Bugtraqmailing list archives

By Date

By Thread

[ GLSA 200501-11 ] Dillo: Format string vulnerability

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 200501-11- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  Severity: Normal     Title: Dillo: Format string vulnerability      Date: January 09, 2005      Bugs: #76665        ID: 200501-11- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========Dillo is vulnerable to a format string bug, which may result in theexecution of arbitrary code.Background==========Dillo is a small and fast multi-platform web browser based on GTK+.Affected packages=================    -------------------------------------------------------------------     Package           /  Vulnerable  /                     Unaffected    -------------------------------------------------------------------  1  www-client/dillo     < 0.8.3-r4                       >= 0.8.3-r4Description===========Gentoo Linux developer Tavis Ormandy found a format string bug inDillo's handling of messages in a_Interface_msg().Impact======An attacker could craft a malicious web page which, when accessed usingDillo, would trigger the format string vulnerability and potentiallyexecute arbitrary code with the rights of the user running Dillo.Workaround==========There is no known workaround at this time.Resolution==========All Dillo users should upgrade to the latest version:    # emerge --sync    # emerge --ask --oneshot --verbose ">=www-client/dillo-0.8.3-r4"References==========  [ 1 ] CAN-2005-0012http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0012Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:http://security.gentoo.org/glsa/glsa-200501-11.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity () gentoo org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2005 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.0

Attachment:signature.asc
Description: OpenPGP digital signature

By Date

By Thread

Current thread:

• [ GLSA 200501-11 ] Dillo: Format string vulnerabilityThierry Carrez (Jan 11)