To: [email protected]Subject: [ MDVSA-2008:236-1 ] vim
Date: Mon, 08 Dec 2008 19:38:00 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1L9sU5-0002I7-1H@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:236-1
http://www.mandriva.com/security/
_______________________________________________________________________
Package : vim
Date : December 8, 2008
Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
Several vulnerabilities were found in the vim editor:
A number of input sanitization flaws were found in various vim
system functions. If a user were to open a specially crafted file,
it would be possible to execute arbitrary code as the user running vim
(CVE-2008-2712).
Ulf Hц╓rnhammar of Secunia Research found a format string flaw in
vim's help tags processor. If a user were tricked into executing the
helptags command on malicious data, it could result in the execution
of arbitrary code as the user running vim (CVE-2008-2953).
A flaw was found in how tar.vim handled TAR archive browsing. If a
user were to open a special TAR archive using the plugin, it could
result in the execution of arbitrary code as the user running vim
(CVE-2008-3074).
A flaw was found in how zip.vim handled ZIP archive browsing. If a
user were to open a special ZIP archive using the plugin, it could
result in the execution of arbitrary code as the user running vim
(CVE-2008-3075).
A number of security flaws were found in netrw.vim, the vim plugin
that provides the ability to read and write files over the network.
If a user opened a specially crafted file or directory with the netrw
plugin, it could result in the execution of arbitrary code as the
user running vim (CVE-2008-3076).
A number of input validation flaws were found in vim's keyword and
tag handling. If vim looked up a document's maliciously crafted
tag or keyword, it was possible to execute arbitary code as the user
running vim (CVE-2008-4101).
A vulnerability was found in certain versions of netrw.vim where it
would send FTP credentials stored for an FTP session to subsequent
FTP sessions to servers on different hosts, exposing FTP credentials
to remote hosts (CVE-2008-4677).
This update provides vim 7.2 (patchlevel 65) which corrects all of
these issues and introduces a number of new features and bug fixes.
Update:
The previous vim update incorrectly introduced a requirement on
libruby and also conflicted with a file from the git-core package
(in contribs). These issues have been corrected with these updated
packages.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2953http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3074http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3075http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3076http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4101http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4677
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
1ebd5f8b6c0743bab3db3113c2bb5498 2008.0/i586/vim-common-7.2.065-9.3mdv2008.0.i586.rpm
ecad30a24814aa1543f3e9f4548c0d8e 2008.0/i586/vim-enhanced-7.2.065-9.3mdv2008.0.i586.rpm
a62bc45e20c7cb05ea99471949fa057b 2008.0/i586/vim-minimal-7.2.065-9.3mdv2008.0.i586.rpm
e5431f23309139db47583d100ebec5fc 2008.0/i586/vim-X11-7.2.065-9.3mdv2008.0.i586.rpm
f2413164a86b6635ee5ff016c3527d64 2008.0/SRPMS/vim-7.2.065-9.3mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
3fc6eb1eda476d642947ecaab7a225f2 2008.0/x86_64/vim-common-7.2.065-9.3mdv2008.0.x86_64.rpm
0edf2753ba8a00f8d866e559f7a2192b 2008.0/x86_64/vim-enhanced-7.2.065-9.3mdv2008.0.x86_64.rpm
692d5032e705bfda05b2b2618b8369d6 2008.0/x86_64/vim-minimal-7.2.065-9.3mdv2008.0.x86_64.rpm
87bf7a4fba22dc1773b544eeb412db06 2008.0/x86_64/vim-X11-7.2.065-9.3mdv2008.0.x86_64.rpm
f2413164a86b6635ee5ff016c3527d64 2008.0/SRPMS/vim-7.2.065-9.3mdv2008.0.src.rpm
Mandriva Linux 2008.1:
c934d47ecaa0ed9d9bff2b89fea74f20 2008.1/i586/vim-common-7.2.065-9.3mdv2008.1.i586.rpm
714185e359626acb9d22a88c54608a38 2008.1/i586/vim-enhanced-7.2.065-9.3mdv2008.1.i586.rpm
59d119574eb3dc453305bed6da73a12e 2008.1/i586/vim-minimal-7.2.065-9.3mdv2008.1.i586.rpm
4543e6fba5116a1d95fddfee3ce73613 2008.1/i586/vim-X11-7.2.065-9.3mdv2008.1.i586.rpm
d007fce1a939ef4e1841cf54c68dbdd0 2008.1/SRPMS/vim-7.2.065-9.3mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
f8375b1d25260274ef2b081eec0396ea 2008.1/x86_64/vim-common-7.2.065-9.3mdv2008.1.x86_64.rpm
20577d11a3a22ff802a7e1c749099b76 2008.1/x86_64/vim-enhanced-7.2.065-9.3mdv2008.1.x86_64.rpm
1aa16e6fb134f57f4faefb319bdd6840 2008.1/x86_64/vim-minimal-7.2.065-9.3mdv2008.1.x86_64.rpm
99e25a76291297900ffce76e81e87e20 2008.1/x86_64/vim-X11-7.2.065-9.3mdv2008.1.x86_64.rpm
d007fce1a939ef4e1841cf54c68dbdd0 2008.1/SRPMS/vim-7.2.065-9.3mdv2008.1.src.rpm
Mandriva Linux 2009.0:
39b17b1ac441ba27254daeac8e593de6 2009.0/i586/vim-common-7.2.065-9.3mdv2009.0.i586.rpm
477cbeec330709630426f06c474e3c48 2009.0/i586/vim-enhanced-7.2.065-9.3mdv2009.0.i586.rpm
3ae2bf83194b6a323e78e09874a9cb3d 2009.0/i586/vim-minimal-7.2.065-9.3mdv2009.0.i586.rpm
02c54fb5e618484f6312ddf0b98cb08b 2009.0/i586/vim-X11-7.2.065-9.3mdv2009.0.i586.rpm
26bb261499484986d9f352208dac6aab 2009.0/SRPMS/vim-7.2.065-9.3mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
6c00a2bcd26eed82708f625b0c2f4ecc 2009.0/x86_64/vim-common-7.2.065-9.3mdv2009.0.x86_64.rpm
2a9dcd8a41b17ba2849df2e1d0da077f 2009.0/x86_64/vim-enhanced-7.2.065-9.3mdv2009.0.x86_64.rpm
effaa23409fe3358318c291db55f6e6b 2009.0/x86_64/vim-minimal-7.2.065-9.3mdv2009.0.x86_64.rpm
7ca4a070928495e0e8081bbe0b845c51 2009.0/x86_64/vim-X11-7.2.065-9.3mdv2009.0.x86_64.rpm
26bb261499484986d9f352208dac6aab 2009.0/SRPMS/vim-7.2.065-9.3mdv2009.0.src.rpm
Corporate 3.0:
474ad132ad608caf03176e33b81359f8 corporate/3.0/i586/vim-common-7.2.065-9.3.C30mdk.i586.rpm
1349e3dcc99a0e100e185f344efabe3d corporate/3.0/i586/vim-enhanced-7.2.065-9.3.C30mdk.i586.rpm
5ee98b1525bd32dec3af623474c6ade4 corporate/3.0/i586/vim-minimal-7.2.065-9.3.C30mdk.i586.rpm
3327eedd3e14cb7b426cdf0ba07ef5ed corporate/3.0/i586/vim-X11-7.2.065-9.3.C30mdk.i586.rpm
9f059fa975e2d851e66f5e1eff88d3d0 corporate/3.0/SRPMS/vim-7.2.065-9.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
65e2168ca42319b7ba79f7dfe0e2143f corporate/3.0/x86_64/vim-common-7.2.065-9.3.C30mdk.x86_64.rpm
85092d93a8a040c567ce59d0512d8847 corporate/3.0/x86_64/vim-enhanced-7.2.065-9.3.C30mdk.x86_64.rpm
dff08e81f6c2cede1de99ae96700178f corporate/3.0/x86_64/vim-minimal-7.2.065-9.3.C30mdk.x86_64.rpm
f299fe329b20cefb391976ffb9664b39 corporate/3.0/x86_64/vim-X11-7.2.065-9.3.C30mdk.x86_64.rpm
9f059fa975e2d851e66f5e1eff88d3d0 corporate/3.0/SRPMS/vim-7.2.065-9.3.C30mdk.src.rpm
Corporate 4.0:
37db43f0c3855a4c86d5237f4e5f292f corporate/4.0/i586/vim-common-7.2.065-8.3.20060mlcs4.i586.rpm
9ed45a0dd9eb354a508c893a2e177662 corporate/4.0/i586/vim-enhanced-7.2.065-8.3.20060mlcs4.i586.rpm
6117088ff587d3b96090dc5232a37a36 corporate/4.0/i586/vim-minimal-7.2.065-8.3.20060mlcs4.i586.rpm
61747391c926c371c679984941a5bfb9 corporate/4.0/i586/vim-X11-7.2.065-8.3.20060mlcs4.i586.rpm
cd60343d547090af2e9d0c3943d0aa81 corporate/4.0/SRPMS/vim-7.2.065-8.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
2956ef9554f0c8ffb523f243ad547ad0 corporate/4.0/x86_64/vim-common-7.2.065-8.3.20060mlcs4.x86_64.rpm
5a8d2fbb71645fe83b977df339dd2069 corporate/4.0/x86_64/vim-enhanced-7.2.065-8.3.20060mlcs4.x86_64.rpm
250987bbd2f083c308ea3849d9bdd524 corporate/4.0/x86_64/vim-minimal-7.2.065-8.3.20060mlcs4.x86_64.rpm
3636d25dd546e0ea06cee2d9539aea81 corporate/4.0/x86_64/vim-X11-7.2.065-8.3.20060mlcs4.x86_64.rpm
cd60343d547090af2e9d0c3943d0aa81 corporate/4.0/SRPMS/vim-7.2.065-8.3.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
520cc910d9ee606478a83ac015814d09 mnf/2.0/i586/vim-common-7.2.065-9.3.C30mdk.i586.rpm
c826084eb33961639c40377fc9b6a9b4 mnf/2.0/i586/vim-enhanced-7.2.065-9.3.C30mdk.i586.rpm
2f724da0fe5da0022b298262f1188aa5 mnf/2.0/i586/vim-minimal-7.2.065-9.3.C30mdk.i586.rpm
1b626e0380d726aa8072089bd94eadfd mnf/2.0/SRPMS/vim-7.2.065-9.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJPatcmqjQ0CJFipgRAp3vAJwMcdTivDsR5SM0N9sW/hnYXOb/YgCdFnRx
2uGyk940O65ZfGdUVa1xrEo=
=7tdF
-----END PGP SIGNATURE-----
