[IT-SecNots] [SECURITY] [DSA 4467-1] vim security update

[Moritz Muehlenhoff <jmm AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4467-1                   security AT debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
June 18, 2019                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : vim
CVE ID         : CVE-2019-12735

User "Arminius" discovered a vulnerability in Vim, an enhanced version of the
standard UNIX editor Vi (Vi IMproved). The "Common vulnerabilities and
exposures project" identifies the following problem:
  
Editors typically provide a way to embed editor configuration commands (aka
modelines) which are executed once a file is opened, while harmful commands
are filtered by a sandbox mechanism. It was discovered that the "source"
command (used to include and execute another file) was not filtered, allowing
shell command execution with a carefully crafted file opened in Vim.

For the stable distribution (stretch), this problem has been fixed in
version 8.0.0197-4+deb9u2.

We recommend that you upgrade your vim packages.

For the detailed security status of vim please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/vim

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl0JVQAACgkQEMKTtsN8
TjazzA//UmDDYU8/DrWBGm32wyufLBrJAnCnfM/klHl+7Cvwz0ODLeoWNavnFmhH
IbeTKqOU9Yb86dNldUUcrjYoUXXyp8bER14XjMT4+30R8HA1lTcjbWHhlbyBbRET
3etj0i5Vh82q5jsVfQbqadg1YycLrCtjoECFzB97hl7Yya+8wKHF+8Z8ChV9k0mo
SQsuNAeu/kILFsTbIKDZocr8/XxQ5eDJwUjPAHlUm0JQTrV3oNWuDulMQII5g7ZX
gU/rNi43CdDsKOiVHlm/j7tMEy8Nf+aXKVuYXgpZ2rfQkONxOQlbSs5E+H3ZyDFD
oQvdX9U8RzjIT7gR3uFgFjIjWvm/lJumzciJnn9A6i/NiR6EAgfj/Sjfs37cxig4
w1bIRD0mzTCxUiieyRDU/Dk98v1nUE3ChaHNEgeuXV7vjNXs5kduoL8lt7p2Nb9K
j6y5p2JaawJq7fjFzUIan2YpBqu+VgwyeNsum4TaGO89+enZ0hMicuT1jGRshzX8
fCoJ/+Y63MY/+1uYgZ99PgGrI55qHyaUMd2Y1iPoC6tzAspRL7yOyu+NICUTfK5N
jQvfxEuUQV4nhiNXEFxd9wzTJ4V3stM3ASR85/ZaDbqbYsOCJdYwhw58T6nbgSMM
KdRjPQa7Xeaqzhdu8RQPF7zWA+hWyk5Q5BBp42W7Tlm+Lsp63Z4=
=G7Bt
-----END PGP SIGNATURE-----