FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

vim -- Potential code execution

Affected packages
vim < 9.1.1164
vim-gtk2 < 9.1.1164
vim-gtk3 < 9.1.1164
vim-motif < 9.1.1164
vim-tiny < 9.1.1164
vim-x11 < 9.1.1164

Details

VuXML ID 398d1ec1-f7e6-11ef-bb15-002590af0794
Discovery 2025-03-02
Entry 2025-03-02

vim reports:

Summary

Potential code execution with tar.vim and special crafted tar files

Description

Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files.

Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to support permissions), the tar.vim plugin uses the ":read " ex command line to append below the cursor position, however the is not sanitized and is taken literaly from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL).

Impact

Impact is high but a user must be convinced to edit such a file using Vim which will reveal the filename, so a careful user may suspect some strange things going on.

References

URL https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3