[Secure-testing-team] Bug#860367: feh: CVE-2017-7875

[Salvatore Bonaccorso]

Source: feh
Version: 2.12-1
Severity: normal
Tags: upstream security patch fixed-upstream

Hi,

the following vulnerability was published for fehl.

CVE-2017-7875[0]:
| In wallpaper.c in feh before v2.18.3, if a malicious client pretends to
| be the E17 window manager, it is possible to trigger an out-of-boundary
| heap write while receiving an IPC message. An integer overflow leads to
| a buffer overflow and/or a double free.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-7875
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7875
[1] https://github.com/derf/feh/commit/f7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore