GLSA 200501-11: Dillo: Format string vulnerability
| Severity: | normal |
| Title: | Dillo: Format string vulnerability |
| Date: | 01/09/2005 |
| Bugs: | |
| ID: | 200501-11 |
Synopsis
Dillo is vulnerable to a format string bug, which may result in the execution of arbitrary code.Background
Dillo is a small and fast multi-platform web browser based on GTK+.
Affected packages
| Package | Vulnerable | Unaffected | Architecture(s) |
|---|---|---|---|
| www-client/dillo | < 0.8.3-r4 | >= 0.8.3-r4 | All supported architectures |
Description
Gentoo Linux developer Tavis Ormandy found a format string bug in Dillo's handling of messages in a_Interface_msg().
Impact
An attacker could craft a malicious web page which, when accessed using Dillo, would trigger the format string vulnerability and potentially execute arbitrary code with the rights of the user running Dillo.
Workaround
There is no known workaround at this time.
Resolution
All Dillo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/dillo-0.8.3-r4"
References
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.