feh - Out-of-Boundary Heap Write Vulnerability
Summary
DLA-899-1: feh - security update. Affects feh versions < 2.3-2+deb7u1. Fixed in 2.3-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
feh is an image viewer for Linux systems. It allows users to view and manipulate images from the command line or within a graphical environment. The vulnerability affects feh version 2.3-2+deb7u1 on Debian 7 Wheezy.
Vulnerability Detail
The vulnerability in feh allows an attacker to trigger an out-of-boundary heap write when receiving an IPC message. This can lead to arbitrary code execution or a denial of service attack. The issue was discovered by Tobias Stoeckmann.
How To Fix
Minimum fixed version
2.3-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fehTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The feh image viewer on Debian 7 Wheezy is vulnerable to an out-of-boundary heap write vulnerability. It is recommended to upgrade the feh package to version 2.3-2+deb7u1 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for feh →
FAQ
feh is an image viewer for Linux systems that allows users to view and manipulate images from the command line or within a graphical environment.
An out-of-boundary heap write occurs when a program writes data beyond the allocated memory space of a heap object. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
The vulnerability can be exploited by sending a specially crafted IPC message to the feh image viewer, triggering the out-of-boundary heap write.
The vulnerability can lead to arbitrary code execution or a denial of service attack, depending on how it is exploited.
Yes, upgrading the feh package to version 2.3-2+deb7u1 or later will fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for feh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
