• [SECURITY] [DSA 4467-1] vim security update

    From Moritz Muehlenhoff@1:229/2 to All on Tue Jun 18 23:30:02 2019
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4467-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff
    June 18, 2019 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : vim
    CVE ID : CVE-2019-12735

    User "Arminius" discovered a vulnerability in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). The "Common vulnerabilities and exposures project" identifies the following problem:

    Editors typically provide a way to embed editor configuration commands (aka modelines) which are executed once a file is opened, while harmful commands
    are filtered by a sandbox mechanism. It was discovered that the "source" command (used to include and execute another file) was not filtered, allowing shell command execution with a carefully crafted file opened in Vim.

    For the stable distribution (stretch), this problem has been fixed in
    version 8.0.0197-4+deb9u2.

    We recommend that you upgrade your vim packages.

    For the detailed security status of vim please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/vim

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl0JVQAACgkQEMKTtsN8 TjazzA//UmDDYU8/DrWBGm32wyufLBrJAnCnfM/klHl+7Cvwz0ODLeoWNavnFmhH IbeTKqOU9Yb86dNldUUcrjYoUXXyp8bER14XjMT4+30R8HA1lTcjbWHhlbyBbRET 3etj0i5Vh82q5jsVfQbqadg1YycLrCtjoECFzB97hl7Yya+8wKHF+8Z8ChV9k0mo SQsuNAeu/kILFsTbIKDZocr8/XxQ5eDJwUjPAHlUm0JQTrV3oNWuDulMQII5g7ZX gU/rNi43CdDsKOiVHlm/j7tMEy8Nf+aXKVuYXgpZ2rfQkONxOQlbSs5E+H3ZyDFD oQvdX9U8RzjIT7gR3uFgFjIjWvm/lJumzciJnn9A6i/NiR6EAgfj/Sjfs37cxig4 w1bIRD0mzTCxUiieyRDU/Dk98v1nUE3ChaHNEgeuXV7vjNXs5kduoL8lt7p2Nb9K j6y5p2JaawJq7fjFzUIan2YpBqu+VgwyeNsum4TaGO89+enZ0hMicuT1jGRshzX8 fCoJ/+Y63MY/+1uYgZ99PgGrI55qHyaUMd2Y1iPoC6tzAspRL7yOyu+NICUTfK5N jQvfxEuUQV4nhiNXEFxd9wzTJ4V3stM3ASR85/ZaDbqbYsOCJdYwhw58T6nbgSMM KdRjPQa7Xeaqzhdu8RQPF7zWA+hWyk5Q5BBp42W7Tlm+Lsp63Z4=
    =G7Bt
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)