Following the recent discussion on debian-devel, I'm concerned that
this package is still in stable and testing.

There has been no new upstream version and absolutely minimal fixes in
Debian for the last 10 years.  While for some classes of software this
would be fine, a web browser is constantly working with untrusted
input, and a web browser written in C and C++ is likely to have many
exploitable security vulnerabilties.

I see no sign that it has already been fuzz tested by the previous
upstream maintainer or the developers of the newer forks, so these
vulnerabilities are more likely to be found by attackers than
defenders.

I understand that Dillo does have the advantage of not implementing
Javascript, but there is still plenty of complexity in the formats it
does handle.  For comparison, see Vincent Sanders' accounts of fuzzing
NetSurf, a similarly "light" browser project:
<https://vincentsanders.blogspot.com/2016/08/down-rabbit-hole.html>,
<https://vincentsanders.blogspot.com/2016/10/rabbit-of-caerbannog.html>.

Ben.

Control: severity -1 important

Removing dillo at this stage in the Trixie release process would result
in removal of the src:claws-mail package on account of the
claws-mail-dillo-viewer binary package depending upon it. Because
Trixie soft freeze has begun, dropping binary packages from a source
package is no longer appropriate, so dropping claw-mail-dillo-viewer is
not straightforward.

As of last year a new upstream maintainer for Dillo has stepped up and
has made new releases (See https://dillo-browser.github.io/). While
it's likely too late to get the latest release into trixie, there is
the potential to get it into trixie-backports post-release.

Upstream has now moved to https://dillo-browser.org/ - they have some
new releases and have been quite active.

This bug can be closed when the new version is packaged.

We believe that the bug you reported is fixed in the latest version of
dillo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1102988@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nikolas Nyby <nikolas@gnu.org> (supplier of updated dillo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 31 Jul 2026 12:12:31 -0400
Source: dillo
Architecture: source
Version: 3.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Nikolas Nyby <nikolas@gnu.org>
Changed-By: Nikolas Nyby <nikolas@gnu.org>
Closes: 766086 1022726 1077067 1102988 1114901 1137091 1141871 1141966
Changes:
 dillo (3.3.0-1) unstable; urgency=medium
 .
   * Salvage package. (Closes: #1141966)
   * New upstream version 3.3.0.
     (Closes: #1102988, #1077067, #1114901, #1141871)
   * debian/control:
     - Add myself as maintainer.
     - Update standards version to 4.7.4.
     - Update homepage. (Closes: #1022726, #1137091)
     - Remove libjpeg8-dev from Build-Depends. (Closes: #766086)
     - Fix wording in description.
   * debian/copyright: Updates for new version.
   * debian/patches: Remove unnecessary patches,
     refresh move-helper-tools-to-libexec.patch.
   * debian/upstream/metadata: Add file.
   * debian/rules: Update deprecated --enable-ssl option to --enable-tls.
   * debian/docs: Remove stale files for new release.
   * debian/watch: Update for version 5 and new homepage.
   * Add debian/salsa-ci.yml file.
Checksums-Sha1:
 c7f5a6c5c4d459a09c3bbe55564ada09e2f0c472 1750 dillo_3.3.0-1.dsc
 ebf54a2f5084db3cf7064d0d6d3c3f769407c186 1368668 dillo_3.3.0.orig.tar.gz
 cc10c7a2d23b13595c2786b8dd9b9e9864ae56c7 21772 dillo_3.3.0-1.debian.tar.xz
 b9796527d8a1d197d1f6d7082b4e5d054850dd43 8736 dillo_3.3.0-1_source.buildinfo
Checksums-Sha256:
 99908254128471a63eb0206d92f7fe2482c0ecd11e54da0bdff709ce603ee66d 1750 dillo_3.3.0-1.dsc
 db1863261d5efbd27b090e430c88064082b891cea1edf7a14e234cca51754f60 1368668 dillo_3.3.0.orig.tar.gz
 26ba027419b5ec3ecfc7c39c3b8c419f26155603afdc24da7c37131fa6a7e7f4 21772 dillo_3.3.0-1.debian.tar.xz
 62296b071532a18d3d960edd470df0155d6c512fcd4a18c38db6e73fe9d68f2b 8736 dillo_3.3.0-1_source.buildinfo
Files:
 18d09317e2622f4b56b3a062e9dfed57 1750 web optional dillo_3.3.0-1.dsc
 14b7a0e6a8ce4888423a7acbc0e6c906 1368668 web optional dillo_3.3.0.orig.tar.gz
 7da92a1a94f7c174d2b488027e441421 21772 web optional dillo_3.3.0-1.debian.tar.xz
 acf722eeb0f6bf710d90e23d854d87e3 8736 web optional dillo_3.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmpwsDcQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFBsQC/0SMCbJGFF/WGwcVTVwQzSB38nI7CGO8Td3
one6VuQRWuvgW+LxQZcxmg6L560mqCTB/+898+DVAADV2BECAqG1P+4VI+184BCP
PxHpdkEKFBD/q4qmr8Q3FUZwcMOCQWtBjM1euBxM6cvSiT834OTPjohjOCf1C/Or
bhavYUInmptXau4KpSuIbhMHlITEElG6V8hQOyqSxkZo9slTV/bjyHCCRCR/N9be
mHI9wfwp4YtHxsGcc1OMy7uXuk5et/SK3crrAKxKewgQc1qYukFGpGrE1psg7npx
Tw0sxSOIC0+TbJmfXgK3dXCXSe8RWOWLa07OCua0yyTclQeNkngdZqPv/PxmQXFn
jWqnQUr+ri87yz/GF4uT22y0xuKim2Gfs0UDA5dm7KP7n5Q0N84eoSsyOE6iEJ8a
S/iJxkigKOXR4x1RkM3DJkemxlS9eotwhdr3jM8SczzXs10/REr+DrD/T6FsUFGA
qAM1qxbFzL7EW+CD9hYafoGrMSDGqVQ=
=r3xV
-----END PGP SIGNATURE-----