CVE-2010-2246: Input Validation
Published May 26, 2011
·Updated
feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Affected Software
23 affected components
Feh Project Feh=0.5.0
Feh Project Feh=0.6.4
Feh Project Feh=0.7.0
Feh Project Feh=0.9.9
Feh Project Feh=1.1.0
Feh Project Feh=1.2.0
Feh Project Feh=1.2.1
Feh Project Feh=1.2.3
Feh Project Feh=1.2.5
Feh Project Feh=1.2.6
Feh Project Feh=1.2.7
Feh Project Feh=1.3.0
Feh Project Feh=1.3.1
Feh Project Feh=1.3.3
Feh Project Feh=1.3.5
Feh Project Feh=1.4
Feh Project Feh=1.4.1
Feh Project Feh=1.4.2
Feh Project Feh=1.4.3
Feh Project Feh=1.5
Feh Project Feh=1.6
Feh Project Feh=1.6.1
Feh Project Feh<=1.7
Event History
May 26, 2011
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-2246?
CVE-2010-2246 has a medium severity rating due to the potential for remote code execution through malicious URLs.
2
How do I fix CVE-2010-2246?
To fix CVE-2010-2246, upgrade to Feh version 1.8 or later, which addresses this vulnerability.
3
What versions of Feh are affected by CVE-2010-2246?
CVE-2010-2246 affects Feh versions prior to 1.8, including 0.5.0 through 1.7.
4
Can CVE-2010-2246 be exploited without user interaction?
Yes, CVE-2010-2246 can potentially be exploited remotely without user interaction if the vulnerable command is executed with a malicious URL.
5
What conditions must be met for CVE-2010-2246 to be exploited?
For CVE-2010-2246 to be exploited, the '--wget-timestamp' option must be enabled and a crafted URL containing shell metacharacters must be used.