scsijon
Joined: 23 May 2007 Posts: 1538 Location: the australian mallee
Posted: Mon 17 Jun 2019, 18:04 Post subject:
Vim CVE-2019-12735 WARNINGS
copied from my LFS mail system
--------------------------------------------
Subject: [lfs-dev] Vim CVE-2019-12735
Message-ID: <20190614221658.GA31361@milliways.localdomain>
Content-Type: text/plain; charset=utf-8
It is possible for a remote attacker to execute arbitrary OS
commands in vim up to version 8.1.1364 via the :source! command in a
modeline of a malicious file (all you have to do is open the file in
vim).
A workaround is to disable modelines in vimrc :
set nomodeline
I could tell you that there is a "good" version of vim (8.1.1529
which was current when I cloned it) in my webspace at higgs, but if
you were to just use that then you have bigger security problems
(unverified source).
If you need an urgent fix, the upstream mercurial repository is at
https://www.vim.org/mercurial.php
The individual change which fixed this adds a new test to check it
works, and that relies on earlier changes since 8.1. Also, if
running the tests as root (chroot) some tests will fail. So, for
the moment "please be aware".
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum