[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

MDVSA-2008:236-1 -- Mandriva vim

ID: oval:org.secpod.oval:def:301320Date: (C)2012-01-07   (M)2017-10-04
Class: PATCHFamily: unix




Several vulnerabilities were found in the vim editor: A number of input sanitization flaws were found in various vim system functions. If a user were to open a specially crafted file, it would be possible to execute arbitrary code as the user running vim . Ulf Härnhammar of Secunia Research found a format string flaw in vim"s help tags processor. If a user were tricked into executing the helptags command on malicious data, it could result in the execution of arbitrary code as the user running vim . A flaw was found in how tar.vim handled TAR archive browsing. If a user were to open a special TAR archive using the plugin, it could result in the execution of arbitrary code as the user running vim . A flaw was found in how zip.vim handled ZIP archive browsing. If a user were to open a special ZIP archive using the plugin, it could result in the execution of arbitrary code as the user running vim . A number of security flaws were found in netrw.vim, the vim plugin that provides the ability to read and write files over the network. If a user opened a specially crafted file or directory with the netrw plugin, it could result in the execution of arbitrary code as the user running vim . A number of input validation flaws were found in vim"s keyword and tag handling. If vim looked up a document"s maliciously crafted tag or keyword, it was possible to execute arbitary code as the user running vim . A vulnerability was found in certain versions of netrw.vim where it would send FTP credentials stored for an FTP session to subsequent FTP sessions to servers on different hosts, exposing FTP credentials to remote hosts . This update provides vim 7.2 which corrects all of these issues and introduces a number of new features and bug fixes. Update: The previous vim update incorrectly introduced a requirement on libruby and also conflicted with a file from the git-core package . These issues have been corrected with these updated packages.

Platform:
Mandriva Linux 2009.0
Mandriva Linux 2008.1
Mandriva Linux 2008.0
Product:
vim
Reference:
MDVSA-2008:236-1
CVE-2008-4677
CVE-2008-4101
CVE-2008-3076
CVE-2008-3075
CVE-2008-3074
CVE-2008-2953
CVE-2008-2712
CVE    7
CVE-2008-2953
CVE-2008-3076
CVE-2008-4677
CVE-2008-2712
...
CPE    3
cpe:/o:mandriva:linux:2008.1
cpe:/o:mandriva:linux:2009.0
cpe:/o:mandriva:linux:2008.0

© 2013 SecPod Technologies