Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-12735: It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution. 1718308: CVE-2019-12735 vim/neovim: ':source!' command allows arbitrary command execution via modelines
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | vim-common | 2:8.1.1602-1.amzn2 |
| Amazon Linux · 2 | vim-debuginfo | 2:8.1.1602-1.amzn2 |
| Amazon Linux · 2 | vim-enhanced | 2:8.1.1602-1.amzn2 |
| Amazon Linux · 2 | vim-filesystem | 2:8.1.1602-1.amzn2 |
| Amazon Linux · 2 | vim-minimal | 2:8.1.1602-1.amzn2 |
| Amazon Linux · 2 | vim-X11 | 2:8.1.1602-1.amzn2 |
Vulnerabilities 1
-
Unscored —
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via t…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-12735.html