vim -- multiple vulnerabilities in the netrw module

Jan Minar reports:

Applying the ``D'' to a file with a crafted file name, or inside a directory with a crafted directory name, can lead to arbitrary code execution.

[source]

Lack of sanitization throughout Netrw can lead to arbitrary code execution upon opening a directory with a crafted name.

[source]

The Vim Netrw Plugin shares the FTP user name and password across all FTP sessions. Every time Vim makes a new FTP connection, it sends the user name and password of the previous FTP session to the FTP server.

[source]