From nobody Mon Mar 03 04:13:35 2025 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Z5lmc0KPDz5hrJf; Mon, 03 Mar 2025 04:13:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Z5lmb6z7rz3hNJ; Mon, 03 Mar 2025 04:13:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740975216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/v/8CjbaWGnX2wG9/xOcvvD0/c5EuXokN3BhXHcH58s=; b=Y98d6agoT0Qs98RMZM3jYMefz0ZFtX5FwNuTD8VPBuoyYBSKgudtuE7o5DlZi6fnXK7w1e ZmGjIy4ZJeAgtgEeRY/qUSt5nRydpL5KnAD7jC7/b/TqrIkYLRxvylYt6jn+kTi4mY/1mC QbKgnWiDUoq2e99n1qGKrVPwBV05AtaBWja7sIF+3/HOpI7jHyogNACy3jMgAqp1Yyx0mP oGOW5z6zzfuu5qX4cmVAqtaYwXcFtigDAGkiFLdFtfGt0QI5SEV0Ws/RsPRW2IsC8GoTCi tlcl02WKofgo+0cv64KSQjTrQNi5HrJ7QgValNSGRdeAkSM8WUDZzb6rbUVxGQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1740975216; a=rsa-sha256; cv=none; b=PO5q2u4djNy1EZDPbNuLTqkQdcLVtUJiUkLpeQQmGDySLyi0Besr+a33yfLu0ekkxjQB1k MGHcOhjgu6EiUoOIJhYSYaTzEvVC+RaofWqqBG+oiWWJTBJHkNumrjXtgxq4z6N8EamhlZ UEaJnJZXrNS/7I2JFcUhnSEbsQuTm53EgtBIbrx+w4VBD9d9ASH2ezeN4o0dp7roSwBSSx 6PjFc5DwvwBwg+ow7clOmfTAx/jefqPITSS8TAM65+E1z8qlfsAib3azKbdulXz8dJwx9p coSQW4DYAao6+Wt0jnXZXV4qSK9RglptR/6qIulj+sw/WhAJIZRL/ZnJTqMhmA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740975216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/v/8CjbaWGnX2wG9/xOcvvD0/c5EuXokN3BhXHcH58s=; b=BbOSUC8Ut+8Ftwu+biY00kzG4GYmDel55iLd86GLyp5oT1H8X3kVfXtNfPBPQwPstKp58/ 6JC0VpVsQDfQFGmF+nEEb9hEWZeKRone6PIcXwjpBqGJg5rZM0IljbZ4yck1KAToriVnhA 0ywzGZRxVH53pAjvbO856t9MlYYMhbDv/24NlZ8g42Ix3vhgxbs6Q/kV+0jfINWPU/znRz gIMXMquTD415heQ4LxdBzbLAmea9YxpQsjW4tiqWzRhSlZlU2qsuMXrOGrSK+kZ4pdHXdI xckcc9gqqxJjSeVcH1gCs2TAe47VFGPDlJwtxpLTW3JspbpHfF5GCJJPWQRYqA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Z5lmb6Yw3zXbj; Mon, 03 Mar 2025 04:13:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5234DZo7065631; Mon, 3 Mar 2025 04:13:35 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5234DZsS065628; Mon, 3 Mar 2025 04:13:35 GMT (envelope-from git) Date: Mon, 3 Mar 2025 04:13:35 GMT Message-Id: <202503030413.5234DZsS065628@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org From: Adam Weinberger Subject: git: ead69c91fa0a - 2025Q1 - editors/vim: Update to 9.1.1164 (security, high severity) List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adamw X-Git-Repository: ports X-Git-Refname: refs/heads/2025Q1 X-Git-Reftype: branch X-Git-Commit: ead69c91fa0ab64fbe70a4f7e6da1973a04e4b4f Auto-Submitted: auto-generated The branch 2025Q1 has been updated by adamw: URL: https://cgit.FreeBSD.org/ports/commit/?id=ead69c91fa0ab64fbe70a4f7e6da1973a04e4b4f commit ead69c91fa0ab64fbe70a4f7e6da1973a04e4b4f Author: Adam Weinberger AuthorDate: 2025-03-03 04:00:23 +0000 Commit: Adam Weinberger CommitDate: 2025-03-03 04:13:15 +0000 editors/vim: Update to 9.1.1164 (security, high severity) From the Github Advisory (https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3): Summary: Potential code execution with tar.vim and special crafted tar files. Description: Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to support permissions), the tar.vim plugin uses the ":read " ex command line to append below the cursor position, however the is not sanitized and is taken literaly from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). Impact: Impact is high but a user must be convinced to edit such a file using Vim which will reveal the filename, so a careful user may suspect some strange things going on. The Vim project would like to thank RyotaK (GMO Flatt Security Inc) for reporting this issue. The issue has been fixed as of Vim patch v9.1.1164. MFH: 2025Q1 Security: GHSA-wfmf-8626-q3r3 (cherry picked from commit c7aeeb0958ae7cba9ceb3f734c0f21e1722d8680) --- editors/vim/Makefile | 2 +- editors/vim/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/editors/vim/Makefile b/editors/vim/Makefile index adbbc212dbce..5a792383d5c5 100644 --- a/editors/vim/Makefile +++ b/editors/vim/Makefile @@ -1,5 +1,5 @@ PORTNAME= vim -PORTVERSION= 9.1.0984 +PORTVERSION= 9.1.1166 DISTVERSIONPREFIX= v CATEGORIES= editors diff --git a/editors/vim/distinfo b/editors/vim/distinfo index ce544689ea14..42237eeb2869 100644 --- a/editors/vim/distinfo +++ b/editors/vim/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1735869944 -SHA256 (vim-vim-v9.1.0984_GH0.tar.gz) = 1a821c8fa4fe176e2713ac38ed37fe85da6785d9095233dd830e5e97f2aad681 -SIZE (vim-vim-v9.1.0984_GH0.tar.gz) = 18380062 +TIMESTAMP = 1740975157 +SHA256 (vim-vim-v9.1.1166_GH0.tar.gz) = 18543682cffe511407ef6a61af6df842d60232fad58c7c02544ae5860107e6be +SIZE (vim-vim-v9.1.1166_GH0.tar.gz) = 18510701