Red Hat Bugzilla – Bug 509921
CVE-2009-2294 dillo: PNG-related integer overflow
Last modified: 2016-03-04 07:32:04 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2294 to
the following vulnerability:
Reference: MISC: http://www.ocert.org/advisories/ocert-2009-008.html
Integer overflow in the Png_datainfo_callback function in Dillo 2.1
and earlier allows remote attackers to cause a denial of service
(crash) and possibly execute arbitrary code via a PNG image with
crafted (1) width or (2) height values.
Upstream patches to correct the issue:
It looks as though dillo 0.8.6 doesn't do any image size checks, or at least not in the same way newer dillo does, and the above patches definitely do not apply clean.
Is there a particular reason why we are still shipping dillo 0.8.6 when 2.1 is available? It doesn't look like dillo has really been touched in 2 years (last real update was Dec 6, 2007).
I can't determine whether or not the dillo packages we ship in Fedora are affected by this problem.
Andreas, is dillo still being maintained? Even now, if I use the menu item to launch dillo, it crashes on startup. The i18n version works, so there are definitely problems with this old version of dillo altogether.
It is maintained. The problem with the newer dillo is that it requires fltk2 which for a lot of reasons is not in fedora right now (and probably will not be). However there are movements in dillo to change the usage of fltk2. Until then we are stuck with the old release.
As to the crash I will try to look into the issues asap.
Thanks, Andreas. I wasn't aware of the fltk2 issues. Unfortunately, I don't have a reproducer for the security issue noted, so I have nothing to verify that dillo is for sure affected (or not). Perhaps you can examine the patches and code and see if you can tell?
Any followup on this? It's been a few months now. Thanks.
I'm going to close this. It's been a year. Nothing exciting is happening with dillo in Fedora, so it looks unmaintained to me. As I cannot reproduce this crash, I have no way to know whether dillo 0.8.6 is affected or not. There doesn't seem to be much point in keeping this bug open as a result; if someone cares to investigate this further and finds that dillo is affected, feel free to re-open and work towards a resolution.