[ MDVSA-2008:236 ] vim
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:236
http://www.mandriva.com/security/
_______________________________________________________________________
Package : vim
Date : December 3, 2008
Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
Several vulnerabilities were found in the vim editor:
A number of input sanitization flaws were found in various vim
system functions. If a user were to open a specially crafted file,
it would be possible to execute arbitrary code as the user running vim
(CVE-2008-2712).
Ulf Härnhammar of Secunia Research found a format string flaw in
vim's help tags processor. If a user were tricked into executing the
helptags command on malicious data, it could result in the execution
of arbitrary code as the user running vim (CVE-2008-2953).
A flaw was found in how tar.vim handled TAR archive browsing. If a
user were to open a special TAR archive using the plugin, it could
result in the execution of arbitrary code as the user running vim
(CVE-2008-3074).
A flaw was found in how zip.vim handled ZIP archive browsing. If a
user were to open a special ZIP archive using the plugin, it could
result in the execution of arbitrary code as the user running vim
(CVE-2008-3075).
A number of security flaws were found in netrw.vim, the vim plugin
that provides the ability to read and write files over the network.
If a user opened a specially crafted file or directory with the netrw
plugin, it could result in the execution of arbitrary code as the
user running vim (CVE-2008-3076).
A number of input validation flaws were found in vim's keyword and
tag handling. If vim looked up a document's maliciously crafted
tag or keyword, it was possible to execute arbitary code as the user
running vim (CVE-2008-4101).
A vulnerability was found in certain versions of netrw.vim where it
would send FTP credentials stored for an FTP session to subsequent
FTP sessions to servers on different hosts, exposing FTP credentials
to remote hosts (CVE-2008-4677).
This update provides vim 7.2 (patchlevel 65) which corrects all of
these issues and introduces a number of new features and bug fixes.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3074
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3076
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4101
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4677
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
9687145d46a754a50f26498399e42f84
2008.0/i586/vim-common-7.2.065-9.2mdv2008.0.i586.rpm
5ab8b8d113ef693c07cd79f693d47638
2008.0/i586/vim-enhanced-7.2.065-9.2mdv2008.0.i586.rpm
cf40227e84aac1a17a1a2973685e6a1f
2008.0/i586/vim-minimal-7.2.065-9.2mdv2008.0.i586.rpm
bf9cb876e1958d7b215a7039e1c52975
2008.0/i586/vim-X11-7.2.065-9.2mdv2008.0.i586.rpm
7b1b039b2ba0233b6535775ecd200e6d 2008.0/SRPMS/vim-7.2.065-9.2mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
fa3479b036e054ce12a0e680e95f28f6
2008.0/x86_64/vim-common-7.2.065-9.2mdv2008.0.x86_64.rpm
d1e10ebfaa89c3ca0cc72624531c6950
2008.0/x86_64/vim-enhanced-7.2.065-9.2mdv2008.0.x86_64.rpm
a8961516b64c325bf6662b44e1384885
2008.0/x86_64/vim-minimal-7.2.065-9.2mdv2008.0.x86_64.rpm
eb6a696807d8a2e55d9a447266081bc4
2008.0/x86_64/vim-X11-7.2.065-9.2mdv2008.0.x86_64.rpm
7b1b039b2ba0233b6535775ecd200e6d 2008.0/SRPMS/vim-7.2.065-9.2mdv2008.0.src.rpm
Mandriva Linux 2008.1:
bf1bbb5c11dc18f5b626830f83324bab
2008.1/i586/vim-common-7.2.065-9.2mdv2008.1.i586.rpm
54426458bb7601d9b3fdfedfa16ee9c6
2008.1/i586/vim-enhanced-7.2.065-9.2mdv2008.1.i586.rpm
ca94206e37b639a4577272d05ef10489
2008.1/i586/vim-minimal-7.2.065-9.2mdv2008.1.i586.rpm
8b58cee3b8ccee24408c1ed78215cb89
2008.1/i586/vim-X11-7.2.065-9.2mdv2008.1.i586.rpm
2886ecd9e5117b6464dc82e12bc41ee6 2008.1/SRPMS/vim-7.2.065-9.2mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
f56a2879dfbca889824074338eca652c
2008.1/x86_64/vim-common-7.2.065-9.2mdv2008.1.x86_64.rpm
e813a7a4126f4b5413b6a3517bb57c97
2008.1/x86_64/vim-enhanced-7.2.065-9.2mdv2008.1.x86_64.rpm
cfc262ca8e4995d5b648c282d05f9261
2008.1/x86_64/vim-minimal-7.2.065-9.2mdv2008.1.x86_64.rpm
dce8110e159fe8b767d596346514d1e9
2008.1/x86_64/vim-X11-7.2.065-9.2mdv2008.1.x86_64.rpm
2886ecd9e5117b6464dc82e12bc41ee6 2008.1/SRPMS/vim-7.2.065-9.2mdv2008.1.src.rpm
Mandriva Linux 2009.0:
b94e841258ba0053a8c2e1c61d378ff4
2009.0/i586/vim-common-7.2.065-9.2mdv2009.0.i586.rpm
53b66549200b5a8a3374de12c56ca3c4
2009.0/i586/vim-enhanced-7.2.065-9.2mdv2009.0.i586.rpm
a412c994a7d9f3111e2dfd4d629de72c
2009.0/i586/vim-minimal-7.2.065-9.2mdv2009.0.i586.rpm
f1a2096a8b72c74ed3ef7df984491b66
2009.0/i586/vim-X11-7.2.065-9.2mdv2009.0.i586.rpm
49185b01a1d717513902ba49235023a0 2009.0/SRPMS/vim-7.2.065-9.2mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
dce4c150ca5f8beed2e6ec917ee8f36d
2009.0/x86_64/vim-common-7.2.065-9.2mdv2009.0.x86_64.rpm
8351ee5ccbbf039649c830befb16c8b6
2009.0/x86_64/vim-enhanced-7.2.065-9.2mdv2009.0.x86_64.rpm
25abc823231a1242ec9e00e08aeea08b
2009.0/x86_64/vim-minimal-7.2.065-9.2mdv2009.0.x86_64.rpm
8f18e3bf52e528294a8c027227163ea0
2009.0/x86_64/vim-X11-7.2.065-9.2mdv2009.0.x86_64.rpm
49185b01a1d717513902ba49235023a0 2009.0/SRPMS/vim-7.2.065-9.2mdv2009.0.src.rpm
Corporate 3.0:
57eb3da62007c67d4dfff2184712e723
corporate/3.0/i586/vim-common-7.2.065-9.2.C30mdk.i586.rpm
cd32782aeb6a12ff17d63436cf1b5bdd
corporate/3.0/i586/vim-enhanced-7.2.065-9.2.C30mdk.i586.rpm
5fe6219ae51f930a61ac7719d483c4d2
corporate/3.0/i586/vim-minimal-7.2.065-9.2.C30mdk.i586.rpm
ad522f08a5c827dc68c1c3d80dc96c05
corporate/3.0/i586/vim-X11-7.2.065-9.2.C30mdk.i586.rpm
5056d9e1057c60b0cc2514cfb14f6aef
corporate/3.0/SRPMS/vim-7.2.065-9.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
934038cf8d1a329cf8020895ed3db7c3
corporate/3.0/x86_64/vim-common-7.2.065-9.2.C30mdk.x86_64.rpm
65d64cc850ebdcb6a47905c94df19437
corporate/3.0/x86_64/vim-enhanced-7.2.065-9.2.C30mdk.x86_64.rpm
138427402ee4d0dba3931861f43b17af
corporate/3.0/x86_64/vim-minimal-7.2.065-9.2.C30mdk.x86_64.rpm
23ab99b940c3150ea185cbe0cf7a536a
corporate/3.0/x86_64/vim-X11-7.2.065-9.2.C30mdk.x86_64.rpm
5056d9e1057c60b0cc2514cfb14f6aef
corporate/3.0/SRPMS/vim-7.2.065-9.2.C30mdk.src.rpm
Corporate 4.0:
ccad6e665824b0af02d7cf6dc244800f
corporate/4.0/i586/vim-common-7.2.065-8.2.20060mlcs4.i586.rpm
6259e89fdff3af4591f00aee85f6408d
corporate/4.0/i586/vim-enhanced-7.2.065-8.2.20060mlcs4.i586.rpm
a1899ec82783d087a67e598440c7d97b
corporate/4.0/i586/vim-minimal-7.2.065-8.2.20060mlcs4.i586.rpm
1628ebe4b6bd2c0398689d8b63059ad4
corporate/4.0/i586/vim-X11-7.2.065-8.2.20060mlcs4.i586.rpm
ff5ce0745012df27dba7c628be9696c2
corporate/4.0/SRPMS/vim-7.2.065-8.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
2cc05e275dfda62016b2ca250bc7abac
corporate/4.0/x86_64/vim-common-7.2.065-8.2.20060mlcs4.x86_64.rpm
12628db58e590955b4fc52b9b9da35f2
corporate/4.0/x86_64/vim-enhanced-7.2.065-8.2.20060mlcs4.x86_64.rpm
81d3a71d955ef44e9adf0087a38b2048
corporate/4.0/x86_64/vim-minimal-7.2.065-8.2.20060mlcs4.x86_64.rpm
01db91a3cd0d64fba00beb7ac29121ab
corporate/4.0/x86_64/vim-X11-7.2.065-8.2.20060mlcs4.x86_64.rpm
ff5ce0745012df27dba7c628be9696c2
corporate/4.0/SRPMS/vim-7.2.065-8.2.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
17e4eff8ebdba9763a278a2d0e2f4ca3
mnf/2.0/i586/vim-common-7.2.065-9.2.C30mdk.i586.rpm
a32e43b8fd1beaa139c108a14685b357
mnf/2.0/i586/vim-enhanced-7.2.065-9.2.C30mdk.i586.rpm
ccd9d76b31b85005d465a11113db862e
mnf/2.0/i586/vim-minimal-7.2.065-9.2.C30mdk.i586.rpm
27bd018672a8bc5aa5d15a7bc6e64dc0 mnf/2.0/SRPMS/vim-7.2.065-9.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJNyr0mqjQ0CJFipgRAvZIAKCt0kqq89JAQAR+RIP90e6/NLuz/gCgsJpo
KAmfiIoMaojFy7qpIqRnGw4=
=Cl2x
-----END PGP SIGNATURE-----