Vulnerability-Lookup

OPENSUSE-SU-2024:11497-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

gvim-8.2.3408-1.2 on GA media

Severity

Moderate

Notes

Title of the patch: gvim-8.2.3408-1.2 on GA media

Description of the patch: These are all security issues fixed in the gvim-8.2.3408-1.2 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2024-11497

CVE-2007-2438

Affected products

Recommended 20 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2007-2953

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact moderate

CVE-2017-1000382

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact low

CVE-2017-5953

8.4 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact important

CVE-2017-6349

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact moderate

CVE-2017-6350

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact moderate

CVE-2019-12735

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 20 products, the same list as for CVE-2007-2438

Threats

Impact important

References

27 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2007-2438/	self
https://www.suse.com/security/cve/CVE-2007-2953/	self
https://www.suse.com/security/cve/CVE-2017-1000382/	self
https://www.suse.com/security/cve/CVE-2017-5953/	self
https://www.suse.com/security/cve/CVE-2017-6349/	self
https://www.suse.com/security/cve/CVE-2017-6350/	self
https://www.suse.com/security/cve/CVE-2019-12735/	self
https://www.suse.com/security/cve/CVE-2007-2438	external
https://bugzilla.suse.com/270496	external
https://bugzilla.suse.com/304172	external
https://www.suse.com/security/cve/CVE-2007-2953	external
https://bugzilla.suse.com/292433	external
https://www.suse.com/security/cve/CVE-2017-1000382	external
https://bugzilla.suse.com/1065958	external
https://bugzilla.suse.com/1070955	external
https://www.suse.com/security/cve/CVE-2017-5953	external
https://bugzilla.suse.com/1024724	external
https://bugzilla.suse.com/1123143	external
https://bugzilla.suse.com/1173534	external
https://www.suse.com/security/cve/CVE-2017-6349	external
https://bugzilla.suse.com/1027057	external
https://www.suse.com/security/cve/CVE-2017-6350	external
https://bugzilla.suse.com/1027053	external
https://www.suse.com/security/cve/CVE-2019-12735	external
https://bugzilla.suse.com/1137443	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "gvim-8.2.3408-1.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the gvim-8.2.3408-1.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11497",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11497-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2007-2438 page",
        "url": "https://www.suse.com/security/cve/CVE-2007-2438/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2007-2953 page",
        "url": "https://www.suse.com/security/cve/CVE-2007-2953/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-1000382 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-1000382/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5953 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5953/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6349 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6349/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-6350 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-6350/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-12735 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-12735/"
      }
    ],
    "title": "gvim-8.2.3408-1.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11497-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-8.2.3408-1.2.aarch64",
                "product": {
                  "name": "gvim-8.2.3408-1.2.aarch64",
                  "product_id": "gvim-8.2.3408-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-8.2.3408-1.2.aarch64",
                "product": {
                  "name": "vim-8.2.3408-1.2.aarch64",
                  "product_id": "vim-8.2.3408-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-8.2.3408-1.2.aarch64",
                "product": {
                  "name": "vim-data-8.2.3408-1.2.aarch64",
                  "product_id": "vim-data-8.2.3408-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-common-8.2.3408-1.2.aarch64",
                "product": {
                  "name": "vim-data-common-8.2.3408-1.2.aarch64",
                  "product_id": "vim-data-common-8.2.3408-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-8.2.3408-1.2.aarch64",
                "product": {
                  "name": "vim-small-8.2.3408-1.2.aarch64",
                  "product_id": "vim-small-8.2.3408-1.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-8.2.3408-1.2.ppc64le",
                "product": {
                  "name": "gvim-8.2.3408-1.2.ppc64le",
                  "product_id": "gvim-8.2.3408-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-8.2.3408-1.2.ppc64le",
                "product": {
                  "name": "vim-8.2.3408-1.2.ppc64le",
                  "product_id": "vim-8.2.3408-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-8.2.3408-1.2.ppc64le",
                "product": {
                  "name": "vim-data-8.2.3408-1.2.ppc64le",
                  "product_id": "vim-data-8.2.3408-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-common-8.2.3408-1.2.ppc64le",
                "product": {
                  "name": "vim-data-common-8.2.3408-1.2.ppc64le",
                  "product_id": "vim-data-common-8.2.3408-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-8.2.3408-1.2.ppc64le",
                "product": {
                  "name": "vim-small-8.2.3408-1.2.ppc64le",
                  "product_id": "vim-small-8.2.3408-1.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-8.2.3408-1.2.s390x",
                "product": {
                  "name": "gvim-8.2.3408-1.2.s390x",
                  "product_id": "gvim-8.2.3408-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-8.2.3408-1.2.s390x",
                "product": {
                  "name": "vim-8.2.3408-1.2.s390x",
                  "product_id": "vim-8.2.3408-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-8.2.3408-1.2.s390x",
                "product": {
                  "name": "vim-data-8.2.3408-1.2.s390x",
                  "product_id": "vim-data-8.2.3408-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-common-8.2.3408-1.2.s390x",
                "product": {
                  "name": "vim-data-common-8.2.3408-1.2.s390x",
                  "product_id": "vim-data-common-8.2.3408-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-8.2.3408-1.2.s390x",
                "product": {
                  "name": "vim-small-8.2.3408-1.2.s390x",
                  "product_id": "vim-small-8.2.3408-1.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-8.2.3408-1.2.x86_64",
                "product": {
                  "name": "gvim-8.2.3408-1.2.x86_64",
                  "product_id": "gvim-8.2.3408-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-8.2.3408-1.2.x86_64",
                "product": {
                  "name": "vim-8.2.3408-1.2.x86_64",
                  "product_id": "vim-8.2.3408-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-8.2.3408-1.2.x86_64",
                "product": {
                  "name": "vim-data-8.2.3408-1.2.x86_64",
                  "product_id": "vim-data-8.2.3408-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-common-8.2.3408-1.2.x86_64",
                "product": {
                  "name": "vim-data-common-8.2.3408-1.2.x86_64",
                  "product_id": "vim-data-common-8.2.3408-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-8.2.3408-1.2.x86_64",
                "product": {
                  "name": "vim-small-8.2.3408-1.2.x86_64",
                  "product_id": "vim-small-8.2.3408-1.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gvim-8.2.3408-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64"
        },
        "product_reference": "gvim-8.2.3408-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gvim-8.2.3408-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le"
        },
        "product_reference": "gvim-8.2.3408-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gvim-8.2.3408-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x"
        },
        "product_reference": "gvim-8.2.3408-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gvim-8.2.3408-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64"
        },
        "product_reference": "gvim-8.2.3408-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-8.2.3408-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64"
        },
        "product_reference": "vim-8.2.3408-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-8.2.3408-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le"
        },
        "product_reference": "vim-8.2.3408-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-8.2.3408-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x"
        },
        "product_reference": "vim-8.2.3408-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-8.2.3408-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64"
        },
        "product_reference": "vim-8.2.3408-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-8.2.3408-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64"
        },
        "product_reference": "vim-data-8.2.3408-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-8.2.3408-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le"
        },
        "product_reference": "vim-data-8.2.3408-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-8.2.3408-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x"
        },
        "product_reference": "vim-data-8.2.3408-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-8.2.3408-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64"
        },
        "product_reference": "vim-data-8.2.3408-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-8.2.3408-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64"
        },
        "product_reference": "vim-data-common-8.2.3408-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-8.2.3408-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le"
        },
        "product_reference": "vim-data-common-8.2.3408-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-8.2.3408-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x"
        },
        "product_reference": "vim-data-common-8.2.3408-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-8.2.3408-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64"
        },
        "product_reference": "vim-data-common-8.2.3408-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-8.2.3408-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64"
        },
        "product_reference": "vim-small-8.2.3408-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-8.2.3408-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le"
        },
        "product_reference": "vim-small-8.2.3408-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-8.2.3408-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x"
        },
        "product_reference": "vim-small-8.2.3408-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-small-8.2.3408-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        },
        "product_reference": "vim-small-8.2.3408-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2007-2438",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2007-2438"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2007-2438",
          "url": "https://www.suse.com/security/cve/CVE-2007-2438"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 270496 for CVE-2007-2438",
          "url": "https://bugzilla.suse.com/270496"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 304172 for CVE-2007-2438",
          "url": "https://bugzilla.suse.com/304172"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2007-2438"
    },
    {
      "cve": "CVE-2007-2953",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2007-2953"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2007-2953",
          "url": "https://www.suse.com/security/cve/CVE-2007-2953"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 292433 for CVE-2007-2953",
          "url": "https://bugzilla.suse.com/292433"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2007-2953"
    },
    {
      "cve": "CVE-2017-1000382",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-1000382"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-1000382",
          "url": "https://www.suse.com/security/cve/CVE-2017-1000382"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1065958 for CVE-2017-1000382",
          "url": "https://bugzilla.suse.com/1065958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1070955 for CVE-2017-1000382",
          "url": "https://bugzilla.suse.com/1070955"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-1000382"
    },
    {
      "cve": "CVE-2017-5953",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5953"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5953",
          "url": "https://www.suse.com/security/cve/CVE-2017-5953"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1024724 for CVE-2017-5953",
          "url": "https://bugzilla.suse.com/1024724"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123143 for CVE-2017-5953",
          "url": "https://bugzilla.suse.com/1123143"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173534 for CVE-2017-5953",
          "url": "https://bugzilla.suse.com/1173534"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-5953"
    },
    {
      "cve": "CVE-2017-6349",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6349"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6349",
          "url": "https://www.suse.com/security/cve/CVE-2017-6349"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027057 for CVE-2017-6349",
          "url": "https://bugzilla.suse.com/1027057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6349"
    },
    {
      "cve": "CVE-2017-6350",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-6350"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-6350",
          "url": "https://www.suse.com/security/cve/CVE-2017-6350"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1027053 for CVE-2017-6350",
          "url": "https://bugzilla.suse.com/1027053"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-6350"
    },
    {
      "cve": "CVE-2019-12735",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-12735"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
          "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-12735",
          "url": "https://www.suse.com/security/cve/CVE-2019-12735"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1137443 for CVE-2019-12735",
          "url": "https://bugzilla.suse.com/1137443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:gvim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-data-common-8.2.3408-1.2.x86_64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.aarch64",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.ppc64le",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.s390x",
            "openSUSE Tumbleweed:vim-small-8.2.3408-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-12735"
    }
  ]
}

CVE-2007-2438 (GCVE-0-2007-2438)

Vulnerability from cvelistv5 – Published: 2007-05-02 21:00 – Updated: 2024-08-07 13:42

Summary

The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

30 references

URL	Tags
http://secunia.com/advisories/25024	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/25159	third-party-advisoryx_refsource_SECUNIA
http://marc.info/?l=vim-dev&m=117762581821298&w=2	mailing-listx_refsource_MLIST
http://www.securitytracker.com/id?1018035	vdb-entryx_refsource_SECTRACK
http://www.ubuntu.com/usn/usn-463-1	vendor-advisoryx_refsource_UBUNTU
http://www.vupen.com/english/advisories/2007/1599	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/25182	third-party-advisoryx_refsource_SECUNIA
http://www.trustix.org/errata/2007/0017/	vendor-advisoryx_refsource_TRUSTIX
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://tech.groups.yahoo.com/group/vimdev/message/46627	x_refsource_MISC
http://marc.info/?l=vim-dev&m=117778983714029&w=2	mailing-listx_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2007-03…	vendor-advisoryx_refsource_REDHAT
http://tech.groups.yahoo.com/group/vimdev/message/46658	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.debian.org/security/2007/dsa-1364	vendor-advisoryx_refsource_DEBIAN
http://tech.groups.yahoo.com/group/vimdev/message/46645	x_refsource_CONFIRM
http://secunia.com/advisories/26653	third-party-advisoryx_refsource_SECUNIA
http://attrition.org/pipermail/vim/2007-May/001614.html	mailing-listx_refsource_VIM
http://www.attrition.org/pipermail/vim/2007-Augus…	mailing-listx_refsource_VIM
http://www.vim.org/news/news.php	x_refsource_CONFIRM
https://bugzilla.redhat.com/bugzilla/show_bug.cgi…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/23725	vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/467202/100…	mailing-listx_refsource_BUGTRAQ
http://tech.groups.yahoo.com/group/vimannounce/me…	mailing-listx_refsource_MLIST
http://secunia.com/advisories/25255	third-party-advisoryx_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/25432	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/25367	third-party-advisoryx_refsource_SECUNIA
http://osvdb.org/36250	vdb-entryx_refsource_OSVDB

Date Public

2007-04-26 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:42:32.149Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "25024",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25024"
          },
          {
            "name": "25159",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25159"
          },
          {
            "name": "[vim-dev] 20070426 feedkeys() allowed in sandbox",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=vim-dev\u0026m=117762581821298\u0026w=2"
          },
          {
            "name": "1018035",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018035"
          },
          {
            "name": "USN-463-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-463-1"
          },
          {
            "name": "ADV-2007-1599",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1599"
          },
          {
            "name": "25182",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25182"
          },
          {
            "name": "2007-0017",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2007/0017/"
          },
          {
            "name": "SUSE-SR:2007:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_12_sr.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://tech.groups.yahoo.com/group/vimdev/message/46627"
          },
          {
            "name": "[vim-dev] 20070428 Re: feedkeys() allowed in sandbox",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=vim-dev\u0026m=117778983714029\u0026w=2"
          },
          {
            "name": "RHSA-2007:0346",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0346.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://tech.groups.yahoo.com/group/vimdev/message/46658"
          },
          {
            "name": "vim-feedkeyswritefile-command-execution(34012)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34012"
          },
          {
            "name": "DSA-1364",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2007/dsa-1364"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tech.groups.yahoo.com/group/vimdev/message/46645"
          },
          {
            "name": "26653",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26653"
          },
          {
            "name": "20070513 OMG VIM VULN",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-May/001614.html"
          },
          {
            "name": "20070823 vim editor duplicates / clarifications",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001770.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vim.org/news/news.php"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238259"
          },
          {
            "name": "23725",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/23725"
          },
          {
            "name": "20070430 FLEA-2007-0014-1: vim",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/467202/100/0/threaded"
          },
          {
            "name": "[vimannounce] 20070512 Stable Vim version 7.1 has been released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://tech.groups.yahoo.com/group/vimannounce/message/178"
          },
          {
            "name": "25255",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25255"
          },
          {
            "name": "oval:org.mitre.oval:def:9876",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9876"
          },
          {
            "name": "MDKSA-2007:101",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:101"
          },
          {
            "name": "25432",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25432"
          },
          {
            "name": "25367",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25367"
          },
          {
            "name": "36250",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36250"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "25024",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25024"
        },
        {
          "name": "25159",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25159"
        },
        {
          "name": "[vim-dev] 20070426 feedkeys() allowed in sandbox",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=vim-dev\u0026m=117762581821298\u0026w=2"
        },
        {
          "name": "1018035",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018035"
        },
        {
          "name": "USN-463-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-463-1"
        },
        {
          "name": "ADV-2007-1599",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1599"
        },
        {
          "name": "25182",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25182"
        },
        {
          "name": "2007-0017",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2007/0017/"
        },
        {
          "name": "SUSE-SR:2007:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_12_sr.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://tech.groups.yahoo.com/group/vimdev/message/46627"
        },
        {
          "name": "[vim-dev] 20070428 Re: feedkeys() allowed in sandbox",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=vim-dev\u0026m=117778983714029\u0026w=2"
        },
        {
          "name": "RHSA-2007:0346",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0346.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://tech.groups.yahoo.com/group/vimdev/message/46658"
        },
        {
          "name": "vim-feedkeyswritefile-command-execution(34012)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34012"
        },
        {
          "name": "DSA-1364",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2007/dsa-1364"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tech.groups.yahoo.com/group/vimdev/message/46645"
        },
        {
          "name": "26653",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26653"
        },
        {
          "name": "20070513 OMG VIM VULN",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-May/001614.html"
        },
        {
          "name": "20070823 vim editor duplicates / clarifications",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001770.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vim.org/news/news.php"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238259"
        },
        {
          "name": "23725",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/23725"
        },
        {
          "name": "20070430 FLEA-2007-0014-1: vim",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/467202/100/0/threaded"
        },
        {
          "name": "[vimannounce] 20070512 Stable Vim version 7.1 has been released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://tech.groups.yahoo.com/group/vimannounce/message/178"
        },
        {
          "name": "25255",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25255"
        },
        {
          "name": "oval:org.mitre.oval:def:9876",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9876"
        },
        {
          "name": "MDKSA-2007:101",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:101"
        },
        {
          "name": "25432",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25432"
        },
        {
          "name": "25367",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25367"
        },
        {
          "name": "36250",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36250"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-2438",
    "datePublished": "2007-05-02T21:00:00.000Z",
    "dateReserved": "2007-05-01T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:42:32.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-2953 (GCVE-0-2007-2953)

Vulnerability from cvelistv5 – Published: 2007-07-31 10:00 – Updated: 2024-08-07 13:57

Summary

Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.

Severity

No CVSS data available.

CWE

Assigner

flexera mitre root

References

32 references

URL	Tags
http://www.vmware.com/security/advisories/VMSA-20…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/25095	vdb-entryx_refsource_BID
http://secunia.com/advisories/26822	third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/26522	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/26285	third-party-advisoryx_refsource_SECUNIA
https://issues.rpath.com/browse/RPL-1595	x_refsource_CONFIRM
http://secunia.com/advisories/26594	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/25941	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/32858	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33410	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-505-1	vendor-advisoryx_refsource_UBUNTU
http://www.redhat.com/support/errata/RHSA-2008-05…	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/archive/1/475076/100…	mailing-listx_refsource_BUGTRAQ
http://support.avaya.com/elmodocs2/security/ASA-2…	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2007/2687	vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2009/0904	vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2009/0033	vdb-entryx_refsource_VUPEN
http://www.securityfocus.com/archive/1/502322/100…	mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.trustix.org/errata/2007/0026/	vendor-advisoryx_refsource_TRUSTIX
http://www.debian.org/security/2007/dsa-1364	vendor-advisoryx_refsource_DEBIAN
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://secunia.com/secunia_research/2007-66/advisory/	x_refsource_MISC
http://secunia.com/advisories/26653	third-party-advisoryx_refsource_SECUNIA
http://www.attrition.org/pipermail/vim/2007-Augus…	mailing-listx_refsource_VIM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/26674	third-party-advisoryx_refsource_SECUNIA
ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039	x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2008-06…	vendor-advisoryx_refsource_REDHAT

Date Public

2007-07-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:57:54.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
          },
          {
            "name": "25095",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25095"
          },
          {
            "name": "26822",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26822"
          },
          {
            "name": "MDKSA-2007:168",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:168"
          },
          {
            "name": "26522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26522"
          },
          {
            "name": "26285",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26285"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1595"
          },
          {
            "name": "26594",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26594"
          },
          {
            "name": "25941",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25941"
          },
          {
            "name": "32858",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32858"
          },
          {
            "name": "33410",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33410"
          },
          {
            "name": "USN-505-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-505-1"
          },
          {
            "name": "RHSA-2008:0580",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
          },
          {
            "name": "20070730 FLEA-2007-0036-1 vim vim-minimal gvim",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/475076/100/100/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
          },
          {
            "name": "ADV-2007-2687",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2687"
          },
          {
            "name": "ADV-2009-0904",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0904"
          },
          {
            "name": "ADV-2009-0033",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0033"
          },
          {
            "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:6463",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6463"
          },
          {
            "name": "2007-0026",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2007/0026/"
          },
          {
            "name": "DSA-1364",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2007/dsa-1364"
          },
          {
            "name": "SUSE-SR:2007:018",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_18_sr.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://secunia.com/secunia_research/2007-66/advisory/"
          },
          {
            "name": "26653",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26653"
          },
          {
            "name": "20070823 vim editor duplicates / clarifications",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001770.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11549",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11549"
          },
          {
            "name": "vim-helptagsone-code-execution(35655)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35655"
          },
          {
            "name": "MDVSA-2008:236",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
          },
          {
            "name": "26674",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26674"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039"
          },
          {
            "name": "RHSA-2008:0617",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
        "shortName": "flexera"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
        },
        {
          "name": "25095",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25095"
        },
        {
          "name": "26822",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26822"
        },
        {
          "name": "MDKSA-2007:168",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:168"
        },
        {
          "name": "26522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26522"
        },
        {
          "name": "26285",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26285"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-1595"
        },
        {
          "name": "26594",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26594"
        },
        {
          "name": "25941",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25941"
        },
        {
          "name": "32858",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32858"
        },
        {
          "name": "33410",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33410"
        },
        {
          "name": "USN-505-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-505-1"
        },
        {
          "name": "RHSA-2008:0580",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
        },
        {
          "name": "20070730 FLEA-2007-0036-1 vim vim-minimal gvim",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/475076/100/100/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
        },
        {
          "name": "ADV-2007-2687",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2687"
        },
        {
          "name": "ADV-2009-0904",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0904"
        },
        {
          "name": "ADV-2009-0033",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0033"
        },
        {
          "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:6463",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6463"
        },
        {
          "name": "2007-0026",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2007/0026/"
        },
        {
          "name": "DSA-1364",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2007/dsa-1364"
        },
        {
          "name": "SUSE-SR:2007:018",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_18_sr.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://secunia.com/secunia_research/2007-66/advisory/"
        },
        {
          "name": "26653",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26653"
        },
        {
          "name": "20070823 vim editor duplicates / clarifications",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001770.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11549",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11549"
        },
        {
          "name": "vim-helptagsone-code-execution(35655)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35655"
        },
        {
          "name": "MDVSA-2008:236",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
        },
        {
          "name": "26674",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26674"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039"
        },
        {
          "name": "RHSA-2008:0617",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
          "ID": "CVE-2007-2953",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
            },
            {
              "name": "25095",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25095"
            },
            {
              "name": "26822",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26822"
            },
            {
              "name": "MDKSA-2007:168",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:168"
            },
            {
              "name": "26522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26522"
            },
            {
              "name": "26285",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26285"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-1595",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-1595"
            },
            {
              "name": "26594",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26594"
            },
            {
              "name": "25941",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25941"
            },
            {
              "name": "32858",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32858"
            },
            {
              "name": "33410",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33410"
            },
            {
              "name": "USN-505-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-505-1"
            },
            {
              "name": "RHSA-2008:0580",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
            },
            {
              "name": "20070730 FLEA-2007-0036-1 vim vim-minimal gvim",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/475076/100/100/threaded"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
            },
            {
              "name": "ADV-2007-2687",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2687"
            },
            {
              "name": "ADV-2009-0904",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0904"
            },
            {
              "name": "ADV-2009-0033",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0033"
            },
            {
              "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:6463",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6463"
            },
            {
              "name": "2007-0026",
              "refsource": "TRUSTIX",
              "url": "http://www.trustix.org/errata/2007/0026/"
            },
            {
              "name": "DSA-1364",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2007/dsa-1364"
            },
            {
              "name": "SUSE-SR:2007:018",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2007_18_sr.html"
            },
            {
              "name": "http://secunia.com/secunia_research/2007-66/advisory/",
              "refsource": "MISC",
              "url": "http://secunia.com/secunia_research/2007-66/advisory/"
            },
            {
              "name": "26653",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26653"
            },
            {
              "name": "20070823 vim editor duplicates / clarifications",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001770.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11549",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11549"
            },
            {
              "name": "vim-helptagsone-code-execution(35655)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35655"
            },
            {
              "name": "MDVSA-2008:236",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
            },
            {
              "name": "26674",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26674"
            },
            {
              "name": "ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039",
              "refsource": "CONFIRM",
              "url": "ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039"
            },
            {
              "name": "RHSA-2008:0617",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
    "assignerShortName": "flexera",
    "cveId": "CVE-2007-2953",
    "datePublished": "2007-07-31T10:00:00.000Z",
    "dateReserved": "2007-05-31T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:57:54.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-1000382 (GCVE-0-2017-1000382)

Vulnerability from cvelistv5 – Published: 2017-10-31 20:00 – Updated: 2024-08-05 22:00

Summary

VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

2 references

URL	Tags
http://security.cucumberlinux.com/security/detail…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2017/10/31/1	mailing-listx_refsource_MLIST

Date Public

2017-10-31 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:41.397Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security.cucumberlinux.com/security/details.php?id=120"
          },
          {
            "name": "[oss-security] 20171031 Fw: Security risk of vim swap files",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/10/31/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-06T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security.cucumberlinux.com/security/details.php?id=120"
        },
        {
          "name": "[oss-security] 20171031 Fw: Security risk of vim swap files",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/10/31/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-1000382",
          "REQUESTER": "hanno@hboeck.de",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://security.cucumberlinux.com/security/details.php?id=120",
              "refsource": "CONFIRM",
              "url": "http://security.cucumberlinux.com/security/details.php?id=120"
            },
            {
              "name": "[oss-security] 20171031 Fw: Security risk of vim swap files",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/10/31/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000382",
    "datePublished": "2017-10-31T20:00:00.000Z",
    "dateReserved": "2017-10-31T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:00:41.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5953 (GCVE-0-2017-5953)

Vulnerability from cvelistv5 – Published: 2017-02-10 06:51 – Updated: 2024-08-05 15:18

Summary

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://security.gentoo.org/glsa/201706-26	vendor-advisoryx_refsource_GENTOO
http://www.securityfocus.com/bid/96217	vdb-entryx_refsource_BID
http://www.debian.org/security/2017/dsa-3786	vendor-advisoryx_refsource_DEBIAN
https://github.com/vim/vim/commit/399c297aa93afe2…	x_refsource_CONFIRM
https://groups.google.com/forum/#%21topic/vim_dev…	x_refsource_CONFIRM
https://usn.ubuntu.com/4016-1/	vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4309-1/	vendor-advisoryx_refsource_UBUNTU

Date Public

2017-02-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:18:49.173Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201706-26",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-26"
          },
          {
            "name": "96217",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96217"
          },
          {
            "name": "DSA-3786",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3786"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY"
          },
          {
            "name": "USN-4016-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4016-1/"
          },
          {
            "name": "USN-4309-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4309-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-02-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-30T19:06:05.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201706-26",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-26"
        },
        {
          "name": "96217",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96217"
        },
        {
          "name": "DSA-3786",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3786"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY"
        },
        {
          "name": "USN-4016-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4016-1/"
        },
        {
          "name": "USN-4309-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4309-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-5953",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201706-26",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-26"
            },
            {
              "name": "96217",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96217"
            },
            {
              "name": "DSA-3786",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3786"
            },
            {
              "name": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d",
              "refsource": "CONFIRM",
              "url": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY"
            },
            {
              "name": "USN-4016-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4016-1/"
            },
            {
              "name": "USN-4309-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4309-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5953",
    "datePublished": "2017-02-10T06:51:00.000Z",
    "dateReserved": "2017-02-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:18:49.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-6349 (GCVE-0-2017-6349)

Vulnerability from cvelistv5 – Published: 2017-02-27 07:25 – Updated: 2024-08-05 15:25

Summary

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://security.gentoo.org/glsa/201706-26	vendor-advisoryx_refsource_GENTOO
http://www.securitytracker.com/id/1037949	vdb-entryx_refsource_SECTRACK
https://github.com/vim/vim/commit/3eb1637b1bba195…	x_refsource_MISC
http://www.securityfocus.com/bid/96451	vdb-entryx_refsource_BID
https://groups.google.com/forum/#%21topic/vim_dev…	x_refsource_MISC
https://groups.google.com/forum/#%21topic/vim_dev…	x_refsource_MISC
https://usn.ubuntu.com/4309-1/	vendor-advisoryx_refsource_UBUNTU

Date Public

2017-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:25:49.193Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201706-26",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-26"
          },
          {
            "name": "1037949",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037949"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c"
          },
          {
            "name": "96451",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96451"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y"
          },
          {
            "name": "USN-4309-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4309-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-30T19:06:03.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201706-26",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-26"
        },
        {
          "name": "1037949",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037949"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c"
        },
        {
          "name": "96451",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96451"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y"
        },
        {
          "name": "USN-4309-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4309-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-6349",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201706-26",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-26"
            },
            {
              "name": "1037949",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037949"
            },
            {
              "name": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c",
              "refsource": "MISC",
              "url": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c"
            },
            {
              "name": "96451",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96451"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/vim_dev/LAgsTcdSfNA",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/vim_dev/LAgsTcdSfNA"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y"
            },
            {
              "name": "USN-4309-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4309-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-6349",
    "datePublished": "2017-02-27T07:25:00.000Z",
    "dateReserved": "2017-02-26T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:25:49.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-6350 (GCVE-0-2017-6350)

Vulnerability from cvelistv5 – Published: 2017-02-27 07:25 – Updated: 2024-08-05 15:25

Summary

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
https://security.gentoo.org/glsa/201706-26	vendor-advisoryx_refsource_GENTOO
http://www.securitytracker.com/id/1037949	vdb-entryx_refsource_SECTRACK
https://github.com/vim/vim/commit/0c8485f0e493146…	x_refsource_MISC
https://groups.google.com/forum/#%21topic/vim_dev…	x_refsource_MISC
http://www.securityfocus.com/bid/96448	vdb-entryx_refsource_BID
https://groups.google.com/forum/#%21topic/vim_dev…	x_refsource_MISC
https://usn.ubuntu.com/4309-1/	vendor-advisoryx_refsource_UBUNTU

Date Public

2017-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:25:49.084Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201706-26",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-26"
          },
          {
            "name": "1037949",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037949"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/vim_dev/L_dOHOOiQ5Q"
          },
          {
            "name": "96448",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96448"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y"
          },
          {
            "name": "USN-4309-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4309-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-30T19:06:04.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "GLSA-201706-26",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-26"
        },
        {
          "name": "1037949",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037949"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/vim_dev/L_dOHOOiQ5Q"
        },
        {
          "name": "96448",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96448"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y"
        },
        {
          "name": "USN-4309-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4309-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-6350",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201706-26",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-26"
            },
            {
              "name": "1037949",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037949"
            },
            {
              "name": "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75",
              "refsource": "MISC",
              "url": "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/vim_dev/L_dOHOOiQ5Q",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/vim_dev/L_dOHOOiQ5Q"
            },
            {
              "name": "96448",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96448"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y"
            },
            {
              "name": "USN-4309-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4309-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-6350",
    "datePublished": "2017-02-27T07:25:00.000Z",
    "dateReserved": "2017-02-26T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:25:49.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-12735 (GCVE-0-2019-12735)

Vulnerability from cvelistv5 – Published: 2019-06-05 13:07 – Updated: 2025-11-11 16:50

Summary

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

32 references

URL	Tags
https://github.com/numirias/security/blob/master/…
https://github.com/vim/vim/commit/53575521406739c…
https://github.com/neovim/neovim/pull/10082
https://bugs.debian.org/930020
https://bugs.debian.org/930024
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://usn.ubuntu.com/4016-1/	vendor-advisory
https://usn.ubuntu.com/4016-2/	vendor-advisory
http://www.securityfocus.com/bid/108724	vdb-entry
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://www.debian.org/security/2019/dsa-4467	vendor-advisory
https://seclists.org/bugtraq/2019/Jun/33	mailing-list
https://support.f5.com/csp/article/K93144355
https://access.redhat.com/errata/RHSA-2019:1619	vendor-advisory
https://access.redhat.com/errata/RHSA-2019:1774	vendor-advisory
https://access.redhat.com/errata/RHSA-2019:1793	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://www.debian.org/security/2019/dsa-4487	vendor-advisory
https://seclists.org/bugtraq/2019/Jul/39	mailing-list
https://access.redhat.com/errata/RHSA-2019:1947	vendor-advisory
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://support.f5.com/csp/article/K93144355?utm_…
https://security.gentoo.org/glsa/202003-04	vendor-advisory
https://www.exploit-db.com/exploits/46973
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORAx_transferred
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORAx_transferred
https://support.f5.com/csp/article/K93144355?utm_…	x_refsource_CONFIRMx_transferred

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:32:54.206Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/neovim/neovim/pull/10082"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/930020"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/930024"
          },
          {
            "name": "FEDORA-2019-d79f89346c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/"
          },
          {
            "name": "USN-4016-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4016-1/"
          },
          {
            "name": "USN-4016-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4016-2/"
          },
          {
            "name": "108724",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108724"
          },
          {
            "name": "FEDORA-2019-dcd49378b8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/"
          },
          {
            "name": "openSUSE-SU-2019:1551",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2019:1562",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html"
          },
          {
            "name": "openSUSE-SU-2019:1561",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html"
          },
          {
            "name": "DSA-4467",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4467"
          },
          {
            "name": "20190624 [SECURITY] [DSA 4467-2] vim regression update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Jun/33"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K93144355"
          },
          {
            "name": "RHSA-2019:1619",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1619"
          },
          {
            "name": "RHSA-2019:1774",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1774"
          },
          {
            "name": "RHSA-2019:1793",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1793"
          },
          {
            "name": "openSUSE-SU-2019:1759",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html"
          },
          {
            "name": "openSUSE-SU-2019:1796",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html"
          },
          {
            "name": "DSA-4487",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4487"
          },
          {
            "name": "20190724 [SECURITY] [DSA 4487-1] neovim security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Jul/39"
          },
          {
            "name": "RHSA-2019:1947",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1947"
          },
          {
            "name": "[debian-lts-announce] 20190803 [SECURITY] [DLA 1871-1] vim security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html"
          },
          {
            "name": "openSUSE-SU-2019:1997",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K93144355?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          },
          {
            "name": "GLSA-202003-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-11T16:50:16.838Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md"
        },
        {
          "url": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040"
        },
        {
          "url": "https://github.com/neovim/neovim/pull/10082"
        },
        {
          "url": "https://bugs.debian.org/930020"
        },
        {
          "url": "https://bugs.debian.org/930024"
        },
        {
          "name": "FEDORA-2019-d79f89346c",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/"
        },
        {
          "name": "USN-4016-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4016-1/"
        },
        {
          "name": "USN-4016-2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4016-2/"
        },
        {
          "name": "108724",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/108724"
        },
        {
          "name": "FEDORA-2019-dcd49378b8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/"
        },
        {
          "name": "openSUSE-SU-2019:1551",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2019:1562",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html"
        },
        {
          "name": "openSUSE-SU-2019:1561",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html"
        },
        {
          "name": "DSA-4467",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4467"
        },
        {
          "name": "20190624 [SECURITY] [DSA 4467-2] vim regression update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Jun/33"
        },
        {
          "url": "https://support.f5.com/csp/article/K93144355"
        },
        {
          "name": "RHSA-2019:1619",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1619"
        },
        {
          "name": "RHSA-2019:1774",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1774"
        },
        {
          "name": "RHSA-2019:1793",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1793"
        },
        {
          "name": "openSUSE-SU-2019:1759",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html"
        },
        {
          "name": "openSUSE-SU-2019:1796",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html"
        },
        {
          "name": "DSA-4487",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4487"
        },
        {
          "name": "20190724 [SECURITY] [DSA 4487-1] neovim security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Jul/39"
        },
        {
          "name": "RHSA-2019:1947",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1947"
        },
        {
          "name": "[debian-lts-announce] 20190803 [SECURITY] [DLA 1871-1] vim security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html"
        },
        {
          "name": "openSUSE-SU-2019:1997",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html"
        },
        {
          "url": "https://support.f5.com/csp/article/K93144355?utm_source=f5support\u0026amp;utm_medium=RSS"
        },
        {
          "name": "GLSA-202003-04",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202003-04"
        },
        {
          "url": "https://www.exploit-db.com/exploits/46973"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12735",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md",
              "refsource": "MISC",
              "url": "https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md"
            },
            {
              "name": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040",
              "refsource": "MISC",
              "url": "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040"
            },
            {
              "name": "https://github.com/neovim/neovim/pull/10082",
              "refsource": "MISC",
              "url": "https://github.com/neovim/neovim/pull/10082"
            },
            {
              "name": "https://bugs.debian.org/930020",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/930020"
            },
            {
              "name": "https://bugs.debian.org/930024",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/930024"
            },
            {
              "name": "FEDORA-2019-d79f89346c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/"
            },
            {
              "name": "USN-4016-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4016-1/"
            },
            {
              "name": "USN-4016-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4016-2/"
            },
            {
              "name": "108724",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108724"
            },
            {
              "name": "FEDORA-2019-dcd49378b8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/"
            },
            {
              "name": "openSUSE-SU-2019:1551",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2019:1562",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html"
            },
            {
              "name": "openSUSE-SU-2019:1561",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html"
            },
            {
              "name": "DSA-4467",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4467"
            },
            {
              "name": "20190624 [SECURITY] [DSA 4467-2] vim regression update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Jun/33"
            },
            {
              "name": "https://support.f5.com/csp/article/K93144355",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K93144355"
            },
            {
              "name": "RHSA-2019:1619",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1619"
            },
            {
              "name": "RHSA-2019:1774",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1774"
            },
            {
              "name": "RHSA-2019:1793",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1793"
            },
            {
              "name": "openSUSE-SU-2019:1759",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html"
            },
            {
              "name": "openSUSE-SU-2019:1796",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html"
            },
            {
              "name": "DSA-4487",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4487"
            },
            {
              "name": "20190724 [SECURITY] [DSA 4487-1] neovim security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Jul/39"
            },
            {
              "name": "RHSA-2019:1947",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1947"
            },
            {
              "name": "[debian-lts-announce] 20190803 [SECURITY] [DLA 1871-1] vim security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html"
            },
            {
              "name": "openSUSE-SU-2019:1997",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html"
            },
            {
              "name": "https://support.f5.com/csp/article/K93144355?utm_source=f5support\u0026amp;utm_medium=RSS",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K93144355?utm_source=f5support\u0026amp;utm_medium=RSS"
            },
            {
              "name": "GLSA-202003-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12735",
    "datePublished": "2019-06-05T13:07:48.000Z",
    "dateReserved": "2019-06-05T00:00:00.000Z",
    "dateUpdated": "2025-11-11T16:50:16.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2024:11497-1

CVE-2007-2438 (GCVE-0-2007-2438)

CVE-2007-2953 (GCVE-0-2007-2953)

CVE-2017-1000382 (GCVE-0-2017-1000382)

CVE-2017-5953 (GCVE-0-2017-5953)

CVE-2017-6349 (GCVE-0-2017-6349)

CVE-2017-6350 (GCVE-0-2017-6350)

CVE-2019-12735 (GCVE-0-2019-12735)

Tags

Sightings

Nomenclature

Related by attack behaviour