Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635972 (CVE-2017-8368) - app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Summary: app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Status: RESOLVED FIXED
Alias: CVE-2017-8368
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~2 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-31 01:18 UTC by GLSAMaker/CVETool Bot
Modified: 2017-12-25 21:07 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-10-31 01:18:46 UTC 
CVE-2017-8368 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8368):
  Sublime Text 3 Build 3126 might allow user-assisted attackers to execute
  code via a crafted .mkv file. One threat model is a victim who obtains an
  untrusted crafted file from a remote location and issues several
  user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-10-31 01:19:52 UTC 
@Maintainer please let us know when tree is clean.

Thank you
Comment 2 Larry the Git Cow gentoo-dev 2017-12-25 19:21:15 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ceeca83d1b38890cba5030b27c3bc8c91e36e2a

commit 6ceeca83d1b38890cba5030b27c3bc8c91e36e2a
Author:     David Seifert <soap@gentoo.org>
AuthorDate: 2017-12-25 19:21:01 +0000
Commit:     David Seifert <soap@gentoo.org>
CommitDate: 2017-12-25 19:21:01 +0000

    app-editors/sublime-text: Remove vulnerable versions
    
    Bug: https://bugs.gentoo.org/635972
    Package-Manager: Portage-2.3.19, Repoman-2.3.6

 app-editors/sublime-text/Manifest                  |  4 --
 .../sublime-text/sublime-text-2.0.2-r2.ebuild      | 62 ---------------------
 .../sublime-text/sublime-text-3_pre3126-r3.ebuild  | 64 ----------------------
 3 files changed, 130 deletions(-)}
Comment 3 David Seifert gentoo-dev 2017-12-25 19:21:44 UTC 
@Sec, you can proceed.
Comment 4 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-12-25 21:07:42 UTC 
thank you.

GLSA Vote: No