#VU45015 Input validation error in feh - CVE-2010-2246

Vulnerability identifier: #VU45015

Vulnerability risk: Medium

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2010-2246

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
feh
Other software / Other software solutions

Vendor: feh.finalrewind.org

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

feh before 1.8, when the --wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.

Mitigation
Install update from vendor's website.

Vulnerable software versions

feh: 0.5.0 - 1.6.1

---

External links
https://derf.homelinux.org/git/feh/plain/ChangeLog
https://openwall.com/lists/oss-security/2010/06/25/4
https://openwall.com/lists/oss-security/2010/06/28/4
https://www.securityfocus.com/bid/41161

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.