SB2020031239 - Gentoo update for Vim, gVim
Published: March 12, 2020 Updated: March 12, 2020
Security Bulletin ID
SB2020031239
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS Command Injection (CVE-ID: CVE-2019-12735)
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Remediation
Install update from vendor's website.