Bug 635972 (CVE-2017-8368)

Summary:	app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	soap
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~2 [noglsa cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-31 01:18:46 UTC

CVE-2017-8368 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8368):
  Sublime Text 3 Build 3126 might allow user-assisted attackers to execute
  code via a crafted .mkv file. One threat model is a victim who obtains an
  untrusted crafted file from a remote location and issues several
  user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-31 01:19:52 UTC

@Maintainer please let us know when tree is clean.

Thank you

Comment 2 Larry the Git Cow gentoo-dev

2017-12-25 19:21:15 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ceeca83d1b38890cba5030b27c3bc8c91e36e2a

commit 6ceeca83d1b38890cba5030b27c3bc8c91e36e2a
Author:     David Seifert <soap@gentoo.org>
AuthorDate: 2017-12-25 19:21:01 +0000
Commit:     David Seifert <soap@gentoo.org>
CommitDate: 2017-12-25 19:21:01 +0000

    app-editors/sublime-text: Remove vulnerable versions
    
    Bug: https://bugs.gentoo.org/635972
    Package-Manager: Portage-2.3.19, Repoman-2.3.6

 app-editors/sublime-text/Manifest                  |  4 --
 .../sublime-text/sublime-text-2.0.2-r2.ebuild      | 62 ---------------------
 .../sublime-text/sublime-text-3_pre3126-r3.ebuild  | 64 ----------------------
 3 files changed, 130 deletions(-)}

Comment 3 David Seifert gentoo-dev

2017-12-25 19:21:44 UTC

@Sec, you can proceed.

Comment 4 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-12-25 21:07:42 UTC

thank you.

GLSA Vote: No