Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dillo | Dillo | * | 2.1 (including) |
| Dillo | Dillo | 0.0.0 (including) | 0.0.0 (including) |
| Dillo | Dillo | 0.0.1 (including) | 0.0.1 (including) |
| Dillo | Dillo | 0.0.2 (including) | 0.0.2 (including) |
| Dillo | Dillo | 0.0.3 (including) | 0.0.3 (including) |
| Dillo | Dillo | 0.0.4 (including) | 0.0.4 (including) |
| Dillo | Dillo | 0.0.5 (including) | 0.0.5 (including) |
| Dillo | Dillo | 0.0.6 (including) | 0.0.6 (including) |
| Dillo | Dillo | 0.0.42 (including) | 0.0.42 (including) |
| Dillo | Dillo | 0.0.43 (including) | 0.0.43 (including) |
| Dillo | Dillo | 0.1.0 (including) | 0.1.0 (including) |
| Dillo | Dillo | 0.2 (including) | 0.2 (including) |
| Dillo | Dillo | 0.2.1 (including) | 0.2.1 (including) |
| Dillo | Dillo | 0.2.2 (including) | 0.2.2 (including) |
| Dillo | Dillo | 0.2.3 (including) | 0.2.3 (including) |
| Dillo | Dillo | 0.2.4 (including) | 0.2.4 (including) |
| Dillo | Dillo | 0.3 (including) | 0.3 (including) |
| Dillo | Dillo | 0.3.1 (including) | 0.3.1 (including) |
| Dillo | Dillo | 0.3.2 (including) | 0.3.2 (including) |
| Dillo | Dillo | 0.4 (including) | 0.4 (including) |
| Dillo | Dillo | 0.5.0 (including) | 0.5.0 (including) |
| Dillo | Dillo | 0.5.1 (including) | 0.5.1 (including) |
| Dillo | Dillo | 0.6 (including) | 0.6 (including) |
| Dillo | Dillo | 0.6.1 (including) | 0.6.1 (including) |
| Dillo | Dillo | 0.6.2 (including) | 0.6.2 (including) |
| Dillo | Dillo | 0.6.3 (including) | 0.6.3 (including) |
| Dillo | Dillo | 0.6.4 (including) | 0.6.4 (including) |
| Dillo | Dillo | 0.6.5 (including) | 0.6.5 (including) |
| Dillo | Dillo | 0.6.6 (including) | 0.6.6 (including) |
| Dillo | Dillo | 0.7 (including) | 0.7 (including) |
| Dillo | Dillo | 0.7.1 (including) | 0.7.1 (including) |
| Dillo | Dillo | 0.7.1.2 (including) | 0.7.1.2 (including) |
| Dillo | Dillo | 0.7.2 (including) | 0.7.2 (including) |
| Dillo | Dillo | 0.7.3 (including) | 0.7.3 (including) |
| Dillo | Dillo | 0.8 (including) | 0.8 (including) |
| Dillo | Dillo | 0.8.1 (including) | 0.8.1 (including) |
| Dillo | Dillo | 0.8.2 (including) | 0.8.2 (including) |
| Dillo | Dillo | 0.8.3 (including) | 0.8.3 (including) |
| Dillo | Dillo | 0.8.4 (including) | 0.8.4 (including) |
| Dillo | Dillo | 0.8.5-pre-dw-design1 (including) | 0.8.5-pre-dw-design1 (including) |
| Dillo | Dillo | 0.8.5-pre-dw-design2 (including) | 0.8.5-pre-dw-design2 (including) |
| Dillo | Dillo | 0.8.5-pre-dw-design3 (including) | 0.8.5-pre-dw-design3 (including) |
| Dillo | Dillo | 0.8.6 (including) | 0.8.6 (including) |
| Dillo | Ubuntu | dapper | * |
| Dillo | Ubuntu | hardy | * |
| Dillo | Ubuntu | intrepid | * |
| Dillo | Ubuntu | jaunty | * |