Sign in / up

back to article Remember Corel? It's just entered .DLL hell

Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. The holes were dropped by Marcos Accossatto of Core Security after the doodleware company did not respond to his private disclosure. Corel has been contacted for comment. "Given that this is a client- …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Lars Silver badge
    Linux

    Would that be the Corel with one of the first Linux distros then a long time ago, 1997 or such,

    1 0 Reply
    1. A Non e-mouse Silver badge
      Reply Icon

      According to that ever reliable source of Wikipedia, Corel Linux was based off of Debian.

      Corel Linux may have been an early commercial distro of Linux, but it certainly wasn't one of the firsts. Debian, which Corel was based off, first came out in 1996. (It was announced in 1993) The earliest distributions came out in 1992. (Linus released his first kernel in 1991)

      All details sourced from Wikipedia.

      1 0 Reply
    2. DrXym
      Reply Icon

      I have a Corel Linux CD sitting in a cupboard somewhere which was handed out a Linux users group a long time ago. Must see if I can find it.

      Anyway it certainly wasn't the first Linux dist by any stretch but it was perhaps the first dist pitched at consumers. The idea was that they'd slap it on cheap PCs for next to nothing and then make money selling bundled up versions of software (most of which were free to begin with). Xandros and Linspire took the idea over but it didn't catch on.

      1 0 Reply
  2. AMBxx Silver badge
    FAIL

    100 millions users?

    Come on, I loved InfoCentral, but Corel's days are long gone.

    They're all running Windows 95 too.

    3 0 Reply
    1. Grenou
      Reply Icon

      Re: 100 millions users?

      Oh come on folks, Corel might be a tad behind the times, but the software is good.

      Yes, I use their software and have done for years, especially PaintShop Pro which (for the price) can, in the right hands, stand up to the mighty Photoshop (way too expensive).

      But nowadays everyone wants one-click and you have a masterpiece, so the right hands are likely few.

      Give Corel a break and stop sniping :-(

      0 0 Reply
  3. foxyshadis

    All 5 remaining users sure to be saddened

    100 million people have at one time purchased an OEM PC that came pre-installed with some flavor of Corel software, certainly that must mean they're all active users.

    2 1 Reply
    1. Robert Helpmann??
      Reply Icon
      Childcatcher

      Re: All 5 remaining users sure to be saddened

      I don't know about the rest of their user base, but I used to work support for a shop that used their products, but honestly thought the company had folded a long time ago. In fact, this article was a bit of a surprise for me because of that.

      4 0 Reply
    2. Peter Prof Fox
      Reply Icon

      400,000 words a year can't be wrong

      My 1997 version of Corel Wordperfect is nearly perfect. It is streets ahead of Word and Libre Office for a professional writer. I have no intention of ditching Win95 and losing this irreplaceable tool.

      3 0 Reply
      1. A Non e-mouse Silver badge
        Reply Icon
        Unhappy

        Re: 400,000 words a year can't be wrong

        The best thing about WordPerfect was its Reveal Codes feature. It allowed you to see how all the formatting was structured under the bonnet. This allowed you to troubleshoot formatting problems really easily. You could even move the cursor between the formatting elements to ensure you got what you wanted.

        I'm not aware that any word processor supports anything like that any more. And they call it progress....

        7 0 Reply
        1. Michael Wojcik Silver badge
          Reply Icon

          Re: 400,000 words a year can't be wrong

          I'm not aware that any word processor supports anything like that any more.

          I can't offhand name a "word processor" that does (though you can of course inspect the contents of files generated the various ones that use XML), but document markup languages give you this ability and a better separation of content, structure, and formatting in the bargain.

          1 0 Reply
  4. Christian Berger

    Considering how often that thing crashed...

    ... I wouldn't be surprised it had lots of security critical bugs. I mean from a security/reliability perspective they did just about everything wrong. They even supported OLE!

    1 0 Reply
  5. DrXym

    Brings back memories

    I remember buying Corel Draw, mostly for the clip art. The software was always buggy as hell and not fit for purpose.

    0 0 Reply
    1. BongoJoe
      Reply Icon

      Re: Brings back memories

      I remember buying Corel Draw! 3 which was a great product back in the mists of the distant eighties.

      Version 4 onwards was simply either broken or too bloated to run.

      0 0 Reply
  6. Billa Bong

    I confess - I use Corel

    Have done for years. There has never been a feature I wanted and couldn't do in PaintShop Pro that would warrant switching to PhotoShop, despite having both. However, now I'm rethinking...

    3 0 Reply
    1. Hans Neeson-Bumpsadese Silver badge
      Reply Icon

      Re: I confess - I use Corel

      Me too - PSP has been my photo editing application of choice since v7. I much prefer it to PhotoShop, as what I can do in a couple of actions in PSP seems to require a dozen actions in PhotoShop.

      2 0 Reply
      1. killakrust
        Reply Icon

        Re: I confess - I use Corel

        Yep, me too. I've been using Paint Shop Pro 7 for years, and there are very few reasons I can find to re-train myself on Photoshop.

        If someone could hack in 32bit BMP support I'd be soooo happy.

        Hard to tell from the article, but the issue might not affect the really old products like Jasc PSP 7. The X7 version is v17 from what I can gather (the latest version).

        1 0 Reply
        1. Grenou
          Reply Icon

          Re: I confess - I use Corel

          Easy, don't import .pspimages and you're fine.

          I do resent the comments made here about Corel being old hat.

          Heaven forbid the user would be forced to use the ghastly Photoshop, no thanks.

          0 0 Reply
  7. Anonymous Coward
    Happy

    100 Million?

    That's one huge pile of Computer Shoppers still lurking around.

    4 0 Reply
    1. Captain Scarlet
      Reply Icon
      Paris Hilton

      Re: 100 Million?

      Do they really still give us free copies of old versions of their software!

      0 1 Reply
      1. Captain Scarlet
        Reply Icon

        Re: 100 Million?

        Correction: Do they still give copies of old versions of their software for the price of the mag?

        0 0 Reply
  8. Pompous Git Silver badge

    Corel Linux was a disaster. Never managed to get it talking to my Adaptec scsi, or Postscript printer; wouldn't run Corel Word Perfect.

    Much happier with CoreDRAW! Suite. Been using it since V 2.0 when I was southernmost licence-holder on the planet. Soon learnt not to upgrade on first release of new versions; they were invariably buggy as hell. Even skipped a few. Currently on X5.

    0 0 Reply
  9. Kev99 Silver badge

    Interesting how many vulnerabilities are found in various flavors of DLLs. I wonder who created those marvels?

    0 0 Reply
    1. david 12 Silver badge
      Reply Icon

      Interesting how many vulnerabilitie are found in .EXEs

      ...but this isn't a vulnerability found "in" an EXE or a DLL. This is a "search path vulnerability" which is part of a a DOS / Windows 3 design decision, thoughtlessly replicated to this very day, particularly by cross-platform developers: The decision to put the Application (EXE and DLL) in the same folder as the application Data ( BMP/JPG/DOC/DAT )

      Originally, because you wanted, if possible, to put everything on the same floppy disk. Still, if thoughtless, because different platforms have different customs/rules for where user data should go, and where applications should go, and there are still people who just dump averything in together.

      The vulnerability descibed her is that "the DLL search path includes the current directory". This was the default case on Windows for many years.

      Is this just a description of the way old Windows application software works, or a special case of Corel being worse than everyone else when run on a current version of Windows? Dunno without more details.

      0 0 Reply
      1. Pompous Git Silver badge
        Reply Icon

        Re: Interesting how many vulnerabilitie are found in .EXEs

        The default folder for documents in CorelDRAW! x5 is the Pictures Library under Libraries on Win7. I can't ever remember saving into a directory with DLLs in it, even under Windows 2.11! Colour me confused here.

        0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like