[Secure-testing-team] Bug#587205: feh: Arbitrary code execution with --wget-timestamp and URLs

[Daniel Friesel]

Package: feh
Version: 1.3.4.dfsg.1-1
Severity: grave
Tags: security
Justification: user security hole

Hello,

there exists an (IMHO rather unlikely, but still possible) arbitrary code
execution hole in feh. All versions <= 1.7 down to at least the 1.3.4 in
stable (I didn't check earlier ones) are affected.

See <http://seclists.org/oss-sec/2010/q2/332>.

In case the security team wants to patch the stable feh package, the
following diff resolves the issue by removing the --wget-timestamp option,
which is probably broken anyway:
<https://derf.homelinux.org/git/feh/patch/?id=ae56ce24b10767800b1715e7e68b41c7d3571b4c>.

--derf

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.30 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash