Synopsis

Moderate: vim security update

Type/Severity

Security Advisory: Moderate

Topic

Updated vim packages that fix various security issues are now available for
Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Vim (Visual editor IMproved) is an updated and improved version of the vi
editor.

Several input sanitization flaws were found in Vim's keyword and tag
handling. If Vim looked up a document's maliciously crafted tag or keyword,
it was possible to execute arbitrary code as the user running Vim.
(CVE-2008-4101)

A heap-based overflow flaw was discovered in Vim's expansion of file name
patterns with shell wildcards. An attacker could create a specially-crafted
file or directory name that, when opened by Vim, caused the application to
crash or, possibly, execute arbitrary code. (CVE-2008-3432)

Several input sanitization flaws were found in various Vim system
functions. If a user opened a specially crafted file, it was possible to
execute arbitrary code as the user running Vim. (CVE-2008-2712)

Ulf Härnhammar, of Secunia Research, discovered a format string flaw in
Vim's help tag processor. If a user was tricked into executing the
"helptags" command on malicious data, arbitrary code could be executed with
the permissions of the user running Vim. (CVE-2007-2953)

All Vim users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc

Fixes

• BZ - 248542 - CVE-2007-2953 vim format string flaw
• BZ - 451759 - CVE-2008-2712 vim: command execution via scripts not sanitizing inputs to execute and system
• BZ - 455455 - CVE-2008-3432 vim: heap buffer overflow in mch_expand_wildcards()
• BZ - 461927 - CVE-2008-4101 vim: arbitrary code execution in commands: K, Control-], g]

CVEs

• CVE-2008-2712
• CVE-2007-2953
• CVE-2008-4101
• CVE-2008-3432

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
x86_64
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
ia64
vim-X11-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 59bc8e234443ef95a3cb04728314febf1e1f6f4e9ea388ff362775a118291eff
vim-X11-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 59bc8e234443ef95a3cb04728314febf1e1f6f4e9ea388ff362775a118291eff
vim-common-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 29ccaf3f0e611b008031233192cf0936c00619ffa18dd309acf20377cf85d71d
vim-common-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 29ccaf3f0e611b008031233192cf0936c00619ffa18dd309acf20377cf85d71d
vim-enhanced-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 794d235d1de2e748e1e9dce870137052d482ac3db7ca213c707bd90b8c4ae877
vim-enhanced-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 794d235d1de2e748e1e9dce870137052d482ac3db7ca213c707bd90b8c4ae877
vim-minimal-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 487e393997dd410f0238608fef0ee3a734a660e18d51af816961b129b18d198a
vim-minimal-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 487e393997dd410f0238608fef0ee3a734a660e18d51af816961b129b18d198a
i386
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f

Red Hat Enterprise Linux Server - Extended Update Support 4.7

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
x86_64
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
ia64
vim-X11-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 59bc8e234443ef95a3cb04728314febf1e1f6f4e9ea388ff362775a118291eff
vim-X11-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 59bc8e234443ef95a3cb04728314febf1e1f6f4e9ea388ff362775a118291eff
vim-common-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 29ccaf3f0e611b008031233192cf0936c00619ffa18dd309acf20377cf85d71d
vim-common-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 29ccaf3f0e611b008031233192cf0936c00619ffa18dd309acf20377cf85d71d
vim-enhanced-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 794d235d1de2e748e1e9dce870137052d482ac3db7ca213c707bd90b8c4ae877
vim-enhanced-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 794d235d1de2e748e1e9dce870137052d482ac3db7ca213c707bd90b8c4ae877
vim-minimal-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 487e393997dd410f0238608fef0ee3a734a660e18d51af816961b129b18d198a
vim-minimal-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 487e393997dd410f0238608fef0ee3a734a660e18d51af816961b129b18d198a
i386
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f

Red Hat Enterprise Linux Workstation 4

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
x86_64
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
ia64
vim-X11-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 59bc8e234443ef95a3cb04728314febf1e1f6f4e9ea388ff362775a118291eff
vim-common-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 29ccaf3f0e611b008031233192cf0936c00619ffa18dd309acf20377cf85d71d
vim-enhanced-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 794d235d1de2e748e1e9dce870137052d482ac3db7ca213c707bd90b8c4ae877
vim-minimal-6.3.046-1.el4_7.5z.ia64.rpm	SHA-256: 487e393997dd410f0238608fef0ee3a734a660e18d51af816961b129b18d198a
i386
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f

Red Hat Enterprise Linux Desktop 4

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
x86_64
vim-X11-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 89a5dcf2de99b4a288802728da8858959b84143f41f06620b09266b4b7dee067
vim-common-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 4f2390d3773d042b74950518143ee439f4e845a2e2f33aecbe0c32885a6c8176
vim-enhanced-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: c92aecfc4ffa9e5c7d5dd693fbf137c76af421cf0a17473d2da4f3cdfb3c8d75
vim-minimal-6.3.046-1.el4_7.5z.x86_64.rpm	SHA-256: 39a1ea15fd8e6a1fe752c209c3c476b6492ca55ad8a30c94901e8c8bae2fd8a4
i386
vim-X11-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 76c0205d85a7dd753c18162a38553493ca52b1ac562fc9f2be2b5e65119a56a9
vim-common-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 85797904518bd4bf387060a1ae8cd6a8c4b785d39d094c1ec650186b509196c5
vim-enhanced-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: 32d3b7667c726a789e86e4e67364ca6c3aaf98b51938c1be7e3b6232f5ec2c6d
vim-minimal-6.3.046-1.el4_7.5z.i386.rpm	SHA-256: c86be5e48ef1918728abc90bc73f82d5d669f1b55bd9833338bb9687be116c4f

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
s390x
vim-X11-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 75624b33ffa78c02043dfaa3ef944c92922997664c5d21a473ad8c994c894f89
vim-common-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 37835b4e7f3ce7a3dfb0e6b86504f8fe0c011c256c1c4a53d47248b4be106f54
vim-enhanced-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 900e111b0b5970e91c9852a5915350ebfd3d4ab62852a4acbc4cba779d2ff803
vim-minimal-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 8552ace0581eec228db39b5630e0847063a195fdd27e911df6a91635f95e9328
s390
vim-X11-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: 64b4c7b891d26c8fdcc1b5e27a66f1207d539c9bb84b9b7be9d5589b51e332fa
vim-common-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: 64742ae338cef7d24f2155a4fe95515a4275db8c80583bc61d3135215f3ef72b
vim-enhanced-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: a7a1e4d4b5c8e2e2aabbdc3f77cda54700bac960b9a9bec36b4dfcb99859c4fd
vim-minimal-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: b1dc445b700c9c6445dab2bb748fb137e88d86070f4658a3015a5f320458e82b

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
s390x
vim-X11-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 75624b33ffa78c02043dfaa3ef944c92922997664c5d21a473ad8c994c894f89
vim-common-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 37835b4e7f3ce7a3dfb0e6b86504f8fe0c011c256c1c4a53d47248b4be106f54
vim-enhanced-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 900e111b0b5970e91c9852a5915350ebfd3d4ab62852a4acbc4cba779d2ff803
vim-minimal-6.3.046-1.el4_7.5z.s390x.rpm	SHA-256: 8552ace0581eec228db39b5630e0847063a195fdd27e911df6a91635f95e9328
s390
vim-X11-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: 64b4c7b891d26c8fdcc1b5e27a66f1207d539c9bb84b9b7be9d5589b51e332fa
vim-common-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: 64742ae338cef7d24f2155a4fe95515a4275db8c80583bc61d3135215f3ef72b
vim-enhanced-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: a7a1e4d4b5c8e2e2aabbdc3f77cda54700bac960b9a9bec36b4dfcb99859c4fd
vim-minimal-6.3.046-1.el4_7.5z.s390.rpm	SHA-256: b1dc445b700c9c6445dab2bb748fb137e88d86070f4658a3015a5f320458e82b

Red Hat Enterprise Linux for Power, big endian 4

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
ppc
vim-X11-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: c50f10a46db221031a8947b6357c48f68c19c55316019ef288f8f9d0386dc196
vim-common-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: 2bc61450cf14375794cb5b2078ddff7404caa9fddbffdfa4d8fbc2bf227cbf45
vim-enhanced-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: 63239a5e2be6971d416dd4dfce47ae930106f5c092ca3bf2c0d52e8910703877
vim-minimal-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: d8715c828089d75811168e523ab804ce6eb24ef651e0e185183b79f4c3a19291

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7

SRPM
vim-6.3.046-1.el4_7.5z.src.rpm	SHA-256: 240e3eddc02989bed139d9911699ed305f99740186170cfaf22ba6dbc471c8f0
ppc
vim-X11-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: c50f10a46db221031a8947b6357c48f68c19c55316019ef288f8f9d0386dc196
vim-common-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: 2bc61450cf14375794cb5b2078ddff7404caa9fddbffdfa4d8fbc2bf227cbf45
vim-enhanced-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: 63239a5e2be6971d416dd4dfce47ae930106f5c092ca3bf2c0d52e8910703877
vim-minimal-6.3.046-1.el4_7.5z.ppc.rpm	SHA-256: d8715c828089d75811168e523ab804ce6eb24ef651e0e185183b79f4c3a19291