CVE request for feh

[Stefan Behte <craig () gentoo org>]

Hi,

I guess there is no CVE request for this one yet:

On https://bugs.launchpad.net/ubuntu/+source/feh/+bug/607328 seegooon wrote:

--------------------------------------------------
Hi, I've just discovered that feh is vulnerable to rewriting any user file:

      tmpname_timestamper =
         estrjoin("", "/tmp/feh_", cppid, "_", basename, NULL);
...
            execlp("wget", "wget", "-N", "-O", tmpname_timestamper, newurl,
                   quiet, (char*) NULL);

If attacker knows PID of feh and knows the URL, it can create the link
to any user file. wget would overwrite it.

--------------------------------------------------

Thanks in advance,

Craig