Bugzilla Bug 176464

feedkeys() and writefile() functions are allowed in sandbox which allows a
malicious file run arbitrary commands in a modeline-enabled vim like:
  vim: fdm=expr fde=feedkeys("\\:!touch\ phantom_was_here\\<cr>")
  vim: fdm=expr fde=writefile([""],"phantom_was_here")

 These problems have been fixed with patch-7.0.234[1] and patch-7.0.235[2]
 A temporary solution is to 'set nomodeline' in vimrc which Gentoo already has
by default.

 oh and..
 [1] ftp://ftp.vim.org/pub/vim/patches/7.0/7.0.234
 [2] ftp://ftp.vim.org/pub/vim/patches/7.0/7.0.235
 sorry..

Created an attachment (id=117677) [edit]
vim-7.0.235.ebuild

 I think bumping vim to version 7.0.235 is a good idea. I've created a snapshot
of 
vim patches the way gentoo packages them. It's under
http://hawking.nonlogic.org/distfiles/vim-patches-7.0.235.tar.gz
 I'm attaching updated ebuilds, basically only their names and SRC_URI is
changed.

Created an attachment (id=117686) [edit]
vim-core-7.0.235.ebuild

Created an attachment (id=117688) [edit]
gvim-7.0.235.ebuild

vim please advise and bump as necessary.

*** Bug 176477 has been marked as a duplicate of this bug. ***

7.0.235 is already in the tree, though currently it is not keyworded stable on
any arch. So, I guess the next step is to request keywording, correct?

Sorry for being late I must have forgot to commit the last one a few days ago.

Arches please test and mark stable. Target keywords are:

vim-7.0.235.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 m68k mips ppc ppc64 s390
sh sparc ~sparc-fbsd x86 ~x86 ~x86-fbsd"

ia64 + x86 stable

armin76 just mentioned that gvim needs to go stable as well.

gvim-7.0.235.ebuild:KEYWORDS="alpha amd64 hppa ia64 mips ppc ~ppc64 sparc x86
~x86-fbsd"

sparc all done for vim-core, [g]vim.

Alpha done.

app-editors/gvim needs to be marked stable at the same time or there'll be
issues for folks who have both vim and gvim installed.

oops, sorry, just was going from old emails when i sent that. ignore me...

Stable for HPPA.

ppc64 stable

ppc stable

amd64 done.

*** Bug 168008 has been marked as a duplicate of this bug. ***

This one is ready for GLSA decision. I tend to vote NO.

I vote NO as it seems that Gentoo default install protects against this.

I'd also vote no, but I'd like a way to let users know about a more secure
replacement for vim's builtin moreline support that was just added to the tree
-- app-vim/securemodelines. I'd recommend that users disable modelines if they
have enabled them locally, and install that script instead.

Is that something more appropriate for a GWN article or somethimg?

I'd say GWN + enote.

I vote no too since it's not the default config, and since modeline is known to
be dangerous in some cases. OK for GWN.

Mike, i close this bug but feel free to reopen it if this is useful to you.

All three stable on mips for 7.0.235.