From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4467-1
[email protected] https://www.debian.org/security/ Moritz Muehlenhoff
June 18, 2019
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : vim
CVE ID : CVE-2019-12735
User "Arminius" discovered a vulnerability in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). The "Common vulnerabilities and exposures project" identifies the following problem:
Editors typically provide a way to embed editor configuration commands (aka modelines) which are executed once a file is opened, while harmful commands
are filtered by a sandbox mechanism. It was discovered that the "source" command (used to include and execute another file) was not filtered, allowing shell command execution with a carefully crafted file opened in Vim.
For the stable distribution (stretch), this problem has been fixed in
version 8.0.0197-4+deb9u2.
We recommend that you upgrade your vim packages.
For the detailed security status of vim please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/vim
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
[email protected]
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl0JVQAACgkQEMKTtsN8 TjazzA//UmDDYU8/DrWBGm32wyufLBrJAnCnfM/klHl+7Cvwz0ODLeoWNavnFmhH IbeTKqOU9Yb86dNldUUcrjYoUXXyp8bER14XjMT4+30R8HA1lTcjbWHhlbyBbRET 3etj0i5Vh82q5jsVfQbqadg1YycLrCtjoECFzB97hl7Yya+8wKHF+8Z8ChV9k0mo SQsuNAeu/kILFsTbIKDZocr8/XxQ5eDJwUjPAHlUm0JQTrV3oNWuDulMQII5g7ZX gU/rNi43CdDsKOiVHlm/j7tMEy8Nf+aXKVuYXgpZ2rfQkONxOQlbSs5E+H3ZyDFD oQvdX9U8RzjIT7gR3uFgFjIjWvm/lJumzciJnn9A6i/NiR6EAgfj/Sjfs37cxig4 w1bIRD0mzTCxUiieyRDU/Dk98v1nUE3ChaHNEgeuXV7vjNXs5kduoL8lt7p2Nb9K j6y5p2JaawJq7fjFzUIan2YpBqu+VgwyeNsum4TaGO89+enZ0hMicuT1jGRshzX8 fCoJ/+Y63MY/+1uYgZ99PgGrI55qHyaUMd2Y1iPoC6tzAspRL7yOyu+NICUTfK5N jQvfxEuUQV4nhiNXEFxd9wzTJ4V3stM3ASR85/ZaDbqbYsOCJdYwhw58T6nbgSMM KdRjPQa7Xeaqzhdu8RQPF7zWA+hWyk5Q5BBp42W7Tlm+Lsp63Z4=
=G7Bt
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)