{"id":"CVE-2017-7875","aliases":["DEBIAN-CVE-2017-7875","DLA-2219-1","DLA-899-1","EUVD-2017-16850","GHSA-7hjr-xp4g-fx7m","MGASA-2017-0137","MGASA-2017-0149","UBUNTU-CVE-2017-7875","USN-8982-1","openSUSE-SU-2024:10751-1"],"status":"published","title":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager...","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02266,"percentile":0.8314,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-04-14T18:00:00Z","modified":"2026-11-04T03:43:14Z","fixes":[{"ecosystem":"Debian:12","package":"feh","fixed_in":["2.18-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"feh","fixed_in":["2.18-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"feh","fixed_in":["2.18-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"feh","fixed_in":["2.12-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"feh","fixed_in":["2.3-2+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"feh","fixed_in":["2.18.3-1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"feh","fixed_in":["2.14-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"feh","fixed_in":["3.7-1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-1+deb8u1"}]}],"versions":["2.12-1"]},{"source":"osv","ecosystem":"Debian:7","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2+deb7u1"}]}],"versions":["2.3-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.3-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-3.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-3.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-38.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1ubuntu0.1~esm1"}]}],"versions":["2.13.1-1","2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1ubuntu0.1~esm1"}]}],"versions":["2.13.1-1","2.14-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"feh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-1.3"}]}]}],"products":[{"vendor":"feh_project","product":"feh"}],"references":[{"url":"https://security.gentoo.org/glsa/201707-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://feh.finalrewind.org/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Product","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/97689","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/derf/feh/commit/f7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7875"},{"url":"https://feh.finalrewind.org"},{"url":"https://github.com/advisories/GHSA-7hjr-xp4g-fx7m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7875","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0137.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20775","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-05/msg00000.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0149.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20861","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.66","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.67","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.68","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7875","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8982-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7875","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7875","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:00:00Z","modified":"2024-08-05T16:19:28.399Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16850","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:00:00Z","modified":"2024-08-05T16:19:28Z","updated_at":"2026-11-03T02:39:07.019497Z"}],"ghsa":[{"id":"GHSA-7hjr-xp4g-fx7m","title":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager...","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2022-05-13T01:26:15Z","modified":"2025-04-20T03:37:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:01:45.195531Z"}],"nvd":[{"id":"CVE-2017-7875","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:59:01.173Z","modified":"2026-06-17T01:25:22.907Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"CVE-2017-7875","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:59:01.173Z","modified":"2026-10-20T13:24:27.233343715Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-7875","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:59:01.173Z","modified":"2026-09-01T20:03:50.739651734Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-7875","description":"In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.","status":"published","published":"2017-04-14T18:59:00Z","modified":"2026-11-04T03:30:06.588701718Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"DLA-2219-1","title":"feh - security update","status":"published","published":"2020-05-24T00:00:00Z","modified":"2026-03-09T01:19:21.924505Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-899-1","title":"feh - security update","status":"published","published":"2017-04-17T00:00:00Z","modified":"2026-03-09T02:10:12.964446Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0137","title":"Updated feh package fixes security vulnerability","description":"Updated feh package to fix a double-free/OOB-write in E17 IPC. This was\na potential security issue as a malicious X11 app running alongside feh\nand pretending to be an E17 window manager could have had access to\nout-of-bound memory. Security vulnerability: CVE-2017-7875\n","status":"published","published":"2017-05-10T20:47:44Z","modified":"2026-04-16T06:22:54.052867664Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0149","title":"Updated kernel packages fixes security vulnerabilities","description":"This kernel update is based on upstream 4.4.68 and fixes at least\nthe following security issues:\n\nThe NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through\n4.10.11 allows remote attackers to cause a denial of service (system crash)\nvia a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and\nfs/nfsd/nfsxdr.c (CVE-2017-7645).\n\nThe NFSv2 and NFSv3 server implementations in the Linux kernel through\n4.10.13 lack certain checks for the end of a buffer, which allows remote\nattackers to trigger pointer-arithmetic errors or possibly have unspecified\nother impact via crafted requests, related to fs/nfsd/nfs3xdr.c and\nfs/nfsd/nfsxdr.c (CVE-2017-7895).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-26T06:54:58Z","modified":"2026-04-16T06:23:33.578916789Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10751-1","title":"feh-3.7-1.3 on GA media","description":"These are all security issues fixed in the feh-3.7-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:54.105521Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-8982-1","title":"feh vulnerability","description":"It was discovered that feh incorrectly handled certain IPC messages from a\nclient pretending to be the Enlightenment window manager, leading to an\ninteger overflow. An attacker could possibly use this issue to cause feh to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.","status":"published","published":"2026-11-03T17:35:31Z","modified":"2026-11-04T03:43:14.119579349Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}