[SECURITY] [DSA 3722-1] vim security update

2016-11-2216:41:44

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

Debian Security Advisory DSA-3722-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
November 22, 2016 https://www.debian.org/security/faq

Package : vim
CVE ID : CVE-2016-1248

Florian Larysch and Bram Moolenaar discovered that vim, an enhanced vi
editor, does not properly validate values for the the 'filetype',
'syntax' and 'keymap' options, which may result in the execution of
arbitrary code if a file with a specially crafted modeline is opened.

For the stable distribution (jessie), this problem has been fixed in
version 2:7.4.488-7+deb8u1.

We recommend that you upgrade your vim packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8armhfvim-athena< 7.4.488-7+deb8u1vim-athena_7.4.488-7+deb8u1_armhf.deb
Debian8allvim-doc< 7.4.488-7+deb8u1vim-doc_7.4.488-7+deb8u1_all.deb
Debian7armelvim-gtk< 7.3.547-7+deb7u1vim-gtk_7.3.547-7+deb7u1_armel.deb
Debian8arm64vim-tiny< 7.4.488-7+deb8u1vim-tiny_7.4.488-7+deb8u1_arm64.deb
Debian8powerpcvim-dbg< 7.4.488-7+deb8u1vim-dbg_7.4.488-7+deb8u1_powerpc.deb
Debian8armhfvim-dbg< 7.4.488-7+deb8u1vim-dbg_7.4.488-7+deb8u1_armhf.deb
Debian8arm64vim-athena< 7.4.488-7+deb8u1vim-athena_7.4.488-7+deb8u1_arm64.deb
Debian7i386vim-gtk< 7.3.547-7+deb7u1vim-gtk_7.3.547-7+deb7u1_i386.deb
Debian8mipsvim< 7.4.488-7+deb8u1vim_7.4.488-7+deb8u1_mips.deb
Debian8amd64vim-athena< 7.4.488-7+deb8u1vim-athena_7.4.488-7+deb8u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	armhf	vim-athena	< 7.4.488-7+deb8u1	vim-athena_7.4.488-7+deb8u1_armhf.deb
Debian	8	all	vim-doc	< 7.4.488-7+deb8u1	vim-doc_7.4.488-7+deb8u1_all.deb
Debian	7	armel	vim-gtk	< 7.3.547-7+deb7u1	vim-gtk_7.3.547-7+deb7u1_armel.deb
Debian	8	arm64	vim-tiny	< 7.4.488-7+deb8u1	vim-tiny_7.4.488-7+deb8u1_arm64.deb
Debian	8	powerpc	vim-dbg	< 7.4.488-7+deb8u1	vim-dbg_7.4.488-7+deb8u1_powerpc.deb
Debian	8	armhf	vim-dbg	< 7.4.488-7+deb8u1	vim-dbg_7.4.488-7+deb8u1_armhf.deb
Debian	8	arm64	vim-athena	< 7.4.488-7+deb8u1	vim-athena_7.4.488-7+deb8u1_arm64.deb
Debian	7	i386	vim-gtk	< 7.3.547-7+deb7u1	vim-gtk_7.3.547-7+deb7u1_i386.deb
Debian	8	mips	vim	< 7.4.488-7+deb8u1	vim_7.4.488-7+deb8u1_mips.deb
Debian	8	amd64	vim-athena	< 7.4.488-7+deb8u1	vim-athena_7.4.488-7+deb8u1_amd64.deb