REDHAT-BUG-2455400: High severity vim Vim vulnerability
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the PMLE flag, allowing a modeline to be executed. Additionally, the mapset() function lacks a checksecure() call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0276Patch 9.2.0276 - Compensating control
For Vim, ensure the modeline sandbox restrictions are enforced by using settings that include the P_MLE flag for the `complete`, `guitabtooltip`, and `printheader` options, since missing the `P_MLE` flag allows a modeline to be executed.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455400?
The severity of REDHAT-BUG-2455400 is critical due to the risk of arbitrary OS command execution.
How do I fix REDHAT-BUG-2455400?
To fix REDHAT-BUG-2455400, upgrade Vim to version 9.2.0276 or later.
What versions of Vim are affected by REDHAT-BUG-2455400?
Vim versions prior to 9.2.0276 are affected by REDHAT-BUG-2455400.
What is a modeline sandbox bypass in REDHAT-BUG-2455400?
A modeline sandbox bypass in REDHAT-BUG-2455400 allows crafted files to execute arbitrary OS commands when opened in Vim.
Who is responsible for the vulnerability REDHAT-BUG-2455400?
The vulnerability REDHAT-BUG-2455400 is a result of improper option handling in Vim.