Debian Project

Debian testing security team - Advisory

DTSA-12-1

Date Reported:
September 8th, 2005
Affected Package:
vim
Vulnerability:
modeline exploits
Problem-Scope:
local
Debian-specific:
No
CVE:
CVE-2005-2368

More information:
vim modelines allow files to execute arbitrary commands via shell 
metacharacters in the glob or expand commands of a foldexpr expression 
for calculating fold levels. 

For the testing distribution (etch) this is fixed in version 1:6.3-085+0.0etch1
For the unstable distribution (sid) this is fixed in version 1:6.3-085+1

This upgrade is recommended if you use vim.

If you have the secure testing lines in your sources.list, you can update by running this command as root:
apt-get update && apt-get install vim


To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:

deb http://secure-testing.debian.net/debian-secure-testing etch/security-updates main contrib non-free
deb-src http://secure-testing.debian.net/debian-secure-testing etch/security-updates main contrib non-free

The archive signing key can be downloaded from
http://secure-testing.debian.net/ziyi-2005-7.asc


Valid HTML 4.01! Valid CSS!