Bug 509921 - (CVE-2009-2294) CVE-2009-2294 dillo: PNG-related integer overflow
CVE-2009-2294 dillo: PNG-related integer overflow
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
  Show dependency treegraph
Reported: 2009-07-06 17:12 EDT by Vincent Danen
Modified: 2016-03-04 07:32 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-12-20 17:32:28 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2009-07-06 17:12:48 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2294 to
the following vulnerability:

Name: CVE-2009-2294
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2294
Assigned: 20090702
Reference: MISC: http://www.ocert.org/advisories/ocert-2009-008.html

Integer overflow in the Png_datainfo_callback function in Dillo 2.1
and earlier allows remote attackers to cause a denial of service
(crash) and possibly execute arbitrary code via a PNG image with
crafted (1) width or (2) height values.
Comment 2 Vincent Danen 2009-12-02 16:10:32 EST
It looks as though dillo 0.8.6 doesn't do any image size checks, or at least not in the same way newer dillo does, and the above patches definitely do not apply clean.

Is there a particular reason why we are still shipping dillo 0.8.6 when 2.1 is available?  It doesn't look like dillo has really been touched in 2 years (last real update was Dec 6, 2007).

I can't determine whether or not the dillo packages we ship in Fedora are affected by this problem.

Andreas, is dillo still being maintained?  Even now, if I use the menu item to launch dillo, it crashes on startup.  The i18n version works, so there are definitely problems with this old version of dillo altogether.
Comment 3 Andreas Bierfert 2009-12-02 16:33:26 EST
It is maintained. The problem with the newer dillo is that it requires fltk2 which for a lot of reasons is not in fedora right now (and probably will not be). However there are movements in dillo to change the usage of fltk2. Until then we are stuck with the old release.

As to the crash I will try to look into the issues asap.
Comment 4 Vincent Danen 2009-12-02 18:14:08 EST
Thanks, Andreas.  I wasn't aware of the fltk2 issues.  Unfortunately, I don't have a reproducer for the security issue noted, so I have nothing to verify that dillo is for sure affected (or not).  Perhaps you can examine the patches and code and see if you can tell?
Comment 5 Vincent Danen 2010-04-09 13:02:24 EDT
Any followup on this?  It's been a few months now.  Thanks.
Comment 6 Vincent Danen 2010-12-20 17:32:28 EST
I'm going to close this.  It's been a year.  Nothing exciting is happening with dillo in Fedora, so it looks unmaintained to me.  As I cannot reproduce this crash, I have no way to know whether dillo 0.8.6 is affected or not.  There doesn't seem to be much point in keeping this bug open as a result; if someone cares to investigate this further and finds that dillo is affected, feel free to re-open and work towards a resolution.

Note You need to log in before you can comment on or make changes to this bug.