[ GLSA 201110-08 ] feh: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: feh: Multiple vulnerabilities (GLSA 201110-08)
Severity: high
Exploitable: local, remote
Date: October 13, 2011
Bug(s): #325531, #354063
ID: 201110-08

Synopsis

Multiple vulnerabilities were found in feh, the worst of which
leading to remote passive code execution.


Background

feh is a fast, lightweight imageviewer using imlib2.

Affected Packages

Package: media-gfx/feh
Vulnerable: < 1.12
Unaffected: >= 1.12
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in feh. Please review the
CVE identifiers referenced below for details.


Impact

A malicious entity might entice a user to visit a URL using the
--wget-timestamp option, thus executing arbitrary commands via shell
metacharacters; a malicious local user could perform a symlink attack and
overwrite arbitrary files.


Workaround

There is no known workaround at this time.

Resolution

All feh users should upgrade to the latest version: