EulerOS 2.0 SP1 : vim (EulerOS-SA-2017-1033)
High Nessus Plugin ID 99878
SynopsisThe remote EulerOS host is missing multiple security updates.
DescriptionAccording to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :
- A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim. (CVE-2016-1248)
- vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.(CVE-2017-5953)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected vim packages.