bugtraq - [SECURITY] [DSA 3786-1] vim security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 13 Feb 2017 22:33:48 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3786-1] vim security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3786-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
February 13, 2017                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : vim
CVE ID         : CVE-2017-5953
Debian Bug     : 854969

Editor spell files passed to the vim (Vi IMproved) editor
may result in an integer overflow in memory allocation
and a resulting buffer overflow which potentially 
could result in the execution of arbitrary code or denial of
service.

For the stable distribution (jessie), this problem has been
fixed in version 2:7.4.488-7+deb8u2.

For the unstable distribution (sid), this problem has been
fixed in version 2:8.0.0197-2.

We recommend that you upgrade your vim packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAliiJbgACgkQEMKTtsN8
Tja9mBAAgj5DEW3ApEzyZ04RmD+a77Ydw6PcQd29JPS+gWvNsqDygijhtQvNIRKk
FDGhjxWSHJ9Z5NqOMkaNBdRJs8w5oBESzwSkb7eaTFkEqU5ckugazVktfiLEXPxo
4VTRNaQXa4ng3SuCdIcOgAk2VxAT06gHT5NnbLN+BJ4L5ODgEINJUiBXlj/7E/iq
HOW7wVOFqE5Qs1BCe77ALLalI+IFuVG2x5UBeC6DfZ7ZW67h+yalUJ4wvzhv4s5R
UarNqd9v8Q/LbtbhYsr8TtR6iLOx4jp0+sy/gyUbiSUK6a55D0p36hViea6jxtv4
1NugSxzdCgUg3qAd/WiX5EIxtnJYAgaMWsnqMF5pyev4IPrPk0hUPKI0W/DLl146
lnHOKaqM3l/SYfU7EnNncw4udXC68amBua3TGkxjZpswt/xeJkxBe3ypw3U03o9j
x48c6NGpPulyRzm6cyrAey3VNAO9+ILFOlDUY+BYPufh7zMhHMjudGNPn/BordQ/
yZ8ekL5yPgOQyAPMGBp4P/RJpV2twS2odm+6/Kf/RB4CNmgUc7BJP66eiMPJa/s/
cB+cb0h7LYvL/tJ9pob2ryOm4Nf11xCdUr/ak6PqL9bBpLQ1WPHk7jY3yzteiRvb
H+k4miSAuWFYtA4yHpkvmeD3Yjyc1hYwzkAduWhbpJyToxQ8HOw=
=a64c
-----END PGP SIGNATURE-----