Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635972 (CVE-2017-8368) - app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Summary: app-editors/sublime-text: User-assisted Remote Code Execution (CVE-2017-8368)
Alias: CVE-2017-8368
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~2 [noglsa cve]
Depends on:
Reported: 2017-10-31 01:18 UTC by GLSAMaker/CVETool Bot
Modified: 2017-12-25 21:07 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-10-31 01:18:46 UTC
CVE-2017-8368 (
  Sublime Text 3 Build 3126 might allow user-assisted attackers to execute
  code via a crafted .mkv file. One threat model is a victim who obtains an
  untrusted crafted file from a remote location and issues several
  user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-10-31 01:19:52 UTC
@Maintainer please let us know when tree is clean.

Thank you
Comment 2 Larry the Git Cow gentoo-dev 2017-12-25 19:21:15 UTC
The bug has been referenced in the following commit(s):

commit 6ceeca83d1b38890cba5030b27c3bc8c91e36e2a
Author:     David Seifert <>
AuthorDate: 2017-12-25 19:21:01 +0000
Commit:     David Seifert <>
CommitDate: 2017-12-25 19:21:01 +0000

    app-editors/sublime-text: Remove vulnerable versions
    Package-Manager: Portage-2.3.19, Repoman-2.3.6

 app-editors/sublime-text/Manifest                  |  4 --
 .../sublime-text/sublime-text-2.0.2-r2.ebuild      | 62 ---------------------
 .../sublime-text/sublime-text-3_pre3126-r3.ebuild  | 64 ----------------------
 3 files changed, 130 deletions(-)}
Comment 3 David Seifert gentoo-dev 2017-12-25 19:21:44 UTC
@Sec, you can proceed.
Comment 4 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-12-25 21:07:42 UTC
thank you.

GLSA Vote: No