Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 7: 2020-0082 Critical: Vim and Neovim Command Injection

mageia
Calendar Grey February 13, 2020
Dist Mageia Esm H88
Mageia has unveiled refreshed versions of vim and neovim addressing a critical command injection flaw. Discover further details regarding this release.
Updated vim and neovim package fixes security vulnerability: It was discovered that Vim before 8.1.1365 and Neovim before 0.3.6 did not restrict the `:source!` command when execut...

Summary

Updated vim and neovim package fixes security vulnerability:
It was discovered that Vim before 8.1.1365 and Neovim before 0.3.6 did not restrict the `:source!` command when executed in a sandbox. This allows remote attackers to take advantage of the modeline feature to inject arbitrary commands when a specially crafted file is opened (CVE-2019-12735).

References

- https://bugs.mageia.org/show_bug.cgi?id=24929

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/

- https://www.cve.org/CVERecord?id=CVE-2019-12735

Topics%20covered

Topics Covered

security advisory remote attack command injection vim Mageia neovim

Resolution

SRPMS

- 7/core/neovim-0.3.7-1.mga7

- 7/core/vim-8.1.1048-1.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 13 Feb 2020
URL: https://advisories.mageia.org/MGASA-2020-0082.html
Type: security
CVE: CVE-2019-12735

Topics%20covered

Topics Covered

security advisory remote attack command injection vim Mageia neovim

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here