Arch Linux alert ASA-201611-29 (neovim)

From:
    	     
 
Levente Polyak <anthraxx@archlinux.org> 
To:
    	     
 
arch-security@archlinux.org 
Subject:
    	     
 
[arch-security] [ASA-201611-29] neovim: arbitrary command execution 
Date:
    	     
 
Wed, 30 Nov 2016 00:32:43 +0100
Message-ID:
    	     
 
<fda2d103-c7da-7677-eed5-618da37b98ff@archlinux.org>
Arch Linux Security Advisory ASA-201611-29
==========================================

Severity: High
Date    : 2016-11-29
CVE-ID  : CVE-2016-1248
Package : neovim
Type    : arbitrary command execution
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package neovim before version 0.1.7-1 is vulnerable to arbitrary
command execution.

Resolution
==========

Upgrade to 0.1.7-1.

# pacman -Syu "neovim>=0.1.7-1"

The problem has been fixed upstream in version 0.1.7.

Workaround
==========

None.

Description
===========

A vulnerability has been discovered in vim which would allow arbitrary
shell commands to be run if a user opened a file with a malicious
modeline. This is due to lack of validation of values for a few
options. Those options' values are then used in vim's scripts to build
a command string that's evaluated by execute, which is what allows the
shell commands to be run.

This has been fixed in Vim by patch 8.0.0056. Since Neovim shares this
code, it is also vulnerable.

Impact
======

An attacker is able to execute arbitrary commands by tricking a user to
open a malicious file with a special modeline.

References
==========

https://bugs.archlinux.org/task/51927
https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99...
https://github.com/neovim/neovim/commit/4fad66fbe637818b6...
https://access.redhat.com/security/cve/CVE-2016-1248