freebsd/ports
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security/vuxml: Add vim* shell commands execution

Browse Source
This commit is contained in:
Fernando Apesteguía
2025-03-10 18:53:36 +01:00
parent 49a93e9acd
commit 976ac8ad30
1 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/vuxml/vuln/2025.xml
+55
View File
@@ -1,3 +1,58 @@
<vuln vid="2ec7816d-fdb7-11ef-91ff-b42e991fc52e">
<topic>vim -- Improper Input Validation in Vim</topic>
<affects>
<package>
<name>vim</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-gtk2</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-gtk3</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-motif</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-tiny</name>
<range><lt>9.1.1164</lt></range>
</package>
<package>
<name>vim-x11</name>
<range><lt>9.1.1164</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security-advisories@github.com reports:</p>
<blockquote cite="https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29">
<p>Vim is distributed with the tar.vim plugin, that allows
easy editing and viewing of (compressed or uncompressed) tar
files. Starting with 9.1.0858, the tar.vim plugin uses the
&quot;:read&quot; ex command line to append below the
cursor position, however the is not sanitized and is taken
literally from the tar archive. This allows to execute
shellcommands via special crafted tar archives. Whether
this really happens, depends on the shell being used
(&apos;shell&apos; option, which is set using $SHELL).
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-27423</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-27423</url>
</references>
<dates>
<discovery>2025-03-03</discovery>
<entry>2025-03-10</entry>
</dates>
</vuln>
<vuln vid="6ba9e26e-c9c6-49f7-ae43-47e5864f0b66">
<topic>electron33 -- multiple vulnerabilities</topic>
<affects>