Skip to content
Snippets Groups Projects
Commit c7aeeb09 authored by Adam Weinberger's avatar Adam Weinberger
Browse files

editors/vim: Update to 9.1.1164 (security, high severity)

From the Github Advisory (https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3):
  Summary:

      Potential code execution with tar.vim and special crafted tar
      files.

  Description:

      Vim is distributed with the tar.vim plugin, that allows easy
      editing and viewing of (compressed or uncompressed) tar files.

      Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to
      support permissions), the tar.vim plugin uses the ":read " ex
      command line to append below the cursor position, however the is
      not sanitized and is taken literaly from the tar archive. This
      allows to execute shell commands via special crafted tar archives.
      Whether this really happens, depends on the shell being used
      ('shell' option, which is set using $SHELL).

  Impact:

      Impact is high but a user must be convinced to edit such a file
      using Vim which will reveal the filename, so a careful user may
      suspect some strange things going on.

  The Vim project would like to thank RyotaK (GMO Flatt Security Inc)
  for reporting this issue.

  The issue has been fixed as of Vim patch v9.1.1164.

MFH:		2025Q1
Security:	GHSA-wfmf-8626-q3r3
parent b0007142
No related branches found
No related tags found
No related merge requests found
PORTNAME= vim
PORTVERSION= 9.1.1117
PORTVERSION= 9.1.1166
DISTVERSIONPREFIX= v
CATEGORIES= editors
......
TIMESTAMP = 1739731868
SHA256 (vim-vim-v9.1.1117_GH0.tar.gz) = 5801f8c82a565127cf8a40900247e3093e1130b0bda915f122293413d70ed74a
SIZE (vim-vim-v9.1.1117_GH0.tar.gz) = 18487875
TIMESTAMP = 1740973693
SHA256 (vim-vim-v9.1.1166_GH0.tar.gz) = 18543682cffe511407ef6a61af6df842d60232fad58c7c02544ae5860107e6be
SIZE (vim-vim-v9.1.1166_GH0.tar.gz) = 18510701
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment