VIM security note for FreeBSD folks

Software

Installing vim on FreeBSD

If you install the vim text editor either from packages or ports, just a reminder from the FreeBSD Security Team:

SECURITY NOTE: The VIM software has had several remote vulnerabilities discovered within VIM’s modeline support. It allowed remote attackers to execute arbitrary code as the user running VIM. All known problems have been fixed, but the FreeBSD Security Team advises that VIM users use ‘set nomodeline’ in ~/.vimrc to avoid the possibility of trojaned text files.

If you install lots of ports at once or just happened to have vim installed automatically because it was listed as a dependency, you may not have see that message. Take care.

Author bio and support

Me!

Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!