mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-29 05:38:00 +00:00
Code Issues Releases Activity

Add a note about VIM's modeline support. This will instruct users

Browse Source 
that do not need the modeline support to disable it, since it contained
remote vulnerabilities.

Reviewed by:		simon
Approved by:		portsmgr (blanket, secteam), obrien (maintainer)
This commit is contained in:
Remko Lodder 2005-08-16 16:48:41 +00:00
parent a02d5df600
commit ec9063b927
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=140893
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
editors/vim/Makefile
View File

@ -173,6 +173,9 @@ post-install:
${ECHO_CMD} "x!" >> ${WRKDIR}/ex.script
${CP} -p ${TMPPLIST} ${TMPPLIST}.pre-share-vim
cd ${WRKDIR} ; ex < ex.script
@${ECHO_CMD}
@${CAT} ${PKGMESSAGE}
@${ECHO_CMD}
cklatest:
@-ncftpls \

6
editors/vim/pkg-message Normal file
View File

@ -0,0 +1,6 @@
SECURITY NOTE: The VIM software has had several remote vulnerabilities
discovered within VIM's modeline support. It allowed remote attackers to
execute arbitrary code as the user running VIM. All known problems
have been fixed, but the FreeBSD Security Team advises that VIM users
use 'set nomodeline' in ~/.vimrc to avoid the possibility of trojaned
text files.