Summary
Florian Larysch discovered that the Vim text editor did not properly
validate values for the 'filetype', 'syntax', and 'keymap' options. An
attacker could trick a user into opening a file with specially crafted
modelines and possibly execute arbitrary code with the user's privileges.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | vim | 2:7.4.052-1ubuntu3.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | vim | 2:7.4.1689-3ubuntu1.2 |
Vulnerabilities 1
-
Unscored —CVE-2016-1248 EPSS 25%
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which ma…
References
-
report
https://ubuntu.com/security/CVE-2016-1248