CVE catalog

CVE-2009-2294

dillo: CVE-2009-2294

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
2.50% · Oct 25, 2026

Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandillosid3.3.0-3fixed
Debiandilloforky3.3.0-3fixed
Debiandillotrixie3.0.5-7.1fixed
Debiandillobookworm3.0.5-7fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandillosourcesid3.0-1mediumNot reported[535788]
Debiandillosourceforky3.0-1mediumNot reported[535788]
Debiandillosourcetrixie3.0-1mediumNot reported[535788]
Debiandillosourcebookworm3.0-1mediumNot reported[535788]

[Debian bug #535788]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dillo]Fixed

    Source package: [dillo]

    Details (2)

    • 3.0.5-7+b1 · amd64 · bookworm

      Fixed · Fixed: 3.0-1

      dsa · dillo · debian · bookworm; dsa · dillo · debian · 12

    • 3.0.5-7+b1 · arm64 · bookworm

      Fixed · Fixed: 3.0-1

      dsa · dillo · debian · bookworm; dsa · dillo · debian · 12

[Debian 13 (Trixie)]

  • [dillo]Fixed
    Details (2)

    • 3.0.5-7.1 · amd64 · trixie

      Fixed · Fixed: 3.0-1

      dsa · dillo · debian · 13

    • 3.0.5-7.1 · arm64 · trixie

      Fixed · Fixed: 3.0-1

      dsa · dillo · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]