Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 635972 (CVE-2017-8368)

Summary: app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: trivial CC: soap
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: ~2 [noglsa cve]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2017-10-31 01:18:46 UTC
CVE-2017-8368 (
  Sublime Text 3 Build 3126 might allow user-assisted attackers to execute
  code via a crafted .mkv file. One threat model is a victim who obtains an
  untrusted crafted file from a remote location and issues several
  user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-10-31 01:19:52 UTC
@Maintainer please let us know when tree is clean.

Thank you
Comment 2 Larry the Git Cow gentoo-dev 2017-12-25 19:21:15 UTC
The bug has been referenced in the following commit(s):

commit 6ceeca83d1b38890cba5030b27c3bc8c91e36e2a
Author:     David Seifert <>
AuthorDate: 2017-12-25 19:21:01 +0000
Commit:     David Seifert <>
CommitDate: 2017-12-25 19:21:01 +0000

    app-editors/sublime-text: Remove vulnerable versions
    Package-Manager: Portage-2.3.19, Repoman-2.3.6

 app-editors/sublime-text/Manifest                  |  4 --
 .../sublime-text/sublime-text-2.0.2-r2.ebuild      | 62 ---------------------
 .../sublime-text/sublime-text-3_pre3126-r3.ebuild  | 64 ----------------------
 3 files changed, 130 deletions(-)}
Comment 3 David Seifert gentoo-dev 2017-12-25 19:21:44 UTC
@Sec, you can proceed.
Comment 4 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-12-25 21:07:42 UTC
thank you.

GLSA Vote: No