Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Joe Locash):

 {{{
 potential code execution with tar.vim and special crafted tar files
 ===================================================================
 Date: 02.03.2025
 Severity: High
 CVE: <not-yet-assigned>
 CWE: Improper Input Validation (CWE-20)

 Vim is distributed with the tar.vim plugin, that allows easy editing and
 viewing of (compressed or uncompressed) tar files.

 Since commit 129a8446d23cd9cb4445fcfea259cba5e0487d29
 (Nov 11, 2024 runtime(tar): Update tar.vim to support permissions), the
 tar.vim plugin uses the ":read <fname>" ex command line to append
 <fname> below the cursor position, however the <fname> is not sanitized
 and is taken literaly from the tar archive. This allows to execute shell
 commands via special crafted tar archives. Whether this really happens,
 depends on the shell being used ('shell' option, which is set using
 $SHELL).

 Impact is **high** but a user must be convinced to edit such a file
 using Vim which will reveal the filename, so a careful user may suspect
 some strange things going on.

 The Vim project would like to thank RyotaK (GMO Flatt Security Inc) for
 reporting this issue.

 The issue has been fixed as of Vim patch v9.1.1164

 [Commit](https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399)
 [Github Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 wfmf-8626-q3r3)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:40>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page