The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.

The remote host is affected by the vulnerability described in GLSA-201110-08 (feh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in feh. Please review the       CVE identifiers referenced below for details.
  Impact :

    A malicious entity might entice a user to visit a URL using the
      --wget-timestamp option, thus executing arbitrary commands via shell       metacharacters; a malicious local user could perform a symlink attack and       overwrite arbitrary files.
  Workaround :

    There is no known workaround at this time.

Changes since 0.10.1 :

  - Bug fixes * Make zoom_default key work properly with
    --geometry * Only create caption directory when actually     writing out a caption.
    <http://github.com/derf/feh/issues/42> * read directory     contents sorted by filename instead of 'randomly' (as     returned by readdir) by default. Thanks talisein!     <https://github.com/derf/feh/pull/20> * Show certain     warnings in the image window as well as on the     commandline <http://github.com/derf/feh/issues/43> *     Change a patch for NETWM fullscreen support to only     apply to fullscreen windows. This fixes the moving     windows bug in fluxbox (since fluxbox doesn't report its     window border width).
    <http://github.com/derf/feh/issues/22>     <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=570903     > * Minor manpage fixes.
    <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625683     > * Fix --auto-zoom / --zoom max/fill documentation, the     'Auto-Zoom' menu option is now always checked when these     options are used * Set _NET_WM_NAME and
    _NET_WM_ICON_NAME properties     <http://github.com/derf/feh/issues/44> * The     zoom_default key now works fine with --scale-down     <http://github.com/derf/feh/issues/41> * Fix access of     uninitialized memory / malloc/realloc clash in continued     theme definition handling. Having a theme line with just     one option/value pair used to produce undefined     behaviour * Fix segfault upon unloadable images when     image-related format specifiers (e.g. %h) are used in
    --title * Fix Imlib2 caching bug in reload (only worked     after the second try) * Show correct image dimensions in     for cached thumbnails * Fix zooming when --scale-down is     used * Make in/out zoom use equal zoom ratio

  - Behavior changes/compatability * --menu-style is now     deprecated * The --menu-bg option has been deprecated.
    It will be removed along with --menu-style by the end of     2012. <http://github.com/derf/feh/issues/27> * Since the     manual is way better structured and more detailed than     the --help output, it now simply refers to the manual. *     The 'A' key (toggle_aliasing) now actually changes the     current window, and not just the default for new windows
    * Show images in current directory when invoked without     file arguments * The --bg options are now     Xinerama-aware. That is, they set the image in the     respective mode (scale/fill/max/center) on each Xinerama     screen. Use --no-xinerama to disable this. * Add --zoom     fill as equivalent for --auto-zoom * Remove builtin http     client (--builtin) * http images are now viewed using     libcurl, not wget (thanks to talisein) This adds libcurl     as dependency, and removes the wget recommendation *     Allow commandline options to override those set in a     theme * Remove support for FEH_OPTIONS (was deprecated     >5 years ago) * Restrict available modifiers to     Control/Mod1/Mod4 * The themes are now read from     ~/.config/feh/themes (BC for .fehrc exists) * Key     bindings can now be configured via ~/.config/feh/keys *     Removes --rcpath, use XDG_CONFIG_HOME instead * Increase     movement steps for Ctrl+Left etc.

  - Features * You can now use the next/prev/jump keys to     navigate thumbnails. Use the render key to open the     currently selected thumbnail.
    <http://github.com/derf/feh/issues/26> * Option to     disable antialiasing, either global (--force-aliasing)     or per image (press 'A' to toggle, keybinding     toggle_aliasing) * Use SIGUSR1/SIGUSR2 to reload all     images in multiwindow mode * Add --zoom max (zooming     like in --bg-max)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
56501	GLSA-201110-08 : feh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55499	Fedora 15 : feh-1.14.1-1.fc15 (2011-8750)	Nessus	Fedora Local Security Checks	low
55498	Fedora 14 : feh-1.14.1-1.fc14 (2011-8747)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-0702

medium

Tenable Plugins

medium

low

low