Scientific Linux: SLSA-2016:2972-1 Moderate: vim Execution Risk

Date: Wed, 21 Dec 2016 16:01:12 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: vim on SL6.x, SL7.x i386/x86_64
MIME-Version: 1.0
Message-ID: <20161221160112.20912.97404@slpackages.fnal.gov>

Synopsis: Moderate: vim security update
Advisory ID: SLSA-2016:2972-1
Issue Date: 2016-12-21
CVE Numbers: CVE-2016-1248
--

Security Fix(es):

* A vulnerability was found in vim in how certain modeline options were
treated. An attacker could craft a file that, when opened in vim with
modelines enabled, could execute arbitrary commands with privileges of the
user running vim. (CVE-2016-1248)
--

SL6
 x86_64
 vim-X11-7.4.629-5.el6_8.1.x86_64.rpm
 vim-common-7.4.629-5.el6_8.1.x86_64.rpm
 vim-debuginfo-7.4.629-5.el6_8.1.x86_64.rpm
 vim-enhanced-7.4.629-5.el6_8.1.x86_64.rpm
 vim-filesystem-7.4.629-5.el6_8.1.x86_64.rpm
 vim-minimal-7.4.629-5.el6_8.1.x86_64.rpm
 i386
 vim-X11-7.4.629-5.el6_8.1.i686.rpm
 vim-common-7.4.629-5.el6_8.1.i686.rpm
 vim-debuginfo-7.4.629-5.el6_8.1.i686.rpm
 vim-enhanced-7.4.629-5.el6_8.1.i686.rpm
 vim-filesystem-7.4.629-5.el6_8.1.i686.rpm
 vim-minimal-7.4.629-5.el6_8.1.i686.rpm
SL7
 x86_64
 vim-X11-7.4.160-1.el7_3.1.x86_64.rpm
 vim-common-7.4.160-1.el7_3.1.x86_64.rpm
 vim-debuginfo-7.4.160-1.el7_3.1.x86_64.rpm
 vim-enhanced-7.4.160-1.el7_3.1.x86_64.rpm
 vim-filesystem-7.4.160-1.el7_3.1.x86_64.rpm
 vim-minimal-7.4.160-1.el7_3.1.x86_64.rpm

- Scientific Linux Development Team