USN-8982-1: feh vulnerability
It was discovered that feh incorrectly handled certain IPC messages from a client pretending to be the Enlightenment window manager, leading to an integer overflow. An attacker could possibly use this issue to cause feh to crash, resulting in a denial of service, or possibly execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/fehto a version that resolves this vulnerability.Fixed in 2.14-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to send specially crafted IPC messages while pretending to be the Enlightenment window manager. The issue arises from feh incorrectly handling those messages, causing an integer overflow.
What is the likely impact if exploitation succeeds?
Successful exploitation could cause feh to crash, resulting in denial of service. The advisory also indicates that arbitrary code execution may be possible.