CVE-2017-7875 Integer overflow in n/a
A malicious E17 window manager can trigger an integer overflow in feh, leading to heap corruption and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7875?
CVE-2017-7875 is a critical vulnerability in n/a, published on 14 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
Weakness: CWE-787
Which versions are affected by CVE-2017-7875?
It affects 1 product.
Linux distribution packages (1)
feh openSUSE:Tumbleweed | All versions | 3.7-1.3 |
Products include Feh Project Feh.
How do I fix CVE-2017-7875?
Upgrade to a fixed version.
Is CVE-2017-7875 being exploited?
There is no known exploitation of CVE-2017-7875 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2017-7875, DLA-2219-1, DLA-899-1, GHSA-7hjr-xp4g-fx7m, MGASA-2017-0137, UBUNTU-CVE-2017-7875 and 1 more.