-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4467-1 secur...@debian.org https://www.debian.org/security/ Moritz Muehlenhoff June 18, 2019 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : vim CVE ID : CVE-2019-12735 User "Arminius" discovered a vulnerability in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). The "Common vulnerabilities and exposures project" identifies the following problem: Editors typically provide a way to embed editor configuration commands (aka modelines) which are executed once a file is opened, while harmful commands are filtered by a sandbox mechanism. It was discovered that the "source" command (used to include and execute another file) was not filtered, allowing shell command execution with a carefully crafted file opened in Vim. For the stable distribution (stretch), this problem has been fixed in version 8.0.0197-4+deb9u2. We recommend that you upgrade your vim packages. For the detailed security status of vim please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vim Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl0JVQAACgkQEMKTtsN8 TjazzA//UmDDYU8/DrWBGm32wyufLBrJAnCnfM/klHl+7Cvwz0ODLeoWNavnFmhH IbeTKqOU9Yb86dNldUUcrjYoUXXyp8bER14XjMT4+30R8HA1lTcjbWHhlbyBbRET 3etj0i5Vh82q5jsVfQbqadg1YycLrCtjoECFzB97hl7Yya+8wKHF+8Z8ChV9k0mo SQsuNAeu/kILFsTbIKDZocr8/XxQ5eDJwUjPAHlUm0JQTrV3oNWuDulMQII5g7ZX gU/rNi43CdDsKOiVHlm/j7tMEy8Nf+aXKVuYXgpZ2rfQkONxOQlbSs5E+H3ZyDFD oQvdX9U8RzjIT7gR3uFgFjIjWvm/lJumzciJnn9A6i/NiR6EAgfj/Sjfs37cxig4 w1bIRD0mzTCxUiieyRDU/Dk98v1nUE3ChaHNEgeuXV7vjNXs5kduoL8lt7p2Nb9K j6y5p2JaawJq7fjFzUIan2YpBqu+VgwyeNsum4TaGO89+enZ0hMicuT1jGRshzX8 fCoJ/+Y63MY/+1uYgZ99PgGrI55qHyaUMd2Y1iPoC6tzAspRL7yOyu+NICUTfK5N jQvfxEuUQV4nhiNXEFxd9wzTJ4V3stM3ASR85/ZaDbqbYsOCJdYwhw58T6nbgSMM KdRjPQa7Xeaqzhdu8RQPF7zWA+hWyk5Q5BBp42W7Tlm+Lsp63Z4= =G7Bt -----END PGP SIGNATURE-----