oss-sec mailing list archives

Re: Security risk of server side text editing in general and vim.tiny specifically


From: Ian Zimmerman <itz () very loosely org>
Date: Fri, 3 Nov 2017 11:12:43 -0700

On 2017-11-03 11:07, Fiedler Roman wrote:

Due to the recent discussion on vim swap file use, I expected also
attraction of of evil-minded to the topic of text editing security and
thus an increase in attack probability on server side text editing in
general. Therefore I wanted to review our software qualification
criteria for text editing on servers, where vim/vim.tiny is used and
probably update the SOPs and guidelines.

How much of this (and the parallel thread of course) applies to nvi?

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet, fetch the TXT record for the domain.


Current thread: