[SECURITY] [DLA 1871-1] vim security update

2019-08-0310:22:32

lists.debian.org

8.6 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

69.0%

JSON

Package : vim
Version : 2:7.4.488-7+deb8u4
CVE ID : CVE-2017-11109 CVE-2017-17087 CVE-2019-12735
Debian Bug : 867720 930020

Several minor issues have been fixed in vim, a highly configurable
text editor.

CVE-2017-11109

Vim allows attackers to cause a denial of service (invalid free)
or possibly have unspecified other impact via a crafted source
(aka -S) file.

CVE-2017-17087

Vim sets the group ownership of a .swp file to the editor&#x27;s
primary group (which may be different from the group ownership of
the original file), which allows local users to obtain sensitive
information by leveraging an applicable group membership.

CVE-2019-12735

Vim did not restrict the `:source!` command when executed in a
sandbox.

For Debian 8 "Jessie", these problems have been fixed in version
2:7.4.488-7+deb8u4.

We recommend that you upgrade your vim packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9arm64vim-gtk3< 2:8.0.0197-4+deb9u2vim-gtk3_2:8.0.0197-4+deb9u2_arm64.deb
Debian8allvim-gui-common< 2:7.4.488-7+deb8u4vim-gui-common_2:7.4.488-7+deb8u4_all.deb
Debian9amd64vim-tiny-dbgsym< 2:8.0.0197-4+deb9u2vim-tiny-dbgsym_2:8.0.0197-4+deb9u2_amd64.deb
Debian8i386vim-gnome< 2:7.4.488-7+deb8u4vim-gnome_2:7.4.488-7+deb8u4_i386.deb
Debian8amd64vim-dbg< 2:7.4.488-7+deb8u4vim-dbg_2:7.4.488-7+deb8u4_amd64.deb
Debian9amd64neovim< 0.1.7-4+deb9u1neovim_0.1.7-4+deb9u1_amd64.deb
Debian9mipselvim-nox< 2:8.0.0197-4+deb9u2vim-nox_2:8.0.0197-4+deb9u2_mipsel.deb
Debian9mipselxxd< 2:8.0.0197-4+deb9u2xxd_2:8.0.0197-4+deb9u2_mipsel.deb
Debian9mips64elvim-gtk-dbgsym< 2:8.0.0197-4+deb9u2vim-gtk-dbgsym_2:8.0.0197-4+deb9u2_mips64el.deb
Debian9mipsvim< 2:8.0.0197-4+deb9u2vim_2:8.0.0197-4+deb9u2_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	vim-gtk3	< 2:8.0.0197-4+deb9u2	vim-gtk3_2:8.0.0197-4+deb9u2_arm64.deb
Debian	8	all	vim-gui-common	< 2:7.4.488-7+deb8u4	vim-gui-common_2:7.4.488-7+deb8u4_all.deb
Debian	9	amd64	vim-tiny-dbgsym	< 2:8.0.0197-4+deb9u2	vim-tiny-dbgsym_2:8.0.0197-4+deb9u2_amd64.deb
Debian	8	i386	vim-gnome	< 2:7.4.488-7+deb8u4	vim-gnome_2:7.4.488-7+deb8u4_i386.deb
Debian	8	amd64	vim-dbg	< 2:7.4.488-7+deb8u4	vim-dbg_2:7.4.488-7+deb8u4_amd64.deb
Debian	9	amd64	neovim	< 0.1.7-4+deb9u1	neovim_0.1.7-4+deb9u1_amd64.deb
Debian	9	mipsel	vim-nox	< 2:8.0.0197-4+deb9u2	vim-nox_2:8.0.0197-4+deb9u2_mipsel.deb
Debian	9	mipsel	xxd	< 2:8.0.0197-4+deb9u2	xxd_2:8.0.0197-4+deb9u2_mipsel.deb
Debian	9	mips64el	vim-gtk-dbgsym	< 2:8.0.0197-4+deb9u2	vim-gtk-dbgsym_2:8.0.0197-4+deb9u2_mips64el.deb
Debian	9	mips	vim	< 2:8.0.0197-4+deb9u2	vim_2:8.0.0197-4+deb9u2_mips.deb