From nobody Mon Mar 3 04:10:46 2025 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Z5ljL3vxYz5hr9H; Mon, 03 Mar 2025 04:10:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Z5ljL3R8rz3gb8; Mon, 03 Mar 2025 04:10:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740975046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dl/sSRRmAlidqUJBPpS03beZfw7pUnogZTq0RzjHw0g=; b=iu1l6zOuSYu6d3GA0zeI0kDK/oWiGsWU9Yat04lJiXm0N7feVoxLJ98jMQ4cPh/iYVb09b F+2+mF2rM0Okv+WWZyv47UTja6CeKWaxOE0tqJiKgQQzsiZd1Ns6XIESpGBosSbmYgiNVR Y60wkZtRnZZ+DskNHp0Ql/cTgo1ltFu1ZN43K/L1w5Adw/zwXuFEQWLzOx/N2+El7UlkHB /a3/VTTzzGjhvGWotTC4jg2TdY9/d8SfxZMeoitg0FZzqo6z5b6WmkycBDwFZ7orRY3ima 8/LyLD96bjgcbBlz8YGYCtSS4eGbwE43bYIJGdRIOGYsFjRWcIjClqNB/srryg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1740975046; a=rsa-sha256; cv=none; b=fxtFUrrbILr7CjA0SUppbRV68BMJJQxvpCnZUtVgkg1myxiGeIZD5IGKpFvxHTlyBhMSRg CQLD81X1+YWJZuX4+CCxZyBN8kOUXPsjjomaYKLjlBjqbHekXh2gSU+D7RaBbOqYb17UAH IDRtXvIG2F1vTqY3QQ/EDXto/JxLUkLzU6NKrT72FXey/4ipSYiZbHoMu+s43nnHyJIV9C 4S7H76p+VNS+GI+ZOEmoFWb/Laac0JZ8biryldmG9zNXofdEeQ83FmhgT7XY/A4mSny7RZ oCqEyzVrHjM7DEhRhu+segpWoQteIR2YC/FbSs8Jyn3fw5sjk/Depy41jkdXhg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1740975046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dl/sSRRmAlidqUJBPpS03beZfw7pUnogZTq0RzjHw0g=; b=tHbOdcXGdgUCvzrwihtgWDplWCsKq1VZUJDEMMV5wFl3fSEenHLEsFOZ10H07f+Gyt5ejl 2L6y1AILjnQKUseBrRiBCkU6er2Ad2f751HHUBTLhWSX+Ps70Y2JhqE/etKrHNLCgHkACD O+mG4TRH6XXRzDobVTED/hHr2acSSVqgUaIBWqx87Nw6HjgTy8WZN8qsVFYDLDGQPlJFEA Y44p4hQSsBCU08L52NkYfpCMBbHW1TF1f8d/VOSpwUyDFEy/MCc5apR97AAxyPZvwU6Zy1 6WigLjRYtBbx9y3o9mk/l0xo4xUNWtEAK/scOK9SQFf8hxlTpacPipevzy1CSQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Z5ljL2kXGzXZw; Mon, 03 Mar 2025 04:10:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5234AkgU057879; Mon, 3 Mar 2025 04:10:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5234AkQe057876; Mon, 3 Mar 2025 04:10:46 GMT (envelope-from git) Date: Mon, 3 Mar 2025 04:10:46 GMT Message-Id: <202503030410.5234AkQe057876@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Adam Weinberger Subject: git: c7aeeb0958ae - main - editors/vim: Update to 9.1.1164 (security, high severity) List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adamw X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c7aeeb0958ae7cba9ceb3f734c0f21e1722d8680 Auto-Submitted: auto-generated The branch main has been updated by adamw: URL: https://cgit.FreeBSD.org/ports/commit/?id=c7aeeb0958ae7cba9ceb3f734c0f21e1722d8680 commit c7aeeb0958ae7cba9ceb3f734c0f21e1722d8680 Author: Adam Weinberger AuthorDate: 2025-03-03 04:00:23 +0000 Commit: Adam Weinberger CommitDate: 2025-03-03 04:00:23 +0000 editors/vim: Update to 9.1.1164 (security, high severity) From the Github Advisory (https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3): Summary: Potential code execution with tar.vim and special crafted tar files. Description: Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Since commit 129a844 (Nov 11, 2024 runtime(tar): Update tar.vim to support permissions), the tar.vim plugin uses the ":read " ex command line to append below the cursor position, however the is not sanitized and is taken literaly from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). Impact: Impact is high but a user must be convinced to edit such a file using Vim which will reveal the filename, so a careful user may suspect some strange things going on. The Vim project would like to thank RyotaK (GMO Flatt Security Inc) for reporting this issue. The issue has been fixed as of Vim patch v9.1.1164. MFH: 2025Q1 Security: GHSA-wfmf-8626-q3r3 --- editors/vim/Makefile | 2 +- editors/vim/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/editors/vim/Makefile b/editors/vim/Makefile index 91196228d944..5a792383d5c5 100644 --- a/editors/vim/Makefile +++ b/editors/vim/Makefile @@ -1,5 +1,5 @@ PORTNAME= vim -PORTVERSION= 9.1.1117 +PORTVERSION= 9.1.1166 DISTVERSIONPREFIX= v CATEGORIES= editors diff --git a/editors/vim/distinfo b/editors/vim/distinfo index a911b32378e4..a0e434fc5d32 100644 --- a/editors/vim/distinfo +++ b/editors/vim/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1739731868 -SHA256 (vim-vim-v9.1.1117_GH0.tar.gz) = 5801f8c82a565127cf8a40900247e3093e1130b0bda915f122293413d70ed74a -SIZE (vim-vim-v9.1.1117_GH0.tar.gz) = 18487875 +TIMESTAMP = 1740973693 +SHA256 (vim-vim-v9.1.1166_GH0.tar.gz) = 18543682cffe511407ef6a61af6df842d60232fad58c7c02544ae5860107e6be +SIZE (vim-vim-v9.1.1166_GH0.tar.gz) = 18510701