CVE-2017-7875: Buffer Overflow
In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/fehto a version that resolves this vulnerability.Fixed in 3.9.1-2Fixed in 3.10.3-1Fixed in 3.13.1-1 - Upgrade
Upgrade
ubuntu/fehto a version that resolves this vulnerability.Fixed in 2.14-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Which installations need remediation?
Feh versions before 2.18.3 are affected. Check the installed feh version; versions earlier than 2.18.3 should be updated to 2.18.3 or later.
What does an attacker need to exploit this issue?
The attacker needs to act as a malicious client that pretends to be the E17 window manager and sends an IPC message to feh. No authentication or user interaction is indicated by the provided severity vector.
What is the likely impact of successful exploitation?
A crafted IPC message can trigger an out-of-bounds heap write through an integer overflow, potentially resulting in a buffer overflow or double free. The supplied severity vector rates confidentiality, integrity, and availability impact as high.