The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2022-0894 https://linux.oracle.com/errata/ELSA-2022-0894.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: vim-X11-8.0.1763-16.0.1.el8_5.12.x86_64.rpm vim-common-8.0.1763-16.0.1.el8_5.12.x86_64.rpm vim-enhanced-8.0.1763-16.0.1.el8_5.12.x86_64.rpm vim-filesystem-8.0.1763-16.0.1.el8_5.12.noarch.rpm vim-minimal-8.0.1763-16.0.1.el8_5.12.x86_64.rpm aarch64: vim-X11-8.0.1763-16.0.1.el8_5.12.aarch64.rpm vim-common-8.0.1763-16.0.1.el8_5.12.aarch64.rpm vim-enhanced-8.0.1763-16.0.1.el8_5.12.aarch64.rpm vim-filesystem-8.0.1763-16.0.1.el8_5.12.noarch.rpm vim-minimal-8.0.1763-16.0.1.el8_5.12.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates/vim-8.0.1763-16.0.1.el8_5.12.src.rpm Related CVEs: CVE-2022-0261 CVE-2022-0318 CVE-2022-0359 CVE-2022-0361 CVE-2022-0392 CVE-2022-0413 Description of changes: [8.0.1763-16.0.1] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16.12] - CVE-2022-0361 vim: Heap-based Buffer Overflow in GitHub repository [2:8.0.1763-16.11] - CVE-2022-0413 vim: use after free in src/ex_cmds.c - Fix specfile problems - Resolves: rhbz#2048525 [2:8.0.1763-16.10] - CVE-2022-0413 vim: use after free in src/ex_cmds.c - Resolves: rhbz#2048525 [2:8.0.1763-16.9] - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c - Improve fix - Resolves: rhbz#2049403 [2:8.0.1763-16.8] - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c - Resolves: rhbz#2049403 [2:8.0.1763-16.7] - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c [2:8.0.1763-16.6] - fix test suite after fix for CVE-2022-0318 [2:8.0.1763-16.5] - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() inmbyte.c _______________________________________________ El-errata mailing list
The package vim before version 8.1.1467-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-201906-8 ======================================== Severity: High Date : 2019-06-11 CVE-ID : CVE-2019-12735 Package : vim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-975 Summary ====== The package vim before version 8.1.1467-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 8.1.1467-1. # pacman -Syu "vim> =8.1.1467-1" The problem has been fixed upstream in version 8.1.1467. Workaround ========= Disable modeline support in the vimrc file by setting: set nomodeline Description ========== getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Impact ===== A remote attacker could execute code with a maliciously written file. References ========= https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 https://security.archlinux.org/CVE-2019-12735 . The Arch Linux Security Advisory ASA-202310-15 highlights a critical vulnerability in the vim text editor that could lead to unauthorized code execution.. Arch Linux Security, vim Package Update, Arbitrary Code Execution, High Severity Flaw, Linux Security Advisory. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.