Synopsis: Updated vim packages fix security issues
Advisory ID: FLSA:2343
Issue date: 2005-02-23
Product: Red Hat Linux, Fedora Core
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2343
CVE Names: CAN-2004-1138 CAN-2005-0069
Updated vim packages that fix multiple vulnerabilities are now
VIM (Vi IMproved) is an updated and improved version of the vi screen-
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
3. Problem description:
Ciaran McCreesh discovered a modeline vulnerability in VIM. It is
possible that a malicious user could create a file containing a
specially crafted modeline which could cause arbitrary command execution
when viewed by a victim. Please note that this issue only affects users
who have modelines and filetype plugins enabled, which is not the
default. The Common Vulnerabilities and Exposures project has assigned
the name CAN-2004-1138 to this issue.
The Debian Security Audit Project discovered an insecure temporary file
usage in VIM. A local user could overwrite or create files as a
different user who happens to run one of the the vulnerable utilities.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0069 to this issue.
All users of VIM are advised to upgrade to these erratum packages, which
contain backported patches for these issues.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www fedoralegacy.org/docs for directions on how to
configure yum and apt-get.