Version 1.11.2 of feh
Release Notes: This release fixes a hole when using feh with HTTP/FTP URLs: an attacker knowing the feh PID and the URL could make feh overwrite arbitrary user files with images by using symlinks to those files and a TOCTTOU attack on feh's unique filename mechanism. This release adds the --no-clobber switch to wget. An attacker can still create arbitrary files via dangling symlinks, but overwriting existing files is no longer possible. A proper fix (probably replacing wget with libcurl) will be provided in feh 2.0.
Other releases
Release Notes: This release fixes Imlib2 and X11 warnings when opening a URL returning an HTTP error, uses "feh -" to read an image from stdin, adds --keep-zoom-vp and --sort mtime options, and adds button bindings to zoom in/out.
Release Notes: Adds %V format specifier (feh process ID). The --scale-down option will no longer be applied to the thumbnail window. --image-bg is now also respected when setting a wallpaper using --bg-max / --bg-center. An image deletion bug related to --cycle-once was fixed. Quick, low-offset drags are now detected as clicks to aid graphics tablet users, whose clicks were misdetected as drags. --start-at and 'z' (jump_random) now work in thumbnail mode as well.
Release Notes: --min-dim and --max-dim options were added to limit processing to images within a certain width x height range.
Release Notes: Fixes a segfault in lossless mirror/rotate when jpegexiforient is not present.
Release Notes: EXIF orientation tags in inplace-rotated images are now always set to "0,0 is top-left" (normal rotation). Previously, they were left unchanged, causing EXIF-aware software to display images rotated with feh at an incorrect angle.
