CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-5953
https://notcve.org/view.php?id=CVE-2017-5953
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. vim en versiones anteriores a patch 8.0.0322 no valida adecuadamente los valores para la longitud del árbol cuando maneja un archivo spell, lo que puede resultar en un desbordamiento de entero en un sitio de asignación de memoria y un desbordamiento de búfer resultante. • http://www.debian.org/security/2017/dsa-3786 http://www.securityfocus.com/bid/96217 https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY https://security.gentoo.org/glsa/201706-26 https://usn.ubuntu.com/4016-1 https://usn.ubuntu.com/4309-1 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 81%CPEs: 2EXPL: 0CVE-2016-1248 – vim: Lack of validation of values for few options results in code exection
https://notcve.org/view.php?id=CVE-2016-1248
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. vim en versiones anteriores a patch 8.0.0056 no valida correctamente los valores para las opciones 'filetype', 'syntax' y 'keymap', lo que puede resulta en la ejecución de código arbitrario si se abre un archivo con una línea de modo especialmente manipulada. A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim. • http://openwall.com/lists/oss-security/2016/11/22/20 http://rhn.redhat.com/errata/RHSA-2016-2972.html http://www.debian.org/security/2016/dsa-3722 http://www.securityfocus.com/bid/94478 http://www.securitytracker.com/id/1037338 http://www.ubuntu.com/usn/USN-3139-1 https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelog https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040 https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a& • CWE-20: Improper Input Validation CWE-138: Improper Neutralization of Special Elements •
CVSS: 6.9EPSS: 0%CPEs: 21EXPL: 0CVE-2009-0316
https://notcve.org/view.php?id=CVE-2009-0316
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair. Una vulnerabilidad de ruta de búsqueda no confiable en el archivo src/if_python.c en la interfaz de Python en Vim en versiones anteriores a 7.2.045, permite a los usuarios locales ejecutar código arbitrario por medio de un archivo Python de tipo caballo de Troya en el directorio de trabajo actual, relacionado con una vulnerabilidad en la función PySys_SetArgv (CVE- 2008-5983), como es demostrado por una ruta de búsqueda errónea para el archivo plugin/bike.vim en bicyclerepair. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 http://www.mandriva.com/security/advisories?name=MDVSA-2009:047 http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html http://www.openwall.com/lists/oss-security/2009/01/26/2 http://www.securityf •
CVSS: 9.3EPSS: 0%CPEs: 18EXPL: 2CVE-2008-3074 – plugin: improper Implementation of shellescape() (arbitrary code execution)
https://notcve.org/view.php?id=CVE-2008-3074
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://marc.info/?l=bugtraq&m=121494431426308&w=2 http://secunia.com/advisories/34418 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 http://www.openwall.com/lists/oss-security/2008/07/07/1 http://www.openwall.com/lists/oss-security/2008/07/07/4 http://www.openwall. • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 0%CPEs: 17EXPL: 2CVE-2008-3075 – plugin: improper Implementation of shellescape() (arbitrary code execution)
https://notcve.org/view.php?id=CVE-2008-3075
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://marc.info/?l=bugtraq&m=121494431426308&w=2 http://secunia.com/advisories/34418 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 http://www.openwall.com/lists/oss-security/2008/07/07/1 http://www.openwall.com/lists/oss-security/2008/07/07/4 http://www.openwall. • CWE-94: Improper Control of Generation of Code ('Code Injection') •