[VIM] Gallery LFI - third party disputed vs vendor

[security curmudgeon]

CVE-2008-3600

Disclosure and Dispute:
http://archives.neohapsis.com/archives/bugtraq/2008-08/0091.html
http://archives.neohapsis.com/archives/bugtraq/2008-08/0115.html

Vendor:
http://gallery.menalto.com/gallery_1.5.8_released

One security issue was reported to us in private by the Digital Security 
Research Group [DSecRG] who were professional and are waiting until after 
this release to publish their findings.

--

who's right? =)