0
0
mirror of https://github.com/vim/vim.git synced 2025-11-10 10:47:23 -05:00

patch 9.1.1164: [security]: code execution with tar.vim and special crafted tar files

Problem:  editing a special crafted tar file allows code execution
          (RyotaK, after 129a8446d2)
Solution: escape the filename before feeding it to the `:read` command

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2025-03-02 19:33:51 +01:00
parent 8872012e5f
commit 334a13bff7
2 changed files with 18 additions and 13 deletions

View File

@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1164,
/**/
1163,
/**/