| Summary: | <app-editors/vim-8.1.0648: out-of-memory in screen.c, state.c, vterm.c leading to denial of service | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> | ||||||
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | minor | CC: | jnerin, vim | ||||||
| Priority: | Normal | Flags: | stable-bot:
sanity-check-
|
||||||
| Version: | unspecified | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1680588 | ||||||||
| Whiteboard: | B3 [noglsa cve] | ||||||||
| Package list: |
=app-editors/vim-8.1.0648-r1
=app-editors/vim-core-8.1.0648
=app-editors/gvim-8.1.0648-r1
|
Runtime testing required: | --- | ||||||
| Attachments: |
|
||||||||
@arches, please stabilize. An automated check of this bug failed - repoman reported dependency errors (197 lines truncated):
> dependency.bad app-editors/vim/vim-8.1.0648-r1.ebuild: DEPEND: alpha(default/linux/alpha/17.0) ['~app-editors/vim-core-8.1.0648']
> dependency.bad app-editors/vim/vim-8.1.0648-r1.ebuild: RDEPEND: alpha(default/linux/alpha/17.0) ['~app-editors/vim-core-8.1.0648']
> dependency.bad app-editors/vim/vim-8.1.0648-r1.ebuild: DEPEND: alpha(default/linux/alpha/17.0/desktop) ['~app-editors/vim-core-8.1.0648']
amd64 stable Stabilizing vim and vim-core but not gvim has led to a dependency failure. amd64 stable s390 stable Created attachment 571678 [details] tatt tests report (ppc64) ppc64: gvim-8.1.0648-r1 fails some tests (bug #682320). Looks good otherwise. Created attachment 571682 [details] tatt tests report (ppc) ppc: gvim-8.1.0648-r1 testsuite hangs (bug #682292). Looks good otherwise. arm stable sparc stable alpha stable arm64 stable hppa stable An automated check of this bug failed - the following atoms are unknown: app-editors/vim-8.1.0648-r1 app-editors/vim-core-8.1.0648 app-editors/gvim-8.1.0648-r1 Please verify the atom list. stable awhile ago and clean. |
From ${URL} : libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c. Upstream Issue: https://github.com/vim/vim/issues/3711 Upstream Patch: https://github.com/vim/vim/commit/cd929f7ba8cc5b6d6dcf35c8b34124e969fed6b8 @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.