debian 12 | dillo | 3.0-1 | — |
References
- http://www.ocert.org/advisories/ocert-2009-008.html
- 20090703 [oCERT-2009-008] Dillo integer overflow mailing-list
- 35647 third-party-advisory
- 55656 vdb-entry