Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

Question

I have downloaded an image that someone has uploaded to my website with a public upload form.

My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ubuntu there is something called "thumbnail"...

So, thumbnail was created and I can see the image in the file explorer, but I've never clicked on the file.

I run on standard Ubuntu 14.04 (previously lubuntu-desk was installed in this way sudo apt-get install lubuntu-desktop).

Answer 1

It depends on what you mean by safe. Ubuntu has to parse and decode the image file to display it in a thumbnail. So any potential exploit in the decoding code is exploitable when you preview the file.

So from a strict perspective, no you're not safe. In practice, I don't believe there's any known exploits on ubuntu for image files. Historically images tend to be low risk.

If you have reason to be suspicious of a file, turn off the preview feature as described:

https://askubuntu.com/questions/136024/how-to-stop-nautilus-from-creating-thumbnails-of-specific-file-types