DSA-3786

96217

https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d

https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY

GLSA-201706-26

USN-4016-1

It was discovered that Vim incorrectly handled certain sources. An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS (CVE-2017-11109)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
(CVE-2017-5953)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.06 LTS. (CVE-2018-20786)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-20079)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2017-6349, CVE-2017-6350).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-5953)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12735).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the vim package has been released.

An update of [linux,vim] packages for PhotonOS has been released.

This update for vim fixes the following issues :

Security issues fixed :

  - CVE-2017-5953: Fixed a possible overflow with corrupted     spell file (bsc#1024724)

  - CVE-2017-6350: Fixed a possible overflow when reading a     corrupted undo file (bsc#1027053)

  - CVE-2017-6349: Fixed a possible overflow when reading a     corrupted undo file (bsc#1027057)

Non security issues fixed :

  - Speed up YAML syntax highlighting (bsc#1018870)

This update was imported from the SUSE:SLE-12:Update update project.

This update for vim fixes the following issues :

  - CVE-2017-5953: Fixed a possible overflow with corrupted     spell file (bsc#1024724)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for vim fixes the following issues: Security issues fixed :

  - CVE-2017-5953: Fixed a possible overflow with corrupted     spell file (bsc#1024724)

  - CVE-2017-6350: Fixed a possible overflow when reading a     corrupted undo file (bsc#1027053)

  - CVE-2017-6349: Fixed a possible overflow when reading a     corrupted undo file (bsc#1027057) Non security issues     fixed :

  - Speed up YAML syntax highlighting (bsc#1018870)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-26 (Vim, gVim: Remote execution of arbitrary code)

    Multiple vulnerabilities have been discovered in Vim and gVim. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted spell       file using Vim or gVim, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in vim in how certain     modeline options were treated. An attacker could craft     a file that, when opened in vim with modelines enabled,     could execute arbitrary commands with privileges of the     user running vim. (CVE-2016-1248)

  - vim before patch 8.0.0322 does not properly validate     values for tree length when handling a spell file,     which may result in an integer overflow at a memory     allocation site and a resultant buffer     overflow.(CVE-2017-5953)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw was found in the way vim handled tree length values when reading an undo file. This bug could result in vim crashing when trying to process corrupted undo files. (CVE-2017-6350)

An integer overflow flaw was found in the way vim handled undo files.
This bug could result in vim crashing when trying to process corrupted undo files.(CVE-2017-6349)

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
(CVE-2017-5953)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for vim fixes the following issues :

  - CVE-2017-5953: Fixed a possible overflow with corrupted     spell file (bsc#1024724)

Editor spell files passed to the vim (Vi IMproved) editor may result in an integer overflow in memory allocation and a resulting buffer overflow which potentially could result in the execution of arbitrary code or denial of service.

A vulnerability has been discovered in Vim where a malformed spell file could cause an integer overflow which is used as the size for memory allocation, resulting in a subsequent buffer overflow.

For Debian 7 'Wheezy', these problems have been fixed in version 2:7.3.547-7+deb7u2.

We recommend that you upgrade your vim packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
134856	Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : Vim vulnerabilities (USN-4309-1)	Nessus	Ubuntu Local Security Checks	critical
125853	Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Vim vulnerabilities (USN-4016-1)	Nessus	Ubuntu Local Security Checks	high
121673	Photon OS 1.0: Vim PHSA-2017-0006	Nessus	PhotonOS Local Security Checks	critical
111855	Photon OS 1.0: Linux / Vim PHSA-2017-0006 (deprecated)	Nessus	PhotonOS Local Security Checks	critical
101285	openSUSE Security Update : vim (openSUSE-2017-788)	Nessus	SuSE Local Security Checks	critical
101228	SUSE SLES11 Security Update : vim (SUSE-SU-2017:1775-1)	Nessus	SuSE Local Security Checks	critical
101108	SUSE SLED12 / SLES12 Security Update : vim (SUSE-SU-2017:1712-1)	Nessus	SuSE Local Security Checks	critical
101021	GLSA-201706-26 : Vim, gVim: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
99879	EulerOS 2.0 SP2 : vim (EulerOS-SA-2017-1034)	Nessus	Huawei Local Security Checks	critical
99878	EulerOS 2.0 SP1 : vim (EulerOS-SA-2017-1033)	Nessus	Huawei Local Security Checks	critical
99036	Amazon Linux AMI : vim (ALAS-2017-809)	Nessus	Amazon Linux Local Security Checks	critical
97426	Fedora 24 : 2:vim (2017-9b2cf468d5)	Nessus	Fedora Local Security Checks	critical
97289	openSUSE Security Update : vim (openSUSE-2017-280)	Nessus	SuSE Local Security Checks	critical
97168	Fedora 25 : 2:vim (2017-595fec72ef)	Nessus	Fedora Local Security Checks	critical
97135	Debian DSA-3786-1 : vim - security update	Nessus	Debian Local Security Checks	critical
97106	Debian DLA-822-1 : vim security update	Nessus	Debian Local Security Checks	critical

CVE-2017-5953

critical

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical