Re: [LFS Trac] #4500: vim-9.1.???? (Update before release)

#4500: vim-9.1.???? (Update before release)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  task         |      Status:  new
 Priority:  normal       |   Milestone:  Hold
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Joe Locash):

 {{{
 potential data loss with zip.vim and special crafted zip files
 ==============================================================
 Date: 12.03.2025
 Severity: Medium
 CVE: *not-yet-assigned*
 CWE: Improper Neutralization of Argument Delimiters in a Command
      ('Argument Injection') (CWE-88)

 # Summary
 potential data loss with zip.vim and special crafted zip files

 # Description
 Vim is distributed with the zip.vim plugin, that allows easy editing and
 viewing of zip archives.

 To view and extract zip files, vim uses the unzip(1) command, usually
 provided by Info-ZIP[1], latest version on Debian is 6.0 from April
 2009.

 If an attacker creates an archive which contains a file `-d/tmp`, and a
 Vim user views such a file and tries to extract such filename from the
 archive, Vim will essentially run the following unzip command:

 unzip -o <archive.zip> member-filename

 However, since the member-filename is called `-d/tmp`, this is seen by
 the unzip command as an additional argument and it therefore happily
 extracts the whole archive into the mentioned directory, overwriting
 existing files because of the `-o`.

 Unfortunately, the latest released unzip version does not support `--`
 as and end-of-argument marker, so we cannot use this to mark the
 beginning of the member-files for unzip. Well, apparently there exists
 some 6.10 beta release[2], that hasn't made it to an official release
 yet which supports the use of the `--` marker since 2010 (but this isn't
 widely known).

 Therefore, Vim will try to work-around it by using the `[-]` glob when a
 filename starts with a `-` to protect unzip from parsing the filename as
 an argument, which is just an ugly work-around.

 # Impact
 Impact is **moderate** because a user must be made to view such an
 archive with Vim and then press 'x' to extract such a strange filename.

 The Vim project would like to thank @Ry0taK (GMO Flatt Security Inc) and
 @takumi-san-ai for reporting this issue.

 The issue has been fixed as of Vim patch v9.1.1198

 [1]: http://www.info-zip.org/pub/infozip/
 [2]: http://antinode.info/ftp/info-zip/unzip610c25c.zip

 [Commit](https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531)
 [Github Advisory](https://github.com/vim/vim/security/advisories/GHSA-
 693p-m996-3rmf)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/4500#comment:43>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page