Bug 174173

Summary:	CAN-2005-0069 vim unsafe temporary file usage.
Product:	[Fedora] Fedora	Reporter:	Mark J. Cox <mjc>
Component:	vim	Assignee:	Karsten Hopp <karsten>
Status:	CLOSED RAWHIDE	QA Contact:	David Lawrence <dkl>
Severity:	low	Docs Contact:
Priority:	medium
Version:	5	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,public=20050109
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-11-28 13:10:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2005-11-25 12:55:26 UTC

The flaw in vimspell seems to be present in the upstream 6.4 but the patch 
vim-6.3-tmpfile.patch included in fc4 is no longer included.  Please check to
see if this flaw is valid for the fc5test1 packages and close if not.

+++ This bug was initially created as a clone of Bug #144698 +++

------- Original comment by Josh Bressers (Security Response Team) on 2005.01.10
14:10 -------

Two insecure temporary file vulns have been reported to the debian BTS.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289560

The issues refer to the usage of temporary files using the process PID as the
"randomness".  I would not be surprised if this isn't the only scripts in vim
that do this.

-- Additional comment from karsten on 2005-01-12 05:37 EST --
FC-2/3 packages have been pushed and announced. FC-4 packages have been built

Comment 1 Karsten Hopp 2005-11-28 13:10:09 UTC

tcltags is o longer part of our vim packages
The flaw in vimspell is fixed in vim-6.4.000-4