Univention Bugzilla – Bug 54326
vim: Multiple issues (4.4)
Last modified: 2022-01-12 16:33:46 CET
New Debian vim 2:8.0.0197-4+deb9u4 fixes: This update addresses the following issues: * Sets the group ownership of a .swp file to the editor's primary group (CVE-2017-17087) * users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode (CVE-2019-20807) * heap-based buffer overflow in utf_ptr2char() in mbyte.c (CVE-2021-3778) * use-after-free in nv_replace() in normal.c (CVE-2021-3796)
--- mirror/ftp/4.4/unmaintained/4.4-1/source/vim_8.0.0197-4+deb9u2.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/vim_8.0.0197-4+deb9u4.dsc @@ -1,3 +1,18 @@ +2:8.0.0197-4+deb9u4 [Mon, 10 Jan 2022 22:05:25 +0100] Anton Gladky <gladk@debian.org>: + + * Non-maintainer upload by the LTS Security Team. + * CVE-2017-17087. Fix swap file permission issue. + * CVE-2019-20807. Prevent execution of arbitrary OS commands in + restricted mode in rvim. + * CVE-2021-3778. Fix Heap-based Buffer Overflow with invalid + utf-8 character. + * CVE-2021-3796. Fix heap Use-After-Free memory error. + +2:8.0.0197-4+deb9u3 [Fri, 21 Jun 2019 00:10:35 -0400] James McCoy <jamessan@debian.org>: + + * Backport patch 8.1.0067 to fix loss of syntax highlighting (Closes: #930718) + + 8.1.0067: syntax highlighting not working when re-entering a buffer + 2:8.0.0197-4+deb9u2 [Sun, 16 Jun 2019 13:06:40 -0400] James McCoy <jamessan@debian.org>: * Backport patches to address CVE-2019-12735 (Closes: #930020) <http://piuparts.knut.univention.de/4.4-8/#8820702741465945777>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] d6710c6a86 Bug #54326: vim 2:8.0.0197-4+deb9u4 doc/errata/staging/vim.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) [4.4-8] 72b1b25b80 Bug #54326: vim 2:8.0.0197-4+deb9u4 doc/errata/staging/vim.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x1148>