Source: feh Version: 2.12-1 Severity: normal Tags: upstream security patch fixed-upstream
Hi, the following vulnerability was published for fehl. CVE-2017-7875[0]: | In wallpaper.c in feh before v2.18.3, if a malicious client pretends to | be the E17 window manager, it is possible to trigger an out-of-boundary | heap write while receiving an IPC message. An integer overflow leads to | a buffer overflow and/or a double free. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-7875 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7875 [1] https://github.com/derf/feh/commit/f7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d Please adjust the affected versions in the BTS as needed. Regards, Salvatore
