CVE-2018-11319

Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle
searches for configuration files (it searches the current directory up to
potentially the root). This improper handling might be exploited for
arbitrary code execution via a malicious gcc plugin, if an attacker has
write access to a directory that is a parent of the base directory of the
project being checked. NOTE: exploitation is more difficult after 3.8.0
because filename prediction may be needed.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894736&gt;